{ "Event": { "published": true, "date": "2024-03-12", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-03-12", "timestamp": 1710288181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "17fc866f-50ae-404e-a02a-ba78217973ad", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3532b725-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235847, "uuid": "8e7283bc-326f-42cd-8846-93514331ffdd", "comment": "Malware payload (Mirai)", "value": "3942661cb9ee465651f982aab8cead82", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235847, "uuid": "509005ed-96b1-4a07-a056-d5dc69c78e13", "comment": "Malware payload (Mirai)", "value": "0051fb14b98416bbe9f0b71f28d3a7c7da5245a4768b6ccbaf45535485fa36ba", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235847, "uuid": "d9ff0106-f390-466c-8f3e-3d043b83b4f9", "comment": "Malware payload (Mirai)", "value": "b7cdcfd29014d995959082fdfd7adf77b24eda0a", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235847, "uuid": "631f0f44-8248-42f9-9b77-72f6be2aa1c8", "comment": "Malware payload (Mirai)", "value": "44daed4e9bf5b40a6e5524713c1f14d986af15c083c55440c25ce3962ef89cecaae5136421c7025ad95a4caa016199a1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235847, "uuid": "b5e7fe52-9fc9-453b-bf6f-1c3f7cffe6fc", "value": "T10DD33B1BB4C180FDC4DAC5B44F9AF53ADD32B1A81238B16B27D4AB225E8DE315F1DA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235847, "uuid": "1484e003-e12e-496c-be66-229af804763b", "value": "3072:DX+wXNsuOXWYmqnQ8k11TosPipRlOaogXk72IElN7Ccb3wCymPd:DX+wXNsuOXWYmC0Puk7u8CymPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235847, "uuid": "8a0cc29c-6604-4a1b-9a77-3e27fda86ace", "value": 139576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235847, "uuid": "a658d0ba-de87-4a81-9d9d-c85fd7b74ca4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235847, "uuid": "9778689b-f6c8-4b35-8f36-08413669f7b2", "value": "3942661cb9ee465651f982aab8cead82", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf81fcf0-e06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710247675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247675, "uuid": "a7b19afa-486d-4ba0-9904-8a52e137a7c9", "comment": "Malware payload", "value": "e5d7a2dd2aafaa4e55c303c3533a36be", "object_relation": "md5", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247675, "uuid": "9d458153-04ab-472e-803a-a2b09b4ea16e", "comment": "Malware payload", "value": "008653065299f1e96ecd195fe23948cc3976210bc8d58ba0e1456db17270154d", "object_relation": "sha256", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247675, "uuid": "cb0a8d55-5301-446f-b400-fab6295c781e", "comment": "Malware payload", "value": "2e7dae389a400eb1e4e49fda39d9b4a282d735cb", "object_relation": "sha1", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247675, "uuid": "9623439f-f80f-4979-b540-666860b65a9f", "comment": "Malware payload", "value": "6e3becb88b7a1c20c10accfb4d6715a97ad18586a31c85145bb3a057449f5951f7e20a5207510e3b2db5ac2902f23416", "object_relation": "sha3-384", "Tag": [ { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247675, "uuid": "daf618c1-92cd-4357-9f23-5283853e2fc5", "value": "T10664D051FB80861AD495077049F78EAB6329FD419F924B0F320CF72D3DB03A56D2BA66", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247675, "uuid": "51a26275-c624-43eb-927f-af90122d592c", "value": "6144:LuunJJ7wY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVEGMIL0pDt//yVQt/NDH:LvJJ7t3bVEGMIIN/rt/BJZHe64TGF3G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710247675, "uuid": "12b479c7-69dd-43e0-a590-977c09fcf267", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710247675, "uuid": "131497dd-57b3-4217-8f69-c9629d4a5fe8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247675, "uuid": "aee02ed2-5f13-4815-abce-1cc51ac1bcc5", "value": "Arrival Notice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36030b19-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710238425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238425, "uuid": "22fdccb3-47f4-47dc-a814-fce55f8b9a74", "comment": "Malware payload (AgentTesla)", "value": "abf936d82bdad5fb4630db128f1157ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238425, "uuid": "ba1cce35-3a13-4c0d-b6be-eccec38d0693", "comment": "Malware payload (AgentTesla)", "value": "010c6f74aa7941262a2a7f930ed8c89ea50ce13f694d8ab56005bb5aa40b0298", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238425, "uuid": "744ffbeb-44f6-42df-8a54-8cc52e54f202", "comment": "Malware payload (AgentTesla)", "value": "80e17b6d469b3e5c540ef9f1be363b8d7ccaecf7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238425, "uuid": "6f1fff5d-b9a5-40ca-92d2-9e83657aa234", "comment": "Malware payload (AgentTesla)", "value": "1b84112d026e1d2a9a12de1a32c800f5e48ac037fd83f4cbdbbf6edc7ebb43ff935bc27e2fb18150c8d4a978aecaeb87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238425, "uuid": "ebe286ee-c956-4be4-8961-4c9affb3e13d", "value": "T1F1F412A9727D6F63C678B5F91134502887F122023826E7ED1DD376CB99F9F810A60E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238425, "uuid": "18ee02fe-9a60-45ec-949d-01fcc5357e40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238425, "uuid": "ac27a214-1a87-4b1c-b235-e6cb8679fb79", "value": "12288:1dsJTENl3lGk5ZhdeHeW9bbz17vfRTsjvzu4m6iqxLfE8i8XUkR:gxENlQk5ZkFB7fRyBpiULfE4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238425, "uuid": "4a825513-a7b8-4a24-9623-d847e9820184", "value": 742920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238425, "uuid": "08fb6180-11f7-4a52-8e2f-fa2dc6d4c25f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238425, "uuid": "217741de-fbab-446b-bf04-baac8971b9c8", "value": "DELIVERY CERTIFICATE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c550620-e00f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710206707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206707, "uuid": "3e88d88b-b232-4c59-a047-63aa32c14fc7", "comment": "Malware payload", "value": "6a2f11c55bfb75095f37d3ffeff4f964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206707, "uuid": "fe27ec35-e585-4a66-9fae-0e032aa40d9f", "comment": "Malware payload", "value": "017f1d43f09c92940572a0946dc1f16f87bfd6f4e80f46e2e4bffded05e9e8a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206707, "uuid": "fb3ce641-fe09-4913-a560-cebbe81c93e1", "comment": "Malware payload", "value": "0374b02096c0cb213bb63eaec6e7ab8a045bfa5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206707, "uuid": "4985b080-2412-49e0-839e-a987ddaa21c2", "comment": "Malware payload", "value": "84cccd633802db935fb5a838199f7a0815539bcfc810bcd3972d79b52fb86f4aa6b3e0dda9fa5940865f9d108556431a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206707, "uuid": "49876b61-8cfb-4068-962c-d6d192afb4ae", "value": "T1B4C5334CF4E680A2D786293155F583B15E7F3E340F1298EF83949AF44A35BE2DE32652", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206707, "uuid": "c815bee7-516f-4c2c-8493-704fac0a2aef", "value": "1494efab7f0f126ef84208e4d8b18d3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206707, "uuid": "99b2948e-659b-4267-b85b-404c45cfceb3", "value": "49152:81xFta+9Cq29SwZLXA3J1ry3pyO+fkKFi68EMJVonVco8Dlz9r:0tnwRaz8fEjUDlz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710206707, "uuid": "56741f4b-e549-418a-8cd2-dd8947b34d44", "value": 2696192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710206707, "uuid": "8cfee402-f7f2-4f93-bb38-8957b43cbb26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206707, "uuid": "51fc61e6-a12b-47a9-88d1-e89d46c34131", "value": "SecuriteInfo.com.Win32.MalwareX-gen.24746.18584", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e56e37f-e04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232453, "uuid": "92d2c104-df11-4c85-993d-70ab7f05be73", "comment": "Malware payload (Mirai)", "value": "64cb73b2f43d8c52ff30961f0007adeb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232453, "uuid": "229e8eb9-257e-4a06-80ca-46a99929eb0e", "comment": "Malware payload (Mirai)", "value": "02b66a167b575253969c72cc018ca9b7262160db4f67e1ef00b43988a3ea0049", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232453, "uuid": "d0ebaffa-7350-4726-959c-82e4710701ec", "comment": "Malware payload (Mirai)", "value": "95b3cf402aae5e30cf17a07f5a1a06c90bda0708", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232453, "uuid": "1fa52ca6-3b2e-4702-a460-4a0c868ffb45", "comment": "Malware payload (Mirai)", "value": "ffcbea7716aeccb5561f59d6967e80082ddf30e0fe4bf3a1dd142633b6b8b39cf8fc00939568efbcd07caed49ccbc2b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232453, "uuid": "0d13f99c-af2d-48ac-a878-05d82946450e", "value": "T1E2330881BC929912CAD42376FA2E01CD332663A9D1DF72179D216F1137DAC2F0D7B652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232453, "uuid": "e5fdedaf-12ba-4055-b4f5-5ad37f4d106b", "value": "768:B3oGCh6mppCK2FdThNutUGUiT5lBCC/L0wIefWBJNoiFS9PBNwoxBA1sH9A7E:9oGaTDC7F4Uitl0K0wIefAJd2Nxey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232453, "uuid": "2df3fb37-df2a-436e-ab2d-02da514d1449", "value": 54088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232453, "uuid": "c5dd2d49-0cc2-404e-aab3-87854f7d5af0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232453, "uuid": "802b3687-ec2c-43bd-84c6-8ee76fa4a52d", "value": "64cb73b2f43d8c52ff30961f0007adeb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "075a14cd-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1710232764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232764, "uuid": "d2064a61-cf58-42e6-89ec-947397c0cf46", "comment": "Malware payload (Loki)", "value": "eaee5df0875713fd78523ed4fdc30d39", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232764, "uuid": "787f55c2-a0fd-4855-933b-783dceb2cce1", "comment": "Malware payload (Loki)", "value": "04a1f48174dc5f7f63cc3c1831b34eb90f070a5b9e20470c94ee94357a3f73b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232764, "uuid": "67c3f45c-6d62-4d7d-a81a-da69ccefaa40", "comment": "Malware payload (Loki)", "value": "e31a30045bfcb92cfc9a80a69bcbe2087078cf0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232764, "uuid": "aa552ca6-c17e-437c-b751-7b435358f26f", "comment": "Malware payload (Loki)", "value": "30702ad2d33a67338cf8613cbf447205f29fe86cd393bf924522637a64ea715d2690637c2be6cb2320d702f0971f5dbb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232764, "uuid": "0455064b-131a-4a7f-8075-1ff284855cb4", "value": "T1A394C080DD98C21AC5968BFF64607966C775D62BB369FB8C7C8023CF5482B81B513B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232764, "uuid": "82c5efd2-3d63-4101-af1f-f57123fcd594", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232764, "uuid": "b76a04a7-c4be-445b-b37e-7149fc93361a", "value": "6144:j+hiQ1o15sp7QPBTiPqWzD2Kr+dsojcYdKRyMfztIo7xZqpgg4WnU/LBZloAITGZ:y7c1iCFHc1tIwaU/RorHzS352F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232764, "uuid": "90659c05-12fb-4985-81be-1205d78c935b", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232764, "uuid": "ec1d4948-63d5-433d-9cfa-23861a4be80f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232764, "uuid": "cef51cfa-ddeb-4cf1-8e28-e4174cdeda1e", "value": "eaee5df0875713fd78523ed4fdc30d39", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8768cc4-e023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1710215424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215424, "uuid": "500a78aa-1f61-4210-a0bf-fb57cb12167d", "comment": "Malware payload (Amadey)", "value": "d09a6cfe8d762be3b2511a013806b78b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215424, "uuid": "519442f7-7222-48cc-9346-20b31de0bc3e", "comment": "Malware payload (Amadey)", "value": "0520b688648369e393b8f603c33dcc1f138a7a6239025b276824d6dbe9c517fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215424, "uuid": "8d7facf7-ed68-4ac5-84d2-3229550afd2e", "comment": "Malware payload (Amadey)", "value": "31704d8ff3eb5914ef86e5f2f8421865e1485726", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215424, "uuid": "3f74d9ac-8a7a-4fcd-81af-4f861be10d04", "comment": "Malware payload (Amadey)", "value": "997a65ec32d2efa39e65093202f2af1435c2991c90e17df1efda230af06ece0c9f5f39a1ff82172c0ea839f99e6d037a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215424, "uuid": "46781280-b915-430d-b457-0c29214720a6", "value": "T11DC41807BA468B63E29F1736C5EF04103BF8DD4367EBDB8A748926991843366DD01B4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215424, "uuid": "977247f4-dcd2-433d-90da-1c680fd15255", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215424, "uuid": "a2715b6b-0b92-4fa0-8c11-18eaabe8a204", "value": "6144:QC33M/KJCOQtchbHSENHJ74xtpW9V2fxzIwS625ij6txlznqi+NehaXoDzvdf:QC3jhFJ4fM2VS625w6txlzqDUhamT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710215424, "uuid": "aff205de-be82-42cc-a8a0-6ea3d215ced7", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710215424, "uuid": "71b1446f-870d-4189-8eed-f23f0e6a0367", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215424, "uuid": "d5f5a7c5-4be6-4014-ab6f-a41da2e2a446", "value": "d09a6cfe8d762be3b2511a013806b78b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9876ef48-e044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710229571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229571, "uuid": "699c7ab9-8ec9-4229-b488-fe8ff18c095b", "comment": "Malware payload (Mirai)", "value": "8f4e41636a6663da7940269ffd8fa002", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229571, "uuid": "4aae28e8-ecd2-4c5f-b05e-34304e634614", "comment": "Malware payload (Mirai)", "value": "06225b5b492695fb0b57dc5232ade11b93e0ed653b2282268825484a36730324", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229571, "uuid": "2fb22734-f85d-4d90-a565-c9affd3d18a3", "comment": "Malware payload (Mirai)", "value": "044e563edcc5ac298a640a373bdcb0b988bcad80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229571, "uuid": "745f5e25-bf0c-48ea-93ae-42dbcfcec409", "comment": "Malware payload (Mirai)", "value": "8f945df75b1bd6372ddc57077b91a742ed7341c3132124b041ae9eb2466ce6bf0ac3ad3f758c70dc89210af55cdcd98e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229571, "uuid": "ed2ddd9f-892f-46c4-a6af-039a41b76849", "value": "T13713F895FC928A7FC6D0137ABB6E2B4C37A163D4C3CF7213992017613A8611F5D22E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229571, "uuid": "84110578-8a5b-41a1-b71f-7c30d44d96ab", "value": "768:AROkDTk9Igep+xMG50qc4qOHOVfjPrlzjDkYuCWod4k0JNtYPiZz14ew14:AJIIgep+SG50O+fTrlDkYuCEtwiZyX1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229571, "uuid": "ea191b9a-a86a-4086-b84d-7e5e8d209033", "value": 43196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229571, "uuid": "7c2f1bcb-2f5e-4c34-ab38-a4d349732429", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229571, "uuid": "67d91d7d-98e6-4198-a72f-6a67073430e1", "value": "8f4e41636a6663da7940269ffd8fa002", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627780bf-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1710229910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229910, "uuid": "81fabac8-c243-4d97-84c0-03bc4f78f22e", "comment": "Malware payload (Stealc)", "value": "b281dbb84dc000eb3d1695c72b6c9862", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229910, "uuid": "7f63dac3-52e5-470f-8291-1d3f763792ff", "comment": "Malware payload (Stealc)", "value": "06575b2e99b28a20f0017c03e6e799a3218fe308c334b746eb5b52786995436e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229910, "uuid": "3e80c375-3a8c-4504-8cd6-916b370ae5d4", "comment": "Malware payload (Stealc)", "value": "8025c97592b9719c954bf49b78941996ac2e3f4d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229910, "uuid": "464984f5-cfa3-44f7-9623-49d895ff0c05", "comment": "Malware payload (Stealc)", "value": "85d8162ff0244c7c83bd5bfd438019bce2e7e6c7c212a6d6920042362b98f87fc8fd45dddff8287762454420a7161578", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229910, "uuid": "d512722a-d042-42a1-ab66-59ad09e9ba66", "value": "T18A64F16076A0907ED1774A705C77B6908A3F78822F70154B6FE8263E5FB27E04A75F0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229910, "uuid": "1fc2d1ad-2f16-46d5-9b20-f02c7d4e57c2", "value": "1bb1293e85bd1bd33a1b6174e328565d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229910, "uuid": "db2358ed-faf1-4b95-907d-b856158279ee", "value": "6144:Z4vh9yj/laGUujk0RZiWAFo/9Alo222ADIt7ClDOQbqFuYyeaxKGX3:qvh9yzop+RZTAFQ2AD87J0yuY+lX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229910, "uuid": "dbe15c91-2169-4594-a69b-676aa71ae702", "value": 336384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229910, "uuid": "60889f66-8e6c-4f49-8b6c-597baa2e3cd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229910, "uuid": "977ad343-dbf7-4dc7-9441-7cbd3ce3206d", "value": "b281dbb84dc000eb3d1695c72b6c9862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91bd2f18-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1710229989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229989, "uuid": "b78e1033-fc85-4e89-99c1-ee98e621c624", "comment": "Malware payload (Loki)", "value": "68894cfd6f4a1bfff344f54760726df7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229989, "uuid": "f69fcdd2-b5c2-4c20-bc84-92646c5dc539", "comment": "Malware payload (Loki)", "value": "07c1a82c5517f92f78a830e12cb1813430c4e02e02c1b6d16cd8d632f80d92f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229989, "uuid": "765098a2-fab4-4fc4-8cf2-7bca4774839d", "comment": "Malware payload (Loki)", "value": "9ae844e3abd601bf5daca1e3ebe331591388493e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229989, "uuid": "e1a50d15-9402-4dc7-bcb1-8296093cdedf", "comment": "Malware payload (Loki)", "value": "1abd6511d20063955015ecd763e8f2a226a714f4842584dab962938ce25601535cdb01f41a27162ebec4a47c2bcb9792", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229989, "uuid": "9b68c4dd-914c-492a-87f2-ad93a01982ab", "value": "T1FA94CF0065F84257DF4D06BE5C582A4187779731D21FFB4BB87067B60A033E2AE92A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229989, "uuid": "e603a332-5330-429a-869e-36fa8b0486f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229989, "uuid": "33467a5c-d758-4124-b226-7fc3f695a5bf", "value": "6144:T+hiQ1o1W5UoKOy2Y5Dd1yh2gReb6d0VOw8qRBGEPU49ogCvrFbtKSyISGgEJFs:ifrKOeRch2g0zVf8qRkSU4+gOxlcHwF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229989, "uuid": "9b8760f5-c9b9-4ec8-85a9-9b7991ac31eb", "value": 441856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229989, "uuid": "ae5c00f3-6e9d-4ed1-99bb-761dbb34e968", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229989, "uuid": "74e2d3a6-3f3e-4e5c-957c-bad10ac303b6", "value": "68894cfd6f4a1bfff344f54760726df7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a363626-e066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710243935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243935, "uuid": "578515d5-d7f4-4b26-a906-2da09db7c599", "comment": "Malware payload (Gafgyt)", "value": "e448163f384f058ecda92f5806def3e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243935, "uuid": "404d6461-2b65-4375-9e29-b74483dee450", "comment": "Malware payload (Gafgyt)", "value": "084678b82d5b9f78ecf5188d691dbfd3ac3e4d303ac2c9e82102e30d3bdbb6d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243935, "uuid": "0e282f9b-3d26-46b8-a15c-b1f3dc75b794", "comment": "Malware payload (Gafgyt)", "value": "7b81f34b93b55afdb4b5e2b02e37af32098304dc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243935, "uuid": "065c815b-f02a-433b-8193-d6a7ae73f9cd", "comment": "Malware payload (Gafgyt)", "value": "6958162d7b88a8eb67708f6588c12292d403f07f3c53c44224f99a44a9e2edddfbd6b6f85e9c4ec2f571f24ffa0423da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243935, "uuid": "00ba541c-f46a-4139-bc9b-0131b462d414", "value": "T12AE3971A7E21DF7FF559827047B38E30969836E636E18185F26CE6481E7138E241FBE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243935, "uuid": "9e5dc823-84ca-4306-ae5d-4cae2b6731be", "value": "3072:G7iL2tEmEh02tKMMHqVtewuAawqIcq88Ek32oQKqqc5hspZC:G7iJmEh02tKMMHqVtewo+Z3Bbzq95hWC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243935, "uuid": "43f066de-d280-435f-a301-92feab1e327a", "value": 148064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243935, "uuid": "0fb1b7b4-4b96-4603-b40b-a01017961b3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243935, "uuid": "0e0447bc-e99e-429a-b755-0411998fea67", "value": "e448163f384f058ecda92f5806def3e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f7f6e1-e05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238887, "uuid": "a4336de3-a99b-4673-82d3-0054cd278f05", "comment": "Malware payload (Mirai)", "value": "3b2b28c80b967690ce2fb5a144d408fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238887, "uuid": "9a1216ef-0dde-430a-b2c0-c3fdcda4d7c1", "comment": "Malware payload (Mirai)", "value": "084864682ca42dd66807478c28e96dd3605bc3621ab0447dc99eaaa3478dee81", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238887, "uuid": "57d954e5-ec0c-41f6-9185-1718281c08ba", "comment": "Malware payload (Mirai)", "value": "5952255e20dfa1a14f3df432fc9ce26178d74e3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238887, "uuid": "8f3d3e04-b4ae-4852-a461-e4599a458da7", "comment": "Malware payload (Mirai)", "value": "a1de97f901eabdfd95d0fc7fd482746f8b920d339aaab8cf7c6ad4be5654487701a981cb1b87f350c5bd91619f1da61c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238887, "uuid": "c29b8e9f-11a0-4751-908b-136e7fac605c", "value": "T136B36D2175352A13C0E595BB21F78711B2F267DD26E4C76E7E720E8EFF203406A869B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238887, "uuid": "e2f03315-315a-446f-a955-fd113a1e371d", "value": "1536:ilm+OUw25tT9QbTELhcYjVOGxlT/5eCKHMERdPUg70ehRfA75oIT1JtDhg/q35Fh:LphEomlTI04xAV1Jjfj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238887, "uuid": "d747b343-60ee-46d9-9318-ba8226190246", "value": 108736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238887, "uuid": "f896a366-546e-477f-a1f7-d0d8efdc561d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238887, "uuid": "d8c7a982-8643-44c7-bab9-c63ad3105029", "value": "3b2b28c80b967690ce2fb5a144d408fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61d26f7e-e09c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710267275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710267275, "uuid": "76190f76-bb42-4b29-a766-e5cef240c77a", "comment": "Malware payload", "value": "64522b13b5255a57d03aa13d35cbea50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710267275, "uuid": "ecc18ccc-e417-491d-a776-a01fd81b6493", "comment": "Malware payload", "value": "09379e588e65b9401b397df97858f730ef425eeb135e3f93bd1d3c22d9ff9dbe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710267275, "uuid": "957eea12-bb76-4ad3-ba89-17ea7bae5369", "comment": "Malware payload", "value": "f47b8dc2602f42c1a780e9988fc4b6ebe27b481b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710267275, "uuid": "52ee1d6e-f64b-450b-b14f-be18546de425", "comment": "Malware payload", "value": "c6653c6cab90e9b3ab7a12cbf11db29bd7dcbc6b4c22e25d04ad20e8ecc1130c5410243df23ab4b358c202aa2a7f57fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710267275, "uuid": "4c26d441-7b82-4828-b0ba-3dc2373e76dd", "value": "T1F5D48D0BB302971ACD526D7C85A1C3602735FF69FB439A0BB1BFFB5526431A01EA52D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710267275, "uuid": "f9b9f8c3-c76a-4a93-a4ed-472be758edc3", "value": "12288:xldxkxswcXKC2zNWfm2YRm5sm2YRm5hkxswcXKC2zNW:P/ZX9uWfm2Yysm2YyhZX9uW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710267275, "uuid": "ea4cf48c-09e4-4769-8ec1-26b05edfd70b", "value": 631808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710267275, "uuid": "389e4d59-7c55-413e-ad07-484f63c7081e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710267275, "uuid": "a2a03df1-c628-46d9-b97d-70efa266b512", "value": "New Invoice.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b9766f6-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235804, "uuid": "960aab6f-2eff-4468-83a2-350662cea369", "comment": "Malware payload (Mirai)", "value": "dcffe161f9ae3f672cf9c52a83f0252c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235804, "uuid": "529398ef-37c7-4489-b749-e694807408c8", "comment": "Malware payload (Mirai)", "value": "09e79169fdf0e4631e131d1a3ff295abcf8af4bdafdc9421e5dd34a603f5c0d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235804, "uuid": "ce6e6d4e-1180-4aa7-a318-1c9e7b7335c6", "comment": "Malware payload (Mirai)", "value": "a15a219628412255ce6da9ed7bce830dfee30409", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235804, "uuid": "05344717-92c3-49b4-9f7a-f24b3be97643", "comment": "Malware payload (Mirai)", "value": "a2774a0c9204719176d32fb0584df0d7770aaf289b56f11406705370308a4a009244188956f9d71a74616f0407ed5f7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235804, "uuid": "ad0bc0f1-e55d-4dea-b56c-cfd926198a4a", "value": "T1BBA34AC2F801EC6EFC4ED3B6449B480DB66193506FA32D62FFA7799BAC720D14925E44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235804, "uuid": "776e558b-c5e1-400f-887f-9b93189cbc57", "value": "1536:7heuBHnI6ynFBdUSgtFDMUMsatpH4LgXndyieyXbSGQ9qP1ExFDGC9oLK5R1NN8u:7o6mBM1N16bBJzaUAwowyfVF1R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235804, "uuid": "f44e3741-fe25-4913-90bd-d622fb80f061", "value": 106160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235804, "uuid": "e5f901f2-77f0-4013-957f-0bb1032732b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235804, "uuid": "e32c95e5-1954-440f-9fe3-8f122f2e4757", "value": "dcffe161f9ae3f672cf9c52a83f0252c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c952e74-e065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1710243590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243590, "uuid": "af08d659-c5c0-495e-8ebd-f057d835ebcd", "comment": "Malware payload (DiscordTokenStealer)", "value": "3de5d4da1d860de2389a63757df5aef6", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243590, "uuid": "bf748105-9ac7-454b-9bcb-0310bbc84140", "comment": "Malware payload (DiscordTokenStealer)", "value": "0a9c90b8c46c6d38d48f838df56530f0b3558e5415212abc0278c08b882c301e", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243590, "uuid": "32523d5a-db14-47e1-a045-aac7a16e7aae", "comment": "Malware payload (DiscordTokenStealer)", "value": "0e1453bf09d623338db66a93b63f3cd09368ce39", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243590, "uuid": "f8c196e8-820e-4fbe-be69-85cc9ed79cbf", "comment": "Malware payload (DiscordTokenStealer)", "value": "2ae5dd4ae450e92b0513a9802dddf82bfeff00461dac977ab61665f2b0fbb98d663d6671ca9dfcdc70b5e35f28ed2361", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243590, "uuid": "c48c42e8-0b68-45fe-92d9-9aa3cd669797", "value": "T1B9474A02FB909ADAC668813689EA43913771FC581F279BD75A44B37C3C767C86DA83C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243590, "uuid": "3f3d3d52-dac4-4e31-bb8f-52703fd5da96", "value": "f2dec354dafd3d7e669b500e1f959937", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243590, "uuid": "6d0de192-54bf-4736-bdca-50468f37a1d3", "value": "393216:catbmIvunTpIMdLCtWp5NJriYN9cXWo6UXE4Vv6MMDJbeWJyI+67bsQuIhf:Xb+uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243590, "uuid": "ce0ec2d5-bdbf-4c40-9a0b-35371354c70c", "value": 26841208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243590, "uuid": "ad120e15-d7b1-481d-877d-428034cfc94e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243590, "uuid": "e762c531-d565-4322-8257-1a1512392eca", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b039e5c-e05b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710239454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239454, "uuid": "6cb70b0e-a108-4a7f-bbe1-80d9ada51521", "comment": "Malware payload (Formbook)", "value": "265f5bbd9a54d7b318b1ea8025f9e8f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239454, "uuid": "a623aa22-db51-4d05-aef6-d0f36b81c3a8", "comment": "Malware payload (Formbook)", "value": "0bbae7b1fa7409d04758a925564ee20f1627cc9fa6011c3a7bd55fe37c200f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239454, "uuid": "266a5075-4d9e-4b28-9580-6aca3249ad7e", "comment": "Malware payload (Formbook)", "value": "a2beb9b82a272e62e8cdb93f599c3d2c41a4224a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239454, "uuid": "9554b727-d3d8-449f-b753-3deb4cadd421", "comment": "Malware payload (Formbook)", "value": "6b2fbedba318a20ed2aed224e6d8ac121285521572cd6730577dca05a9426f944d90444187b0e5c79a61e1fc9ea30b9b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239454, "uuid": "7b96337b-9b2e-461b-adfe-bedb3416714c", "value": "T161E42369BA6826A1DB380F724463E1E9277669032E74D94F7CDDF88A9DF03E4413805F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239454, "uuid": "10907898-e88e-4b5f-9631-95acfbd71412", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239454, "uuid": "d2e6a2c4-c8c9-4573-9d46-fe748055cdaf", "value": "12288:bsJTENl31uiKlp3UEVrpEIbMbrn2QYFhLiUi84AosjzaZZ5jmp7KinsXDcLkR:YxENlwtlp1HEAArn2QYFhLiR83osHGZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710239454, "uuid": "7339b0c4-4e12-49d8-8b69-fe79c17917d7", "value": 712200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710239454, "uuid": "bf96dc57-b9e6-4464-b91f-a17589f82046", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239454, "uuid": "b3d5cedd-4a06-4beb-8ec0-27c6ee0664fc", "value": "PO 1402-16 AH.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67aa70d-e0ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1710275202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710275202, "uuid": "3af273dc-16ad-433e-85ad-88472cd414c9", "comment": "Malware payload (Stealc)", "value": "88d8a1aa36d48e28d506abe4fa3e7322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710275202, "uuid": "3d13c4a1-9751-48eb-aac0-dd48e54dc233", "comment": "Malware payload (Stealc)", "value": "0d124edbaa3ae482812d236f4ed05b094085949a794d69b0bebc679b4a011720", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710275202, "uuid": "45e6eaf8-af72-439a-bd94-f3ea528c6a38", "comment": "Malware payload (Stealc)", "value": "03385cdb977d1e7effbe5f9c1712b723778d3ea7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710275202, "uuid": "6584a4de-cf28-42d9-bedb-a76f8fe352a6", "comment": "Malware payload (Stealc)", "value": "30516b062c86f060958f5e9589b4fe31d851c3699aa3fe5e54d2df55dacdd7fcd7cd12d8454d67f15279d303bc7bfba8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710275202, "uuid": "da703600-8f18-4d9c-a3a2-eda160b5edb8", "value": "T184E523A7655484E3DEB746301539CB7ABFB6AD2380B5410F6318BE9D38323C26E69317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710275202, "uuid": "db58af35-abc8-4adb-a72e-6fc4dce1c78a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710275202, "uuid": "845a3aa4-2e43-4de8-97b3-caf68fbaf6de", "value": "12288:XNzcTCPYV/oVQ+mJkP5isjJyhKxE5n9g8FYE2gXqi:XNzcTUYV3J25iDl9VYE2Mqi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710275202, "uuid": "3077de11-ebbb-4ed4-be8b-d7cb557f55ed", "value": 3161488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710275202, "uuid": "e62f0877-e200-488e-bf53-30a175259574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710275202, "uuid": "c1e30a6a-e92f-42b5-a034-c7409abf6547", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ba471aa-e097-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710265037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710265037, "uuid": "8676b0ba-6723-4626-b005-cbce82b0422c", "comment": "Malware payload", "value": "2694402a15bf74cb83e092b8423092a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710265037, "uuid": "1a936c21-853d-4ce9-851d-30d5628d1cd1", "comment": "Malware payload", "value": "0dc0c7008345a2e24a5db520b0b3c8ea64feadeb7306bab846b91000a0fa650b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710265037, "uuid": "1ccc314e-b5f8-4647-b6ea-af3cdc62a40d", "comment": "Malware payload", "value": "34da23de12e08166c024d81e8f633ff89f6a3405", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710265037, "uuid": "d0787856-6541-47ea-8853-1dfea4380241", "comment": "Malware payload", "value": "28755b599fd5ea9fa9ad85d11916fde96b0cbc5f02b72a031e0ce07c57979763021687ac23505b9a072ce8ca00e964cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710265037, "uuid": "7727b8bb-fcde-46e3-9fa4-0440e21b1b05", "value": "T17AD51306B6678922C28D3F36C4CB922353715983B757F34A398A12D66D173FA9D0A3C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710265037, "uuid": "b1919ae1-6927-485e-bdc7-8f7030c15e4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710265037, "uuid": "4800c153-c8cb-4b13-ac51-80ca10649d63", "value": "49152:i53QoQ/1HPZVpvkUFokbF1OSyYWcWvv5vYaf1409GkMVz:iw/pZVpJF9p1OSyncUvpYCA9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710265037, "uuid": "2a60a22c-e92d-4032-9e98-20b6460710f2", "value": 2767360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710265037, "uuid": "d037fa8f-884b-43af-b5f4-2263322e0172", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710265037, "uuid": "798c7b08-2726-414f-8641-86be63daa1fb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2766b79d-e07e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710254292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254292, "uuid": "65ae5c30-d6fe-4213-8e92-51b22354dab2", "comment": "Malware payload", "value": "42b838cf8bdf67400525e128d917f6e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254292, "uuid": "f34170a2-b0a1-418e-9762-b79521ab54d2", "comment": "Malware payload", "value": "0e4ffba62ce9a464aa1b7ff9f1e55ace8f51ff1e15102d856f801a81f8b4607d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254292, "uuid": "6243c0a6-5353-4495-a5c9-9ecfaffa5084", "comment": "Malware payload", "value": "a578f6faec738912dba8c41e7abe1502c46d0cae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254292, "uuid": "8e423e04-27a6-46dd-a731-07327bfc58da", "comment": "Malware payload", "value": "0fede33084a1032c7d1a797f27d9f145c1bc5621298d4659475671683476e14172e413e4726de1407f19be1a72479f77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254292, "uuid": "a22e1a31-0d20-479b-8e65-ad8a465d8192", "value": "T1E6A3E081ABFCC4F6D3950BFC983315601174911791C6FA1AB4AC294E3E663D8A315BFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254292, "uuid": "68dec09a-750c-4760-afeb-14a38d56c47c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254292, "uuid": "3b471492-6bd6-4a79-97ab-2f96a59df237", "value": "1536:iyhXGdtNbMAxKOcuS11Phbiyn2TCdfGyJVGJkyrt517EwM+9hQ9xKOcuS11PhbiW:i8XG/NbMAsISnRGPJkGt74DsISnRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710254292, "uuid": "d19e4257-0a00-4129-b25b-cc4d2bd15f60", "value": 103424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710254292, "uuid": "8ef58a96-65c8-4dd9-8390-c4f01fb354c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254292, "uuid": "6eb9f654-c0bd-4482-be75-84e13174fa3a", "value": "SecuriteInfo.com.FileRepMalware.8637.26913", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feb657ef-e03f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710227595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227595, "uuid": "2c3b6c41-c20d-472b-9e76-6956c63c924c", "comment": "Malware payload (GuLoader)", "value": "596355c93557be85d3536f2c1b1610dd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227595, "uuid": "e8ba181d-9fca-4cb4-9d20-20fe87cf788e", "comment": "Malware payload (GuLoader)", "value": "0f52e759ab223f9a571c2f78d7131c3fa8e13e855872909c643630794813c011", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227595, "uuid": "aeba68ca-7dcc-407f-a68a-8cfe94fea919", "comment": "Malware payload (GuLoader)", "value": "8daa0cb814561261a726e1fe2d9f59f3afa8e09f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227595, "uuid": "75e75afc-1e64-4508-9e87-3a35093f2604", "comment": "Malware payload (GuLoader)", "value": "06f87e5ffe5c1ae205f449659108c8f38b8b57cb1b500f85e54cdc6ae343aff834366d0e05e5355d9c50bb4ef4b2a0af", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227595, "uuid": "4903f33e-82a0-4ccc-b615-a088badf0d4b", "value": "T12CC249A46E429065015B12FBE44E467AD828A0FB0D9156BA3E4CF93D1C17358FF5EC8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227595, "uuid": "e1e29c49-d727-4a28-9019-a66821fedb85", "value": "384:4jnuHUwHJylKmGIrWaO7hcCfDtaBTW9NJFS7TuVdeMq5V4ECxZ3bmw6YlVpr2wOL:44pylZGeQluuYMk4ECP3bbTD1OWS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227595, "uuid": "a00d3214-0c30-4324-b0b0-439d461a4d19", "value": 28112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227595, "uuid": "9fe76d67-2168-4d9f-8d53-ad6fd0a84d5d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227595, "uuid": "b5ddfc61-ea17-420c-a03c-36929226c154", "value": "RFQ- Titan Machinery SRL2024100044-11RO.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb92b852-e072-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710249467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249467, "uuid": "3270f100-9611-4851-aa93-0b98b5858595", "comment": "Malware payload", "value": "0fcf69828395dfb2bd66edab305a046a", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249467, "uuid": "917a4a9d-9a58-441f-ad27-523f18269e0a", "comment": "Malware payload", "value": "0fb0ed1b2fdbaf2a6db0cbb64f2b9455cea7d2bb2065ae019d9ca960b416f5d9", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249467, "uuid": "5c7581da-712e-4609-b875-5da023e0ccf9", "comment": "Malware payload", "value": "2592f0e76d5c74d7aaf2cabe3c5caa0865211bcc", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249467, "uuid": "ba4282c7-83f7-4e38-a6f0-8b609da131c8", "comment": "Malware payload", "value": "751347ce679b47819cfaccabf70dbbe495e809f9e40b21e3fc6123efec984ab5d17ecec4c95070224354850bc80805f9", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249467, "uuid": "cb18f68a-9fb2-42ff-9eae-d955b4905067", "value": "T18F64D051BB918716E855433149F78AAB6326FC416F924F0F324CF72D3DB07A42D2BA62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249467, "uuid": "0331790b-4a08-4171-92c9-edba504149d9", "value": "6144:2nunJRRWY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbV+TMIN5X6gFmiXZH+Jgi:2yJRRP3bV+TMINtXpeJqYzFHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710249467, "uuid": "b23b43b4-3153-43e4-8b7d-9304f4a22c70", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710249467, "uuid": "cc4ad414-9a05-4f64-bb5b-eba771529f7d", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249467, "uuid": "6e58abf6-9e66-41c5-b1b3-7a15ddc557ba", "value": "PURCHASE ORDER.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4cb851-e0c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710286133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286133, "uuid": "d27a4e8b-0bd6-45a4-a4f0-c305e5f38721", "comment": "Malware payload", "value": "e55737aa31c86a2d4a29663a7dc6cae3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286133, "uuid": "76e17475-358d-43a1-bb9d-5e81d4a2ffbd", "comment": "Malware payload", "value": "0fba13c834e6a50d40c8b52c116953147d8d3cb4d1ce700e9961444fda5f6b8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286133, "uuid": "1e3e8fcd-90e8-44ec-8202-f95a8af4321e", "comment": "Malware payload", "value": "e9b563123c7a80d35f359229b1780270464f05eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286133, "uuid": "47d247a4-6787-4fc9-ac0d-e37814b40dc7", "comment": "Malware payload", "value": "14c4a2d3492a3b8011d8121835aa935c9545f1cab562ff706479a1f98fdab41898c99685ace756e7d90fab4a558dd603", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286133, "uuid": "21ccca0e-2489-4b93-9078-03c9e5ef7c32", "value": "T19747338764AF6079CB25C13492F4FEB519AF1D7DCB6B60264CC6335AC039B962B6102F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286133, "uuid": "3dba79cb-6c64-49c8-939c-36d7f5e93f64", "value": "4d65eb009a5bed7efce0091931f34eb4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286133, "uuid": "54fd2f7e-b8bb-43ce-bb28-d6db70ef9c2a", "value": "786432:EXuw6GnSUmq0BAMBkQS8LpUtQqDx4vIWxIu3c33fAW:Ej6fH6MGQ3pxqDqwWeu3evAW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710286133, "uuid": "5df54d3f-ef43-4c3d-a6b2-fd838fa1495c", "value": 26523248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710286133, "uuid": "0e1d6be3-13c3-47c3-9da5-22e19c47d76a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286133, "uuid": "1bfc0a75-413c-4565-8969-132201b7d7c2", "value": "SecuriteInfo.com.Program.Unwanted.5457.28396.309", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73fde347-e046-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710230369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230369, "uuid": "612075a0-3398-403c-b535-bd6e5e61edca", "comment": "Malware payload (AgentTesla)", "value": "a5e504aa627790a96c3b74c202aaa3c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230369, "uuid": "67f61bb9-24d2-45a1-ba61-2fb08a3f4903", "comment": "Malware payload (AgentTesla)", "value": "12c41cd166ce0369329c7577b3c1b4eb32da2dc12ab14189224c42afa52074ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230369, "uuid": "90ef47f6-10b5-4639-9b16-831625dcbec0", "comment": "Malware payload (AgentTesla)", "value": "f46e620f912fa19a220cf2afea400e02ec1b607f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230369, "uuid": "1954b671-57bb-4e09-9fb0-66b5dafbbafd", "comment": "Malware payload (AgentTesla)", "value": "83e5b6ac93e9e036675a695b979804f322332dfe5387115ece6e2bba60d27d5d367fb1b7373b3e08c7d3b4ecdd6eb9a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710230369, "uuid": "605ed17f-f4cc-4521-9570-8bf3aef9751a", "value": "T185F43399AAC046C107FDD53A2349C9C3B23550ABAA307DB715CC5BFE6238E5B9B16C4C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710230369, "uuid": "88d14729-93c9-4d91-a9f4-ee7141796c87", "value": "12288:nVdWJ7R6r83Ll8lWN+RGTn3S2mPyjcqn7xGdVpgwzS94sWjfICt/t55VQA/J6r:nVq7sUh81mePo9nQv6wmbMtFVQas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710230369, "uuid": "4cf0f965-5611-400a-9f23-738185aa2961", "value": 741277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710230369, "uuid": "e6648d5c-5593-44b7-ab5a-13753deb9e8b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710230369, "uuid": "e576136d-cae8-4a46-9b58-178489618ab9", "value": "Payment Details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06c3904a-e00c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710205275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710205275, "uuid": "3f8cf38b-674a-4bb7-b721-ae13739251de", "comment": "Malware payload", "value": "a968f4fdf6d959c08ff7098ae4a0a695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710205275, "uuid": "b47e28bb-bfaf-4c4c-8714-c199c7073999", "comment": "Malware payload", "value": "137dbb9145273fb20f9ad4ccfd90ba02b43c5e599ff3623f3d74a9ec573e8208", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710205275, "uuid": "54deb9ed-e58d-4632-828f-11c399da3439", "comment": "Malware payload", "value": "a61bbcae48ac79d08382c637c3b11f04b58d8408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710205275, "uuid": "07e740da-4108-493c-9b6f-e635058b6979", "comment": "Malware payload", "value": "77a0bd4818171344496e62641161ba10a47a224b494f31cfd552403878bb173f654ffd80ed135076cc00baf4c0b72623", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710205275, "uuid": "cd15a01c-79ff-46f3-a529-c92a0a454623", "value": "T149A6AE15A3E801A2D57BDA34CA66D333CAB17CA25639D10F0958F2451F73E62CB6F326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710205275, "uuid": "38f18dc7-ea20-4f8a-ba97-59ac9e188773", "value": "3657f2967936289b619c119d1232b7f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710205275, "uuid": "b2d9b5d3-acea-4b89-98f3-d7cc58a9ea72", "value": "98304:mBhfqJYDdmAgSDL845IIqfSqkkoY3m5/44H8cchiDZAFGxZVDGNET4:TedYSDL8cmSqBoYMTHxc4D8GxZVDGNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710205275, "uuid": "3cdabae4-74e0-4892-bb2d-70af7b012187", "value": 9999432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710205275, "uuid": "d8cbf09b-cd46-44f0-b524-afbd6657f4ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710205275, "uuid": "b381376a-c108-4c76-b1fa-fb8a8baba6e7", "value": "SecuriteInfo.com.Win64.TrojanX-gen.28133.22494", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0268629-e07b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710253233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253233, "uuid": "30de5edf-c775-4019-8044-5505844962a9", "comment": "Malware payload (GuLoader)", "value": "2a3f6f5c74093de646faacba9df9cc2e", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253233, "uuid": "615a0e94-4d7d-4279-b080-8001112acb5a", "comment": "Malware payload (GuLoader)", "value": "13b8f7865e3e04b300490ad1ddd3ee8730e67f4d16a54716a5e6011acf392c5c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253233, "uuid": "22da4f21-a39e-4fcc-b838-fc9dc71bbda7", "comment": "Malware payload (GuLoader)", "value": "eba38a8346b1d92d024fc1dcc454127921d6c641", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253233, "uuid": "3785923a-c6b6-4caf-99e9-59ecce0d1cf6", "comment": "Malware payload (GuLoader)", "value": "a338601a3b03e7f8d28f29cffc9d40e75cebd4907b5e055edfcf0dbb05238604c6fd0a8c0d22f77d5473f51e71d5571d", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253233, "uuid": "5afca2c3-1195-4e96-b2ad-feeef1fed952", "value": "T10ED24ADA8E43101546A316F7E88E0574CD2840FBB2264AB53E6CF6785D02B583E7E6CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253233, "uuid": "06c32c0d-ad18-41f7-995e-580258e10b46", "value": "384:fm2TcwTrL/YQeHScGWMobjmyViSURPeumpZaW3Bzijxs/vPfetZWNHLd5zbvYv:+2QwJp+jmaApmRBcohHL3/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710253233, "uuid": "6a29f64c-5dde-466f-969c-7faa4c553d01", "value": 28648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710253233, "uuid": "07514828-7d1f-4afc-9b82-331f834ca7a8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253233, "uuid": "bf814a23-2dda-46e2-a6b5-a5ac1e4f4291", "value": "Arbourvitae.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e870c4-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710229944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229944, "uuid": "969af90b-9816-4614-a640-146e1b6e5f97", "comment": "Malware payload (Mirai)", "value": "45722ddf8d7062eb4a5fd2769eb2328a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229944, "uuid": "2653e6f7-c502-48be-aed2-c159d10b84f6", "comment": "Malware payload (Mirai)", "value": "144c79cee8ed84e6feaf4b8f1ddd8bbfe9e29762b73853bb9713a32659515e3b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229944, "uuid": "653c85d2-a81a-491e-a2fc-05a7c7146728", "comment": "Malware payload (Mirai)", "value": "ffbc32665751ca723126928944e9145dbf2a44f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229944, "uuid": "c13063d5-22d3-4336-b0a5-06d587cbc2d4", "comment": "Malware payload (Mirai)", "value": "3e9ccbf19dae1cc36f1e538f03bcd016d2d6d7eb8127cbf42b94c0a339bc90587a0d9ad47100681c628028ac2607fc38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229944, "uuid": "770379f2-1fc1-4633-aeb0-362cac2e777e", "value": "T189A37CC5FB43E4F6E85305B12037BB368B33E479602AEA42E3756D32AC91511DA1B76C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229944, "uuid": "586ee38f-8d60-41c1-899f-3e2312059a54", "value": "1536:BkN4jxOr3y86uVqc9qzrKC2mksIH3HZYeelztTfxUCn5S24IoTH:KGjxOr3vqc9umCmsIH35Yv1FXQAoTH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229944, "uuid": "7c21a879-08da-44fe-9edf-a2fc91cc501d", "value": 104108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229944, "uuid": "d0cfdaab-241c-42c0-a46d-696ebd5f7fd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229944, "uuid": "e0259f64-892a-4f53-a2ab-d27cc89ebaa1", "value": "45722ddf8d7062eb4a5fd2769eb2328a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a0f39e-e0c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710282636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282636, "uuid": "af2c3930-755f-41f6-9672-7cb6662e5752", "comment": "Malware payload", "value": "34bee52bb6894f61069ca66f4b02be31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282636, "uuid": "04b4d11c-e8c9-4d19-a845-5f9393c2a76b", "comment": "Malware payload", "value": "155dcfc2a65007a7ddaee6144a1444667e8e5a42cf385adf09d28927c25ef4a8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282636, "uuid": "31627b8d-a977-4520-9abf-acd23caa87b8", "comment": "Malware payload", "value": "a984d706379f86873ca90ee43b39fb1213f9196b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282636, "uuid": "2a725685-453d-4477-be43-dd8e63d69346", "comment": "Malware payload", "value": "16d66d3215a0539a41bdcad33adee0ff1a17aa9d3247b7196937fa795fbe83ed3a0dbb438ca3393776470fd43d4c07ef", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282636, "uuid": "92f31115-e715-4355-bf99-80612ef1bfbd", "value": "T194130856F9924E26C2D4137BB67E5A8C3370A7E8C2DFB213CC506B61B98640F0D96E90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282636, "uuid": "443e9e29-d36a-441b-8a75-b54a6519dfd1", "value": "768:gJkHF2WvG5lMFj/7mMPaNzAo89OLJHOmt42PG8otVVdPQOGCOKJfF9wTwbZn:+o2SG5yN7mM0zaYt4eGDV1QOGCO62TwR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710282636, "uuid": "a371c938-2e66-48e4-9548-907ea6719de6", "value": 44616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710282636, "uuid": "43c52f92-426a-4621-8b64-d085c6eab55a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282636, "uuid": "66e2090f-e821-45ad-b04e-e1861cb39aad", "value": "skid.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e536d4-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1710227599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227599, "uuid": "021df09c-0a06-4e5e-9fd1-581449721162", "comment": "Malware payload (AZORult)", "value": "8ce482c332e9ec80d47c64edc65b6a70", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227599, "uuid": "40292aa0-0212-465f-a38d-7160d0fcb12f", "comment": "Malware payload (AZORult)", "value": "1562364a3048ef8e00720e3bc0c6588ed7a4d8f560c5bdafa5b19503e159a8a8", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227599, "uuid": "f2b56e38-3da3-4d98-821e-28bb8418dde4", "comment": "Malware payload (AZORult)", "value": "c4ceaf9bf0791068f650f28674f09ac345bdc3cd", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227599, "uuid": "988a6b7e-c597-4843-b42f-48b2b64b3dcc", "comment": "Malware payload (AZORult)", "value": "ddeb27cd69f07c7489488ad6a2cd3a53fcb72fbbc0f9bd3c9eaee0edbc4f0d2e844aa17ada8623c33be51b0a2bd2c29a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227599, "uuid": "547930f5-c02a-4ca8-b016-20551bde3d5a", "value": "T15DC249659D8220A50A4B06FBB00E8A75D81814FB5E1049793D9CF53E6C63394BF6EDCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227599, "uuid": "57956c69-2969-4362-9ce6-cdb457fe92ed", "value": "768:4OMHs3w3rf5xGsmKQblBW2MQK/fFXSiP10E:403w3rDTpQZjOSiPD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227599, "uuid": "89ebd053-d531-4b58-b6d4-35516e2d4e5a", "value": 27832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227599, "uuid": "efefded3-ca5d-4a1d-b7f7-ecb9d5fd15f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227599, "uuid": "4a813a6c-19f7-415a-869f-bce315912973", "value": "DRAFT BILL OF LADING.PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c808d2-e07e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710254633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254633, "uuid": "66db0dad-5960-4d49-b843-7ca4f9da49b6", "comment": "Malware payload", "value": "f611596577edec928576f46bb384516d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254633, "uuid": "0e42553b-2d98-441e-867a-db2c3be9ea51", "comment": "Malware payload", "value": "15846490706281424a0f5b0b7d3e6ea92173dbeaf6a10a566f4dc8a6a1e977bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254633, "uuid": "f47b9544-7c4c-4e9a-a773-9e7dab182337", "comment": "Malware payload", "value": "898776e0183017b8be099285e6088b22a57d6e06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254633, "uuid": "c12ab15c-4ed0-47da-b026-aa5ced67be50", "comment": "Malware payload", "value": "a204950b0494cb053a63e3e93655505b8313b7e9a986a092ffccea91fffd5a3027875d45e2210a07d05ebbd557ec4c81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254633, "uuid": "9b50b41d-3be8-4a33-81e0-0116460cbd9a", "value": "T1D6E65A47F85150E8C5AED231C6658262BB707C885B3027DB7B60F6B82B73BD46B7A350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254633, "uuid": "ce6b2430-49b2-4d95-aac6-44cc863b53b1", "value": "65892a964106b5e0c6c363fdf21975eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254633, "uuid": "68309649-4105-489c-a01e-980d3e551aa4", "value": "98304:GSZi4DstKdftWhnd0Om2pvhrE8E/gyDErvqje+FH:vKtEUnd0YI8EVDwOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710254633, "uuid": "1539cf4b-4f7b-49ba-83cb-0386830c5142", "value": 14196736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710254633, "uuid": "e094d562-2c02-48f3-9af2-4a29a3917b3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254633, "uuid": "8652c6cf-4374-4cc3-9a08-3375cc895d2a", "value": "mspvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2583ec97-e062-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1710242263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242263, "uuid": "9870a255-e484-4dbe-ad6e-09954da4970a", "comment": "Malware payload (DiscordTokenStealer)", "value": "ce138653424ebdf94bea7738587a95ff", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242263, "uuid": "9b48e8b0-1b06-40de-b273-143ced8eced6", "comment": "Malware payload (DiscordTokenStealer)", "value": "15bbb2b1116cbb397e608a914c7cc8249f1bdae84bfc25c871928b79599410e0", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242263, "uuid": "1fd31b6b-10aa-4140-ba09-4df1dd40a845", "comment": "Malware payload (DiscordTokenStealer)", "value": "7bcebcf41143e40386e7e67069a24f035cf911a2", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242263, "uuid": "302d2d66-be49-41fa-9754-6006bf36ea4b", "comment": "Malware payload (DiscordTokenStealer)", "value": "c08df27ed3777d8191b500a3840886fb82ac42b56ce452890c9d19811964bd3101717ab4fb821a3bc70368fdd2d6a7b3", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test", "colour": "#E8E8B4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242263, "uuid": "77483ec7-b577-473d-9178-f8a383b032ca", "value": "T1CC474B02FB919ADAC668823689EA43913770FC141F279BD75A04B37C7C767C96DA83C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242263, "uuid": "5567eb05-6f98-4d8e-ba19-40136f4ccb77", "value": "f2dec354dafd3d7e669b500e1f959937", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242263, "uuid": "8e329cee-e83e-490a-80d3-067dc4956894", "value": "393216:VWUXIVvunTpIMdL2tWG5NJDKYN9EX0oCUXk4VN6MMDJbeWJvIEZoY/NRCkvAwokw:bXKA/kDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710242263, "uuid": "54e3948b-c7e3-4582-bba2-639b819323b3", "value": 26840184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710242263, "uuid": "804381d3-6cc9-4535-a7dd-1d762c48d43e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242263, "uuid": "704b192f-659b-4191-8fe0-5c4189335822", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53578ec2-e05d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710240192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240192, "uuid": "8c9fc5a4-0448-4f3c-b0e6-b9cd8b266c08", "comment": "Malware payload (AgentTesla)", "value": "bd03bc3f2976c3d0c0f583a42ca3f2d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240192, "uuid": "14e853d6-1acf-4bf7-9c00-f4269c911db8", "comment": "Malware payload (AgentTesla)", "value": "16070427277a25e433acebd492bd3381f325213bea13daa1d128e89c62f90604", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240192, "uuid": "461214cf-49ae-4600-89e3-c654c38ba075", "comment": "Malware payload (AgentTesla)", "value": "e6550e7aa515300f4fbdf679356fd7eab90f78d8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240192, "uuid": "6a242ffa-02ed-4501-bafa-e8f3055d61cd", "comment": "Malware payload (AgentTesla)", "value": "2e6f2d7ce85d08537e28602a010926716aea918c1353d7f2f9e98d54a075d63b5fcba8e8f5b152bd07d970025eae703d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710240192, "uuid": "f59d289a-cc91-4764-a49c-2b639b9210a1", "value": "T168F4239005F37D77F338808A234BA40E7BB547AA2922468C5C6557B7337E299F99339C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710240192, "uuid": "79e8cec9-7232-422b-a20d-e808758ad086", "value": "12288:BNkWpNfv32eFNLxrVm5a3Q1uMM0ri5cRCevdNSev466vcL809Hj3/Ydku3h:nZ93nHrVS1O2lSEh6SfRPYyuR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710240192, "uuid": "dd381142-d357-40ab-9122-502a660d2b1d", "value": 736102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710240192, "uuid": "c401835c-7e31-4ff9-96cd-9252c2212b28", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710240192, "uuid": "a6e2dbc1-4089-41d1-8a9b-1708f50c9b66", "value": "Payment Details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4094cea-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235711, "uuid": "e706ea80-17cb-4b63-a69b-6bcb3565eab1", "comment": "Malware payload (Gafgyt)", "value": "7f238f3f8332cb37a35648ceb350fe43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235711, "uuid": "92de7292-26bd-4b20-9d6b-fa9255c11639", "comment": "Malware payload (Gafgyt)", "value": "1712cb4d8935d26e95265047c02f17da73b048f7ab92e6778a028c5e28c032e0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235711, "uuid": "83a48537-3594-48f4-a6f6-319abacec4f3", "comment": "Malware payload (Gafgyt)", "value": "1b967dc716a69a4b48725cf39e884708342e7d19", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235711, "uuid": "46d98b82-ec4c-497b-9eff-602fed514230", "comment": "Malware payload (Gafgyt)", "value": "adf1ce955b24b158a579849db8fbf41bacf783819a97d926aa4506fa882ad9d5f2ee4440eed6dc120ecd51ff67a05913", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235711, "uuid": "05b13743-389d-47d4-8928-927c919672af", "value": "T17EF3C9978A31D9B7C053E9323A756158B39CBB6A0B0F09CB7E1E75620E1E0CF641F664", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235711, "uuid": "5a7c9a5c-5a19-4eeb-8007-44ff8e236a28", "value": "3072:DaeQlJawzedF0GFGv29Frh+0LS0LUD0afD+tKIj:DTQHawzK/Gu9K0LS0LUD0afD+tKIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235711, "uuid": "a004d086-02ad-4071-8cf1-c25d58590c70", "value": 171645, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235711, "uuid": "3f5df41a-6651-457c-8619-90f878424686", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235711, "uuid": "879f6404-4607-498b-9410-6afbef9adef9", "value": "7f238f3f8332cb37a35648ceb350fe43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38097a8b-e00b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (njrat)", "timestamp": 1710204928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204928, "uuid": "ae76b8ad-5fd8-4d91-bc2d-7847a1083d39", "comment": "Malware payload (njrat)", "value": "399f052f7f86b7b295aab10c692cd8ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204928, "uuid": "fcf45474-68c7-4be6-b862-f5a20f596976", "comment": "Malware payload (njrat)", "value": "1803b1cbe56a3cfc509bbb46378154d64fca3d2589b3d2643d3576f23566a693", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204928, "uuid": "d51ebf15-2346-468c-a538-51d4a8a3a613", "comment": "Malware payload (njrat)", "value": "f1d253009b34b518965aa39cc7372273d7deeb38", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204928, "uuid": "b4b12595-0cee-49b9-85c1-5ab46ac1ff0b", "comment": "Malware payload (njrat)", "value": "5534a7087d32b4a180f4d55a2084eeb9a899e3491f92b097a72950e21802b7b11c84ff8c7e09dd25121c61136c123953", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710204928, "uuid": "88f3c2cd-6fa8-460d-b96d-f539b51302b9", "value": "T11BE3F1953B58E813D4AD2A74C821C45207385C871822AD967CC6B7DFAF33ADC7A44AFD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710204928, "uuid": "b5040714-6c8d-4bd6-a7f9-69043ac9095e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710204928, "uuid": "2c708c8b-838f-4064-9f58-b8f5b490de42", "value": "3072:9S680kHHHHYCaqeMqShg2rH5os/OOaUifoR1Gjg2m+UfuEv:x3q8275qOaUiaDfNv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710204928, "uuid": "229e0d4f-caa1-467b-8d47-19c71ab516ff", "value": 155136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710204928, "uuid": "adde8b1f-ce35-4f88-9724-0fce331a87ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710204928, "uuid": "0e92ab7d-858b-4713-aa5f-23da1c6cc705", "value": "399f052f7f86b7b295aab10c692cd8ba.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b272dcc-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235776, "uuid": "12bf5fea-794a-4c02-ab95-34525d5ad190", "comment": "Malware payload (Mirai)", "value": "5d89a276582f3f76da74bd6104918e26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235776, "uuid": "582d8fc7-c9fb-4c56-87b3-f507d54aa2a5", "comment": "Malware payload (Mirai)", "value": "182dbf915c6867317702d2b07de99a6293871d3ed6fb23c1c8a0e11bbdfab13d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235776, "uuid": "a6e523db-a9fd-4013-9665-76e64e17b75b", "comment": "Malware payload (Mirai)", "value": "02280a0b715110ef5f4b0c6d32cc935c0cb5e035", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235776, "uuid": "6b2a9c03-7a88-4630-96db-bea4e987b2d2", "comment": "Malware payload (Mirai)", "value": "a00e62a57a9c8ebc0c528d0a478391776e214dfe7bc6bcfc75ef1525a8d208c67c876c36c8f9eeee02e31d118e18eb45", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235776, "uuid": "7c6d0757-e1ed-4317-b358-c44fadb2115c", "value": "T13723F2319A676961C7B00873E7CE1087FE02BBFC429F3E83189559249BD6D025AF159F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235776, "uuid": "f234c5d6-ce9f-40b9-884f-83434911f5f2", "value": "768:9nRub798P+fTN5sQeZnZcMRzu3eBO1bfcHMBHAT9IaD97xh+Q0w08LJwWJAhRurN:9ncF8PgFkm87BwXKx97ZB+2rAL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235776, "uuid": "e4dedc38-6f45-4af3-a2c6-e10b68e86974", "value": 48832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235776, "uuid": "e3c803eb-e182-4d82-a2ca-b46aa5e8fdb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235776, "uuid": "75477592-5366-4008-a658-d105b92a0770", "value": "5d89a276582f3f76da74bd6104918e26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f58f03b-e04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710232401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232401, "uuid": "5a2f72bb-1a99-486a-85d6-5f9d6fd1a1cb", "comment": "Malware payload (Formbook)", "value": "9f8a840aff151e707bfd7e42d5b76618", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232401, "uuid": "8487ba0a-0190-4fab-9498-b41c5569ffdf", "comment": "Malware payload (Formbook)", "value": "18697b61ff9ba0995e8458cd944a96d0e0d75b014e76f1978a51eddec563b405", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232401, "uuid": "8d8f75c3-6d5c-4290-bba1-60d3c8f9db9d", "comment": "Malware payload (Formbook)", "value": "7cc3b821be599a0ba3d7ee0d3b7b986a66840246", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232401, "uuid": "37d31aed-85f9-4c83-bce3-91baffd0af94", "comment": "Malware payload (Formbook)", "value": "77796fe25986e687460226a2cf0b42c952c46ef11a95a0502f68a4fde8461f15a096f058ec665338444a75838c2bb859", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232401, "uuid": "db8ce92a-f2df-4e77-bed8-5d92aad9ec46", "value": "T17CE423B73818E265C2B99A7AA945E05142F43135B091D3DABD8F2B9ED3F33D1C483497", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232401, "uuid": "52a847f6-fb26-414e-8db4-285410319f0d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232401, "uuid": "9941051f-f8e5-469b-a24a-1238552f57a9", "value": "12288:HMsJTENl3KLnvrmVIUMD1UoS2cHOTkctIdEu5CkDfg7XIqt52uwok4ACQyp9Voh:1xENlcnvhHxUucnIGCkrat52jot7Qypg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232401, "uuid": "38cfce2e-7701-4968-8e9a-777e8b755a6a", "value": 667648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232401, "uuid": "87a09653-e128-40fc-805d-f072e4751c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232401, "uuid": "677dc433-7907-433d-aa78-23940b6941c5", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.DWR.gen.Eldorado.23180.8848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48ebb12f-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710227720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227720, "uuid": "988409ac-9bc9-4452-b9c1-43b3a9b63c95", "comment": "Malware payload (AgentTesla)", "value": "b47aa4999ce1e6d0c0e63fa131f49711", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227720, "uuid": "7a900e0d-f936-4275-a588-b511445d6a9d", "comment": "Malware payload (AgentTesla)", "value": "1938cf3166e3504fed02fca89a1279ea08e4399539bd0a1f5b711711c65eccab", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227720, "uuid": "86a34969-1f22-41c0-befd-a209f4ad6123", "comment": "Malware payload (AgentTesla)", "value": "a8322fcf93a7f813fb00967ac1dd146925da898a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227720, "uuid": "8da3e0a7-773c-4ca0-8878-dfeb9ebccfe5", "comment": "Malware payload (AgentTesla)", "value": "1018f90234c192fdf463e4c2d6f083ae4328ba95b208ab4f2a4d4647e1263fa775e7011b1f00ab1e9ff95fe819e16007", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227720, "uuid": "b239e632-e7f0-48cc-994f-8577d4ae9c69", "value": "T1D5F41284357C2A63CABDB6F81435246447FA211A342AE3EC4ED379CB59F9F404AA4E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227720, "uuid": "4225a8c3-7d87-4e34-8bec-b334d3acf98c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227720, "uuid": "4097ccab-d3d2-472e-aa0d-77475a9424a0", "value": "12288:bcFsJTENl3l5yqQHBb2eEm9bUerxZwRhgzYExKi5z8B4olDQM5o68PBZ:omxENlX8FbUsyH0xKi1biDX5on", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227720, "uuid": "0a3eaaeb-e568-429c-9733-75158162eca5", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227720, "uuid": "f89d5996-0fd5-408c-979d-6fab6cc8121b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227720, "uuid": "45ba3b90-20b4-4b5b-b3e5-07b866aa528b", "value": "Halkbank_Ekstre_2024 0017_164557_198850.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90cc144f-e063-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710242873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242873, "uuid": "c68b5be1-6928-4998-ae2a-d9c98052963a", "comment": "Malware payload (AgentTesla)", "value": "b653710eef0d8aaadc5cf5f236e0ecb1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242873, "uuid": "ff5243be-fa01-4d00-b6a1-8766f2ff4d7d", "comment": "Malware payload (AgentTesla)", "value": "199854b9d6151b9a4840baee02f0fe5f32e64d1504ecc3c6213fbef4e4e5037a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242873, "uuid": "f71139f7-4f9d-4d91-afe8-d3cb71932f55", "comment": "Malware payload (AgentTesla)", "value": "c816d04e0f72d1ed43c0f3dbcf6a934d3fbbb173", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242873, "uuid": "ba26b4c7-f935-4e44-8bc2-39df61657a69", "comment": "Malware payload (AgentTesla)", "value": "de8157aa725d4776dbd46e279fb1026c2426a7001a2dd0d7045590e0514de5da147aa4ca5cc4e0045f08fabc499f4a8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242873, "uuid": "1433057f-defb-400a-b717-33d889a024e3", "value": "T166E58D13F65667A1C1E9E73ED5F319CC9262AF4822579A1B200E325C19723BF8F1246F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242873, "uuid": "fab40eb9-d73d-46cd-9c3c-b0ff6996edcf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242873, "uuid": "e8eb018e-ee45-4e09-9ec4-b77ad54597dc", "value": "24576:PzGZ43uKNwfiN+beHn77bowsa/uvi2e1znaXw2s7gJ9PtnTvRQauVcFgSEQYVXvI:64rHNUOn7SUT8VTvtY9zs/VffEBcFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710242873, "uuid": "fe5278c7-277d-4ee6-ba74-5c43f89f2f91", "value": 3110400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710242873, "uuid": "cc7e3592-e2aa-441f-81a2-88fbcc0d5a90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242873, "uuid": "d6729eec-6f1a-4028-bdd6-2a50732855be", "value": "SecuriteInfo.com.Win32.DropperX-gen.28867.20921", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27968403-e03d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710226375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226375, "uuid": "991e9cf5-5b99-4fea-aa4f-3a337d5ff2c3", "comment": "Malware payload (AgentTesla)", "value": "1b7825726ca1d8ab97d01d70d4dee4b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226375, "uuid": "0d32c141-b3f9-4774-8b6b-51c1e4578a8c", "comment": "Malware payload (AgentTesla)", "value": "1c6853b0b5404f0d0c4dc2bf0116407e51e37771e2ac84915edf85ce49e86ac2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226375, "uuid": "cedb280d-1628-46ca-87ae-0ea9c882aaa9", "comment": "Malware payload (AgentTesla)", "value": "988d0b2c08d7da6f8f4f33989ce1731fdb4aed80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226375, "uuid": "c92eb427-8cd9-4052-94b9-9b6291f64207", "comment": "Malware payload (AgentTesla)", "value": "df7aab50d20bb64549d814f0c5632e3db8657e89a90db618001f2bfa404c95eed78b2740f5cdc76e4c14c74f7965a056", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226375, "uuid": "d97d2e26-3d64-4783-9265-7e27eaeae74e", "value": "T16125AD0273D1C036FFABA2739B6AF60556BC79254123852F13981DB9BD701B2263E763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226375, "uuid": "57be514e-59dc-416c-8905-b9a598d1e885", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226375, "uuid": "9370b638-bad4-4ffc-8dfc-2fd2c77a1bb9", "value": "24576:+AHnh+eWsN3skA4RV1Hom2KXMmHakNrUAT5:ph+ZkldoPK8YakX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710226375, "uuid": "3cab3a20-7d98-4b7f-8079-f189b01ccfd7", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710226375, "uuid": "89c14046-924d-42c3-b299-ba239242e4a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226375, "uuid": "24f0ff72-424c-44cf-901e-6f03a67ccdad", "value": "Purchase Order #98540-00..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa5f609c-e03f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710227588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227588, "uuid": "48f33e91-25cc-4ee5-915c-5e802fd2fe3d", "comment": "Malware payload (GuLoader)", "value": "134a5d862f0579a96d57706b7aab26aa", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227588, "uuid": "5af3156f-75ef-4af1-8f3c-d56c5cc52171", "comment": "Malware payload (GuLoader)", "value": "1c73be205f6f45263d0d2679a53e76172000fb1dccf242c9ab03935df8a3bc2c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227588, "uuid": "3c69829d-af5f-4dc5-b6cb-fecae8bc4e3b", "comment": "Malware payload (GuLoader)", "value": "845897ec19770438b4d879b1610ceb43501d54bd", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227588, "uuid": "34627d14-2545-4b39-b93e-93246329ee32", "comment": "Malware payload (GuLoader)", "value": "b55baf39d83846a49521592f93b4769a49d2400e05af721522c0f8a387617f5cd601242e34a39b76eb32b82e1d41a7e8", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227588, "uuid": "c8e0f85b-d6ad-405d-8442-57dda8fe5972", "value": "T149C25A249D421041061B4AFBF05E8979D91950FB9C6245B13F8CF63D6D23348BFAEC8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227588, "uuid": "02aa103b-33eb-4dec-b259-c108ec58a2de", "value": "384:4vnAwTXmVJpPWqMbzm9j+sZuK45BW425f753E+8GvRrwYCbxV/uCndJJWQ00wnHh:4NLfkt5fl3EMlwYCbL/1dyQgHJ5x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227588, "uuid": "38e40ffc-0387-4587-b071-3baaee804f24", "value": 27644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227588, "uuid": "36e592be-8c00-4367-abce-63d45bff27e3", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227588, "uuid": "dc58e129-b634-4b33-8840-7e5def17bb97", "value": "Scanned PO Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67b67b69-e065-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710243663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243663, "uuid": "0f5b2bdc-cd83-4d53-9b9a-46f3e47658b9", "comment": "Malware payload", "value": "3b2958d7dbe4dce4fc970d8d01391b88", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243663, "uuid": "d32407c4-21cc-4b92-ba9b-6d91b43213d2", "comment": "Malware payload", "value": "1cab0e68dec03a4aa62b187e10113f447b401669261a0094e49969bc4bab2702", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243663, "uuid": "d9eb3b91-2fc1-47e9-a569-a28532fcba2f", "comment": "Malware payload", "value": "c9f16f685b1c5c851486abb6230a3035f17e4ab3", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243663, "uuid": "e137533b-de88-42f0-af70-6145a0f5bb17", "comment": "Malware payload", "value": "1b380bd487a3b3fa629f5340c10565dac84120a29899a580391c19aff87b0b878beb2f305ddda1b87b371e186806de63", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243663, "uuid": "c254dfd3-f32a-4c3b-9144-8e145c83b6aa", "value": "T1BF759CE5D8C04184ED292F7464761D3A502FBE7EBDBCA94E9A5DB0203BB36C76432907", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243663, "uuid": "864ced27-1321-4410-9108-f464dfe9e808", "value": "24576:5aU/LcNbKqeBS4Q7Gy0ed93GgjH9X6ZIe1wQiJh:MoLc5KqepQ5v37ZmiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243663, "uuid": "9f20ade1-f4eb-49ce-9045-7ee25baa03fd", "value": 1638400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243663, "uuid": "4a7b1f87-57c4-46cd-ba35-deaf1e43e17a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243663, "uuid": "7457d556-3a38-4b8b-bfd7-0b5192e38bd4", "value": "UPS Delivery Information.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d25b07-e0c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710282643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282643, "uuid": "793f7962-ee73-48d0-ade5-1654bf24fb42", "comment": "Malware payload (Mirai)", "value": "0aade88a56f906f574dab16b13550b22", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282643, "uuid": "ec82a41c-cc40-44a2-8d93-4ecfde86bbd0", "comment": "Malware payload (Mirai)", "value": "1d18092042b17063c2860c6f5192773e486428317afbed93a39530be21bed005", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282643, "uuid": "8cc13adf-a22d-4914-aa9f-a6ee43888d7c", "comment": "Malware payload (Mirai)", "value": "3417e746d261c73262191237dcc0b40722e63fc7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282643, "uuid": "317c611b-c427-4df0-8346-45ca31f85a53", "comment": "Malware payload (Mirai)", "value": "1e0acd9bd5d6874bafb779968ea4a49d02e7a94284240469e9aa3078830f7dcfc0fc849188730dfbb58a804adca3b9bc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282643, "uuid": "f36ec208-d9bb-4ceb-85c6-ba53212fc567", "value": "T14B532A03BA4184FDC09AC1B41B6ABA3AF87631FD1338B5AA77D0FE365C49E211D4E945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282643, "uuid": "1f331dbf-584d-4c4b-880f-98227be013be", "value": "1536:8t7HjUwUhxVwlizBEwUkygB/cMBKPyLkXGugZdufgkGaMbwbZnFf:A7HAwWjwlvKyM/1BK4kXGugyfgZaMbwf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710282643, "uuid": "8a43d88a-2b0f-421a-9238-7137fbd399a7", "value": 66496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710282643, "uuid": "315d2bba-130b-47e0-9370-9cf66c4ccaf6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282643, "uuid": "43ee0a72-36c6-4b60-8441-f417c15bfbcf", "value": "skid.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35906100-e03d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710226399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226399, "uuid": "2ffb5a73-01b0-49c6-afa8-aaf42162cd09", "comment": "Malware payload (GuLoader)", "value": "e978a8312acfa04ed80797e11de8ddc6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226399, "uuid": "21a3184e-22ae-4787-8167-b8f543e83753", "comment": "Malware payload (GuLoader)", "value": "1dcd5c2a9a246a17e07dd617dff848f4b8876db4919545c5614c93db21066c72", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226399, "uuid": "d9c73444-4568-418a-a71f-744e132ee11c", "comment": "Malware payload (GuLoader)", "value": "3a3c18b2a0f1239b40387a646284908c777db7ba", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226399, "uuid": "c1d111ca-b033-4e97-a1ec-3964e329466c", "comment": "Malware payload (GuLoader)", "value": "153a9046e6f0604a89a59dc81946d83d37bc3ca6e7dfa03acfb073f5e4beaec882ed1b5b7117cce524c0c021ed7c1bc0", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226399, "uuid": "86a77c2c-c6e1-482b-be2b-cbd6d33d7151", "value": "T106C217A8AE812066451B15FBE85E4634E81950FBAD01467A3E8CF13D6C5B358FF2DC8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226399, "uuid": "b1bf4c27-362f-4eb0-a2da-c6d0a4f4cb99", "value": "768:4/RqEIpsqNa+yRIz11UgU8ay/x3LgGjmoS1o:4AmwyH1mgGjgo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710226399, "uuid": "9fa2a1df-488c-46fa-9f1c-4c9387ccb135", "value": 28040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710226399, "uuid": "89f3723f-a2f5-4fad-9215-ab2e52799689", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226399, "uuid": "40840537-0647-4bd7-84cb-b32577e448bd", "value": "RFQ for 0060M79.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a76316-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238537, "uuid": "aec0794e-7303-4ef7-a069-a60d32f13508", "comment": "Malware payload (Mirai)", "value": "ec726f3980aa5540bbb17fed826a9653", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238537, "uuid": "42bd8399-4564-4024-a22b-9dc480f7eb63", "comment": "Malware payload (Mirai)", "value": "2030a587aba77ad8624a6db22bdd6aea7426b52b443ab0e7dc85f8136725eaa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238537, "uuid": "8227188d-59ed-4aa5-9001-d9fb7d3f4cf9", "comment": "Malware payload (Mirai)", "value": "0735a0fd6f7301bc19ab6b7ffef7bdf997b9d6ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238537, "uuid": "7a7d8073-363c-4d03-9e88-23e66c092b58", "comment": "Malware payload (Mirai)", "value": "6f8f11660991b05eb8b64c7983ac793321543e230e4f4cc8821a304b55a802077fb4e65653c5ac5f103c22b84492b6af", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238537, "uuid": "6f7faa02-2df8-448d-8dce-22d9e78b1013", "value": "T1F2333A057941E573D44353F506A39B611231FA3E3AC64D0AF3687CB4F36A288F262B6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238537, "uuid": "bc946c9c-e005-4823-9819-bb21c803a7a0", "value": "768:g6WRR1AlZ5WjsLekSK5AM4VbgAz9mMKKc4/3j1IH:g6cMowykT5AM6bgAz//z+H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238537, "uuid": "b9757deb-f08e-4c8e-b1df-04ae35807739", "value": 54529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238537, "uuid": "53913f7a-1dae-42a3-ab83-1aa202530f7d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238537, "uuid": "5d455a92-3bd0-4259-a8dc-d881184614dc", "value": "ec726f3980aa5540bbb17fed826a9653", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6817204c-e03d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710226483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226483, "uuid": "25ccfd02-f5f1-419f-b38e-69bacda9ea7e", "comment": "Malware payload (AgentTesla)", "value": "38fe729ac44d2b26822ca19c59faab42", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226483, "uuid": "79485f3e-1f0e-4f86-9f84-0d827a79fdc7", "comment": "Malware payload (AgentTesla)", "value": "22bd561037557a72a5661102f531e51b8a1f77fff3df51759bb3594e21073784", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226483, "uuid": "338f546f-b6bd-4aa3-92f1-4eca98106e9b", "comment": "Malware payload (AgentTesla)", "value": "554b8926a099a92c20a83bc3ad903bc7747570cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226483, "uuid": "77250635-94e4-4b4d-bc26-5b4cfbc9f158", "comment": "Malware payload (AgentTesla)", "value": "fa7c050f9b92fc0e5a4d89468d47e49ed7f3aa2c0765ba42ae6a4d32a2f53770fa3aa45e97f7b5e3ba9df19239069fae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226483, "uuid": "96238276-5fbb-4803-87b6-8c9157ef34d7", "value": "T16214786DC34B02598F620377AB571E5141BDBB6EF38452B1306C533933EAD39A2252BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226483, "uuid": "17b90a7e-34cf-4c8e-80a2-034b325abd58", "value": "768:SwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjyq5Y2PwjfN9LNcX:SwAlRkwAlRkwAlRI5YMwjfN9LNcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710226483, "uuid": "9b5df989-1dc2-46d6-9cfe-48d6c9b3673f", "value": 196896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710226483, "uuid": "f58375c2-4840-4b5f-9e32-a0e4d2743e34", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226483, "uuid": "2fe7bde0-e6b2-445d-be62-65b3f9378070", "value": "RFQ____4400045891 (6073583040).doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11455f9b-e047-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710230633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230633, "uuid": "13c06773-c83f-48c3-9486-0735f77aa9be", "comment": "Malware payload (AgentTesla)", "value": "4051984ca3ee80e9394c4bbbe8933300", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230633, "uuid": "8a06809a-fa0a-4279-a8cd-067febbc25f8", "comment": "Malware payload (AgentTesla)", "value": "22ff191b6e24fa02380bfd8a5adda6e9b3d9bc6af65943cdfda51198a1b532ef", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230633, "uuid": "6b2f7048-1406-4752-9cab-e6f19649f56f", "comment": "Malware payload (AgentTesla)", "value": "64fdd67468aa8863d87d328500b4b48d9654b90e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230633, "uuid": "8924b099-2169-42f1-a451-34f433f444ba", "comment": "Malware payload (AgentTesla)", "value": "abb1eddf2cc1fc3163a0245e5b8f08a89a19212d5fd046d9d405d331b12b1848b17eba81bbc710dbc2bd209bbd6e7afb", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710230633, "uuid": "9be05c57-17e4-44bc-a64a-b97644a116c3", "value": "T19692E1D15B902B2812A1F3354C0FA7AD4EDAE05970822E87E5A4CCCCD6DE0DD056F96F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710230633, "uuid": "715de916-97e6-4d9a-aa3c-a43083b74b31", "value": "384:J3g6SQWvUvMgzQDFLMCOj0onXgBRVzhVzy5nauU5JxBPNJdKg/6cW:K+JWODwRVFRonadrPMpt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710230633, "uuid": "16bd2f3a-7cb1-43c1-bcd6-04b37e449449", "value": 20556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710230633, "uuid": "cb700b15-ddb7-4ebd-a061-a20b908f113f", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710230633, "uuid": "a3108a57-a69b-45c1-87ea-75bfc7f610e0", "value": "DHL shipment arrival.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20f8ba8e-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235813, "uuid": "5fe29f4d-1469-47fd-a887-bdd578dab747", "comment": "Malware payload (Gafgyt)", "value": "f79079a63d0f2e35ce27924a8bcd31b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235813, "uuid": "62835633-219f-4585-954a-fb208f96fe1c", "comment": "Malware payload (Gafgyt)", "value": "239ca42adb261775291ba4e8ff3c4070de15ce52a9a0352a45bafaca4b1959b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235813, "uuid": "f7581868-391a-4e80-8846-667541e69701", "comment": "Malware payload (Gafgyt)", "value": "f7a5692256fe7c1006d7fc76168161648af7d72b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235813, "uuid": "4969b5aa-49cd-4657-bfd4-7aa8d2f17401", "comment": "Malware payload (Gafgyt)", "value": "8e4f3463715ba31f7ead25c130d51fa21aa9bd3eb29cc5d8ff62b48922ffa692903ac34645644bfd10c57d27e1649c5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235813, "uuid": "7635317c-b214-4e6a-b842-89740476c4d1", "value": "T11D04D647A816DF07D85B263A47C70131F6F5A2AD798342367337B8967F231D11ABAAC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235813, "uuid": "2955115b-ad16-4008-9a9d-5c72c6cc32af", "value": "3072:PBbhkrO8TvaJ0zS0Y7lY5xBrSbMyNeQZOlV7kX8mPs0ao8UtKFX:PBba+0z3Y7lY5DyNFAlGX8mPs0ao8Uta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235813, "uuid": "147cab07-48c3-435d-8fb5-26c1de07dc88", "value": 176561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235813, "uuid": "8e59b6ec-52ab-4f40-9850-02b460f15a68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235813, "uuid": "92a7f947-7710-4f8e-900a-23e5945ca05d", "value": "f79079a63d0f2e35ce27924a8bcd31b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b4a647-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235866, "uuid": "ba305433-c31a-4be2-b100-559515f98651", "comment": "Malware payload (Mirai)", "value": "3534f66199154b9bd88d54f8ba691303", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235866, "uuid": "a0fb81e9-33c8-4743-b6aa-1aadf84ccbef", "comment": "Malware payload (Mirai)", "value": "243f1a00ae457a3b7d9002f81f862e19d9d2557dd984020bef099ee81cea672c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235866, "uuid": "07d418c8-45ee-47d9-b552-448ee9f958dc", "comment": "Malware payload (Mirai)", "value": "9bea99053de518bf41e4a6f9a6de8085de784719", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235866, "uuid": "5bb7e6ad-f5af-4f06-9323-cdf00338f543", "comment": "Malware payload (Mirai)", "value": "eea41c308254293abbba83fac9ba1d71d9061f554dbc25af3bef473290b52e66bf523c83787a09d85719d14a1732d9c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235866, "uuid": "b4be81b9-e85e-4b0b-8fda-f60f06f9c721", "value": "T13E04881E6E228F7DF66D873047B78E259B5823DA27E1D640E1ACC1105F6039E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235866, "uuid": "be1a50e5-d581-4979-8916-8e3d0343bc2a", "value": "1536:T16zePrQiQY3tY05Y9vt6Sw6cFL+z14R7oOe/3LM76qfTOSV2dLi6jyfjGdN:TnPvQi46SKFahy7ox3LIS4OLnyfjGdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235866, "uuid": "1d864e40-a0f1-4818-8407-94442f6df169", "value": 173824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235866, "uuid": "d9473655-1774-4946-a1bc-275d9a63fe0a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235866, "uuid": "d4a64f9a-db29-40e7-bd21-7ae23fe64d70", "value": "3534f66199154b9bd88d54f8ba691303", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9f00473-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235748, "uuid": "6fb206de-7240-4ff0-9da1-0fdafef2afc2", "comment": "Malware payload (Mirai)", "value": "4ceab79bf3c337044d503cf7350ed693", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235748, "uuid": "42c20029-3e12-45bf-b46a-7c1d3d7b86d2", "comment": "Malware payload (Mirai)", "value": "24559a625d20f947478d30fe5c4f86253f95b1629b80576e2280f09ea650c3ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235748, "uuid": "b40f62e4-4c99-4b9b-8c73-edeec29903db", "comment": "Malware payload (Mirai)", "value": "89e6ca2f68eeaa8d8f05a0317a48e964899e2388", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235748, "uuid": "ca7bcf88-04b7-4289-873b-2ec229ef9811", "comment": "Malware payload (Mirai)", "value": "544e422662f4ee05aad202158b2951d51de6cd7369c29657568c561c7250f43156b1e554fffba3f697adc9b7cf3ddb04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235748, "uuid": "b87b1990-c3bf-432c-8257-b5552e573f0a", "value": "T1C303F155F4BF100CE6DC25392CF6F92ABC25E058A05DDDB4A8943522F9A1F3279C8B63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235748, "uuid": "2c30b82e-1ae0-487e-97c4-a4ec6b94d979", "value": "768:WyBlqXD87AndNKyDV1jQ8KBXBLoSDXJrCp1HsAVGmEAn4Wpg1xnbcuyD7UGQRj4:WyvqkAntDWXFW1DVG2njUnouy8Gy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235748, "uuid": "8138ea17-72bd-4540-9671-6f760195ac98", "value": 38692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235748, "uuid": "0b5e6926-7d34-4759-80fc-02a15e921524", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235748, "uuid": "4d364667-9fee-4a0e-aa0e-c1c22448d983", "value": "4ceab79bf3c337044d503cf7350ed693", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7eeabd0-e03d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710226671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226671, "uuid": "5be6c7a3-8ed2-4940-8839-67bf6da08d56", "comment": "Malware payload (AgentTesla)", "value": "a6bbb4b583e5b2d8525cfafb5653a3cf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226671, "uuid": "5d626cd7-44fc-418c-9dd2-8d54811f29d5", "comment": "Malware payload (AgentTesla)", "value": "25c4949c91ee17ad3aaa31f47ff7836d2c93bc10c940744aa50730d927496257", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226671, "uuid": "2ff102da-bdf2-4699-bbc9-82c5a98b97a4", "comment": "Malware payload (AgentTesla)", "value": "8550bb98ca7d8aa47966dcd9d0f419afd87cb011", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226671, "uuid": "43a50448-f77b-4207-ac32-b641182ea3a6", "comment": "Malware payload (AgentTesla)", "value": "a0b7c78a9cb29c43ff6622b5e2de70cc211553653204eeb1c45b98b48af37106cbe7240f3e90873ef795de2bccba5049", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226671, "uuid": "8aaef904-0384-4a7c-bc3b-17e55f3518bf", "value": "T1E0F41282317C5A53C6BABAF858A1106807F2156A305AE7FD0EE376CF51FAF440A11F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226671, "uuid": "addcdeb8-52de-4d08-954d-70f2bc27d479", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226671, "uuid": "f40fc467-5b48-47bb-a010-8a4a9fc977e9", "value": "12288:ZKusJTENl3lpAJJjWpRlsoZbQiRAPADZPP2rKDjacIZzX/ay6sKorsglRhVbpg:c7xENlQeprsohQiyPBrK/a9Zb/rLt9hR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710226671, "uuid": "ea67b85f-1dcf-4592-b7db-101577005200", "value": 733184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710226671, "uuid": "22642597-ad68-409b-bf7f-aabbf66e6907", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226671, "uuid": "e014b5bf-9ff3-4d01-97b2-a6b7324b886d", "value": "Invoice032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dd32519-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1710238492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238492, "uuid": "fbed34f2-61b5-48c7-a9bc-3da82896844b", "comment": "Malware payload (RedLineStealer)", "value": "bf73662e2802d4fb5644fe3f14207e15", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238492, "uuid": "969953de-a040-4604-af3f-7bd054d2995e", "comment": "Malware payload (RedLineStealer)", "value": "269505b0d15e7ef16e2f366ed98588c750149c63639b2c3734962aa3be2ad52a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238492, "uuid": "09db7b3a-8525-42e1-9a5d-b2eae15c8bcf", "comment": "Malware payload (RedLineStealer)", "value": "63630f0c3531ef9ba7fefcb21b024dcca880bbf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238492, "uuid": "ed4a9c2c-87bd-4309-ba05-a6edf42a2711", "comment": "Malware payload (RedLineStealer)", "value": "71e9b1fdaab84f9238abad09b8feaba79af0d838ca95ae5106891ebe8f6092ab7953cb2e6dd20e1dd54a5f4a2fec17db", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238492, "uuid": "b4c9114a-47c1-47d8-8c26-195abeecff8a", "value": "T14C651861EFD1DF24EE66E838C2F72B28A3A2E8C76771561F9E5912434CC36E51C98407", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238492, "uuid": "ee07b744-27e6-4df4-98cd-46f6c72b0e86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238492, "uuid": "dea3aa51-c2ab-436e-ba6f-1daac4a597aa", "value": "24576:qyrrgkwq7QDxLpaVYWVzvogBXZnM2pk4bvGxDEs7sv3:D1wCWxLpaVZVzvowZnM2+4z6Xsv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238492, "uuid": "9feac97c-51ae-4a6c-9473-958eb9909287", "value": 1431040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238492, "uuid": "baf1af74-1aa5-4ae5-be28-bcd71cda6609", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238492, "uuid": "d82d7714-a891-4e9b-b226-4912719a83aa", "value": "bf73662e2802d4fb5644fe3f14207e15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13478d10-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232784, "uuid": "9951ee4c-2e20-4d19-8063-e0f4b9ecd568", "comment": "Malware payload (Mirai)", "value": "2bee3d9135b391025d94651eeedba799", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232784, "uuid": "72af676b-72e3-4ff4-abab-cba3abfb96fd", "comment": "Malware payload (Mirai)", "value": "26cb75fac0755ba6c0987d71d136f62c10f7fd9988ef3d7b662a8e71d2388f1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232784, "uuid": "9ec3bdbb-34f0-4798-8904-4b0d9c827951", "comment": "Malware payload (Mirai)", "value": "d9b0d7024f0d330c22ed8f419372ae67ac9ad7d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232784, "uuid": "5e5aa6a7-0793-469b-bb91-53458356f531", "comment": "Malware payload (Mirai)", "value": "13c88b0e60fa5d0870e56f480e967443b118d894bc939c2e6a82d7c0157e3c2d9ea93e3b1b2156133ff7348b53769e4d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232784, "uuid": "bb1782b7-5b68-49cc-8ecf-6ce5fa6be8fb", "value": "T1FF3307D6B401AE7CF95BDFBE80224909BA31621151930B3B637BFD936C322A58D53D87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232784, "uuid": "f9fd44b0-4d94-412d-a17f-64bf3ba0e748", "value": "1536:UutWMN1X17lQJKO5dPzlCH7n2q/CV85/9r8eU:U0rl+KglA7U851c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232784, "uuid": "45fceeaf-6990-499a-9900-e8d0432aa872", "value": 52500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232784, "uuid": "5092de51-755e-41e4-a6ff-d332d83bddc6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232784, "uuid": "fac90b34-eb82-4c94-b212-fe2d74f7bda1", "value": "2bee3d9135b391025d94651eeedba799", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a049389-e099-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710266081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710266081, "uuid": "7569663a-ae97-49b2-b814-f48b877def8c", "comment": "Malware payload", "value": "8859677d3d103a889068257ee8a3d51e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710266081, "uuid": "22705806-fec4-4732-8c26-21824db93549", "comment": "Malware payload", "value": "2724168020aa9d2731641cc1edff581211707e8392849aba1e994abf05e58094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710266081, "uuid": "0702ef8b-2a5d-4829-a30d-f412feeb8dd5", "comment": "Malware payload", "value": "ed708c5be875be9e4605b66bf0ce1942939d3caa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710266081, "uuid": "a509d932-3682-4136-b5f4-c2a89875da21", "comment": "Malware payload", "value": "f2b618ebb720793e3d8905452428c1058d167416ffdc866fae8fbe15b7a0d7c84e2b02ad2617e063ebeee4ec28cb62f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710266081, "uuid": "262f3cb3-d977-446d-a12b-5325c0d0a314", "value": "T13225AEDE57D4F804F37F6BBAB564F084C7B2F4CA49AA860D0940AADD3BB324479C1691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710266081, "uuid": "e69bb882-de51-46a7-ad49-93e06eb8169f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710266081, "uuid": "e0ffe63d-6953-4454-95af-6791237fded6", "value": "24576:Wv2nrJhuo3hZgE+8ToHIdIRTwEkGkZMNJyuMjn:U2nNhuGBd/hPMhMr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710266081, "uuid": "cee50267-b238-47db-9f07-e60dd4b61da8", "value": 1034752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710266081, "uuid": "f7cabebd-2d51-4821-b900-08235ef8b407", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710266081, "uuid": "2fbecd87-f487-4435-8e37-93c9b99f1b42", "value": "RFQ-120324_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89641eed-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229975, "uuid": "c7bb7053-aaae-4771-b969-dee045dba347", "comment": "Malware payload (Gafgyt)", "value": "6fa390e55ef379fa7150ed23cf52d34d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229975, "uuid": "955c54d1-791e-4b1d-8ace-da28f3127d23", "comment": "Malware payload (Gafgyt)", "value": "29138ab9b3ad23e666832a71a9ce9c7b5d6d6fcee23b3e1eaf036797ec9f1baa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229975, "uuid": "62b41dc6-f7f4-4060-8ba9-c74e426614cc", "comment": "Malware payload (Gafgyt)", "value": "40f985e7fb47f773bd5a80ba7e1fd4eb2c835067", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229975, "uuid": "7f26f6e1-1749-47b0-adc1-85d172405b7b", "comment": "Malware payload (Gafgyt)", "value": "ef1c809c5eed7f0601307caf88da0f46f11eb92e46fc28eeaf2b29c304c07b5d5fa59c6ea5dae2c2c5d0a4d00d93a86c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229975, "uuid": "a51d27a6-7884-4091-be4f-3ddc2b81a4c5", "value": "T127D3A6AF7F280397C48785B0396773F00FEA9DA11391A1C2A25ABE406F725747D277A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229975, "uuid": "f1054a01-98d0-40d8-b2c8-db67b0ce93bb", "value": "3072:o8sg5yhr8+502ZqRnE/9WNcLifYc2i60c0IZrRgeQs:o8sgwhr8G02ZqJE/kcLvi60c0IZrRge9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229975, "uuid": "d9823572-9e72-4e6d-b402-73a848b128d9", "value": 141079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229975, "uuid": "3c8f7a66-1959-4a46-a67d-91bc65eca58e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229975, "uuid": "f93e598e-98e6-402c-9e23-5801134abe96", "value": "6fa390e55ef379fa7150ed23cf52d34d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c5167c3-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710227672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227672, "uuid": "9649bd30-7a8b-460f-97c7-2f30a11dc977", "comment": "Malware payload (AgentTesla)", "value": "483190cebdebdf2a298c38af46ae6cf7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227672, "uuid": "4a8a8bb7-5e0a-4678-ad16-0400f2965b6d", "comment": "Malware payload (AgentTesla)", "value": "2aa188d839db1617cb3572a3cc5a613e3af88ce2aa7d3bd028e0b9947ea79b51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227672, "uuid": "9b796b11-cfea-48f7-9bfb-84fcde70dc44", "comment": "Malware payload (AgentTesla)", "value": "703a4fa1d2eefb61609408d53b443c2d2be5affc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227672, "uuid": "b723aa48-dfd3-46d0-916c-e9184fc53ee7", "comment": "Malware payload (AgentTesla)", "value": "e168c44332f7141be947ca45c439ace408b97ee38c97e5b27a8169562fd9348832121483d0f27b03aed6b1141acf5c85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227672, "uuid": "2de4e6fe-3067-4512-a404-d698a42f531e", "value": "T16BE42302FD444652C63D2FBB0F6B2990033A5C2224E6DD2D6D6DB9DB2BB23DA9037547", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227672, "uuid": "fb430347-d1ce-4031-bbb4-2ee159a65f58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227672, "uuid": "9caec745-dae1-41fa-9c9c-4cf8d1661b27", "value": "12288:/sJTENl3lepPyeQaLyAXWyKIAzqrPRBmgNVy1t6/kCu9XaWeh2:kxENlMqeCJyIzqrRBpGODu9XReh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227672, "uuid": "b22a37c9-f638-4752-a737-3e1d1b129a2b", "value": 664064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227672, "uuid": "d0fcff02-6456-445d-aed4-2fdfcfd66fda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227672, "uuid": "2f5e3a8e-3b18-4a2d-9aa8-edc1fb89a5f7", "value": "dhl_MAWB 02391359332-SAW HAWB 611300763430.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1f88144-e03f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710227574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227574, "uuid": "49a12a1a-d749-4bfd-9574-1abcc4dbe609", "comment": "Malware payload (AgentTesla)", "value": "56220982d2aa5f1cdee5f4f173f54ac8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227574, "uuid": "ce846031-117c-4325-8732-570559a1c82c", "comment": "Malware payload (AgentTesla)", "value": "2de36e7d323f154587a39c9f72f43d2a804a69f373557e15a9b2b72ae2beb29d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227574, "uuid": "e4c07500-cb40-4340-a3f6-bca82a05b5e2", "comment": "Malware payload (AgentTesla)", "value": "904c84d07bddc9ba39451df3527c08e750dd7273", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227574, "uuid": "9f2c9a07-8092-4ac1-a4f8-394df67c4050", "comment": "Malware payload (AgentTesla)", "value": "d140d2df2ff62f8b44884317bf68ed150283ddc38511195c5242b357c157b0ed857913e63442cfcbd15424b701d763cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227574, "uuid": "eaa335d6-b6f3-4e19-9f63-aca362d6588c", "value": "T1E352F5054C06EFF56D0B67F649592BA0E5390F328E383091EB563661FD2EDB78D206C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227574, "uuid": "928c7884-e8ca-498b-b6c8-d2db2a13aace", "value": "192:VyUL+Kc7iR49h9mFbYqqmc1kXsFh5VUM6Cw1jysGLHMhmU72Pm577bQ+Nsffs8Pz:VEA29wEHBfFRU7HaDMj72PmkMvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227574, "uuid": "254009c9-be79-4ffd-8409-8b5a76fd8134", "value": 14160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227574, "uuid": "f5008c02-4351-4faa-a267-8962a053239f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227574, "uuid": "cbecf63b-fbac-4bba-bd87-383d41c6d3a7", "value": "ENGINE PARTS -KTK (1).vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc255acd-e05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1710239187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239187, "uuid": "a92fe830-b36f-4921-ad3b-f4786f45a79e", "comment": "Malware payload (XWorm)", "value": "82f989c4165f0bc8d1d5444d8a853752", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239187, "uuid": "a8cb6885-a106-4a41-ba88-5b7832b82cfc", "comment": "Malware payload (XWorm)", "value": "2e14e244f1b8767079e98720deee84551ab59d9433caf30688a981ccd8824384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239187, "uuid": "b180b47e-56a3-4424-99f6-582cdc1a112f", "comment": "Malware payload (XWorm)", "value": "fc3512f96245d7206baeff59c7835a6722153f12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239187, "uuid": "27a55113-3b56-4ffe-875d-ece376483f1a", "comment": "Malware payload (XWorm)", "value": "a8f294ac238bb8994967032bacc8fccc29489241352a28100afd6ec6a98cf9509c023755f52fe9f41d41209f53b24bc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239187, "uuid": "75ab14a4-8ca6-4dda-9ee4-b1e9c110b1c0", "value": "T1BDC49E0472F3AF03EB94AD38D56F412897A399953673F36F5E0861A11C03366ADD23E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239187, "uuid": "5a5f80c4-aedc-4dcd-abca-175ec0c3b6b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239187, "uuid": "891973db-a4a1-47a7-b3fe-5705040e9415", "value": "12288:HNc+mfGoTk9sRDzXxIHALx1U8XW96i0hTX:mNfGykWzaHixjo8TX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710239187, "uuid": "d4086c5a-ac69-4540-b2b1-14235c44cc55", "value": 566784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710239187, "uuid": "a6067785-0e31-44b1-974c-365a43c595f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239187, "uuid": "ded1fb07-8c9e-4bd2-9144-e7c22c02dba9", "value": "SecuriteInfo.com.Trojan.MulDrop24.59030.23050.13183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbcbba95-e072-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710249441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249441, "uuid": "29cb7e68-04fb-4a84-b751-aa91034537cc", "comment": "Malware payload (AgentTesla)", "value": "8720b06d6f6e4c139604d4a9878f04bb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249441, "uuid": "524da1f5-c11c-4f95-bd76-38b292cb05cb", "comment": "Malware payload (AgentTesla)", "value": "2efaca7c89121bf68861283d15ba240a38b9b3e1531e1eb265e605371f7a72d2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249441, "uuid": "fe82eaeb-5570-4f8d-82c4-3f274e8d5d15", "comment": "Malware payload (AgentTesla)", "value": "bd3d5e523e34d2501d3a5293ae6f14fb70eb61e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249441, "uuid": "047d77f7-4c86-4930-849b-0763536fac9f", "comment": "Malware payload (AgentTesla)", "value": "8fe07c59743499c4de6b09e8840e984e6e32fa205eb79181da189e13e762ba632c9422be9b4d514075ddfc50f034dcf5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249441, "uuid": "812ca28a-fe6c-45ee-baa6-3695e3eba82a", "value": "T103059DDE5394FA00F73F6BB63464E090C7B6FCEE89A981490980B6DC3B7364079E5661", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249441, "uuid": "a3a1713f-f255-4a22-9818-cf70d89f7d4c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249441, "uuid": "8f7bc530-8e0d-4f83-b524-05c7c26c3cd0", "value": "12288:K6OzGbNrJaYfumFKW3hFbKLEk20D82Yv8nnjNJvP1elfA+i6hDdDdumO6RCdO243:YzGhrJhuo3hZgE+8TCnH2fA6lcPCd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710249441, "uuid": "d717d3c7-c889-47af-ad99-a0ebed11663c", "value": 847760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710249441, "uuid": "3c2a53cc-289c-411b-a404-b68706da86e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249441, "uuid": "62f101ee-87bb-45d0-b662-fce55d9211aa", "value": "Morton Glass Works PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e6ff57-e096-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710264567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264567, "uuid": "49c756b4-c56e-4f0b-bb89-e4ec302d95ae", "comment": "Malware payload", "value": "c91421f0d68095890b50a034dbf9d060", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264567, "uuid": "32541064-349f-4527-96e8-e60a5fede29c", "comment": "Malware payload", "value": "2f1854f309c913068700c0c3efec3a84ea48e62393df38bab9c8233053e2b19b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264567, "uuid": "a61c30d6-0980-4a89-9fe2-9f9970870ef0", "comment": "Malware payload", "value": "624e0d9c94309de8d038b2e21cf07685d2020fdb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264567, "uuid": "21af7e2c-8e55-452e-b3be-4f5556b132ce", "comment": "Malware payload", "value": "2d7f164aa2fa25f86751b35ea1e9c94e7d75b88dcb4ab42a9e6c75d15478693c868b33615fa4b144aa15766cf467b9b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710264567, "uuid": "80cb76d7-e9f8-458d-942d-09388f06bd1a", "value": "T109769D47F89190A5C1AEE230C666D293BB707C845B3423D32B50FBB92B76BD46E79314", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710264567, "uuid": "c48c62f0-2094-4423-b891-2c9d7a7ea7d1", "value": "49152:FdvgYnvuqgrb/TGvO90dL3BmAFd4A64nsfJYgJi1QjpzkpDKzBzQgQHDSZ/+/A5X:YqpgxDFnEqZJvlNiPt9y7LxXk5prrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710264567, "uuid": "115ac05d-5304-4f0f-b9bf-a6b2a6e1ef83", "value": 7344128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710264567, "uuid": "9bb3351d-0c0d-427c-83ce-3722f19912cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710264567, "uuid": "53a8e08b-264c-49e6-a4d3-31089b4147b5", "value": "bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73e962d5-e060-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710241536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241536, "uuid": "39da0bb3-f5fd-49f5-89b8-05b295c61e67", "comment": "Malware payload (AgentTesla)", "value": "d4419473eb5cbc8a1e0214283d7241ac", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241536, "uuid": "edff4c7d-e169-497c-9a50-9a8658e7680f", "comment": "Malware payload (AgentTesla)", "value": "31096302e680c0c1630af77b499b94cddcf5217ac5bd69bf486e431c87258057", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241536, "uuid": "0df32c85-9048-4bc4-8ca1-6e599032b02d", "comment": "Malware payload (AgentTesla)", "value": "de4aa93485c222065a329c406f6cef40c9b850c3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241536, "uuid": "59b6bbaf-ac49-4f6c-98b9-b47a135cbbe1", "comment": "Malware payload (AgentTesla)", "value": "bf4a86c0f6db3871c3e7e58644d84c9ece66253659e95d391445d86ce3c2dccf4dcce2d1db9c94b303bc991e86bf8afe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241536, "uuid": "567d548a-e570-414a-8292-f6063f3b8079", "value": "T1BB45336D3BC39EAD68F35F4D6E49F20421A25FD86B9516B074D2D32C3A22F0E586C274", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241536, "uuid": "de848dd9-7a98-4580-b5b0-ff8dd69b68f4", "value": "24576:Bi//fdupdUd4BmrBeHkbzLFkA5FC6MovVMIVv01OkfZ0bTDh/oegy1yTzE0Qb9jc:BinkptyEEfLu6MovV9VM1LgTFc3zZQb+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710241536, "uuid": "c7f62f32-9e01-4a4e-b783-d9df17d8778f", "value": 1258593, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710241536, "uuid": "96a5028d-10e7-40c1-b009-7b654662c89c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241536, "uuid": "5100c455-7879-41fe-841c-f20466955d55", "value": "nPurchaseorder03112024.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6080e304-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710229907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229907, "uuid": "3ef8efae-8288-4ba9-96f7-7f234574b7b0", "comment": "Malware payload (Mirai)", "value": "20660efd8ce4a157d817b52ca19bdbd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229907, "uuid": "33216d74-a352-4114-b946-5b0217678025", "comment": "Malware payload (Mirai)", "value": "31b8f2dc0d1769d0ac33503300b51bacd463db6225fc962c2d04570157cc6022", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229907, "uuid": "7eb1454d-8ce6-423e-a049-72dbc979054d", "comment": "Malware payload (Mirai)", "value": "dcd49cd1868c184a5ec3ec2a0f6734bbc321bc59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229907, "uuid": "85d316b5-df80-40cf-b00f-a9227abd0547", "comment": "Malware payload (Mirai)", "value": "3fce1b299355b0a8d827f27b708e692a0799dc92c3732b2741fe53a3aceba81227e7c93baf3367d779ab391427eb1c15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229907, "uuid": "defb8b96-e947-4882-a5de-54bbc018c4f3", "value": "T149E32A02B30D0A47D1632DF43A3F6BD193EFEAC121E4F644255FAA8A9171E325586ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229907, "uuid": "898c924d-3f62-4985-8cee-5b2acaced6ec", "value": "1536:NqaPECVleSRkVjxpuvT0sNjvDUqgQA6GVpSKzDPzqvAoYLmo9ovzt7U2lLcY:HSVjxc7xvi6yScnoJlLcY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229907, "uuid": "b69ebc2a-360a-4fc3-8cee-c58f6139017c", "value": 150392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229907, "uuid": "131dac01-c826-4077-9faf-a2b4c89df4d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229907, "uuid": "269a89ed-fc84-444e-94eb-e833a604790b", "value": "20660efd8ce4a157d817b52ca19bdbd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "082451a3-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710227611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227611, "uuid": "75c299f6-170a-4a6b-aaf0-f7772e2503b9", "comment": "Malware payload (GuLoader)", "value": "ba8d07e2047d2a48cb14a3edd79781b9", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227611, "uuid": "fea7cf58-3e9a-486a-ac94-96db0587920a", "comment": "Malware payload (GuLoader)", "value": "31c8077a6b4e7cd7a35fb0a6a762ca7bfdd03f994414b57fbe6ccef71282fe6b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227611, "uuid": "6826cdaf-bfec-4adf-9538-26107d765fe9", "comment": "Malware payload (GuLoader)", "value": "21f174e142dabd9f2646c56982d330000ad8a0c5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227611, "uuid": "e34ad8b3-6972-4d0a-9a12-1433a34804f9", "comment": "Malware payload (GuLoader)", "value": "d466728c9bf0b24a5a0663bf60cddfd24874aa4057a66b2145454e5b7a4a963f9ee011b26e69a0fefb9aa7afdb4d25f5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227611, "uuid": "d6771e80-e64f-40f2-a8b3-d3d8446d5bfc", "value": "T16EC25A986E5A2152052711FBB46E8439ED6990FBAC104A767E8CF03D6D5B348BF0CC8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227611, "uuid": "36be4478-9fb6-4192-8d05-097c14dff29c", "value": "384:4CnZwUWGuswu/MUFLxF7q/b/BADSAVJAb+GmcUgYbnZ8ayzLx32IgV4V959QHl5h:4fUWGXKA/AbPUgU8ay/x3LgGjmlf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227611, "uuid": "e5e007c8-dfa2-4426-9d97-eb0b21e9b1ed", "value": 28047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227611, "uuid": "893effd7-f9fb-4524-b7e4-3ca2d08c511f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227611, "uuid": "2d6c6ea1-cc9d-40d1-abae-49554a5b28f9", "value": "Scanned PO Copy.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53db79de-e041-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1710228167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228167, "uuid": "4dcd303b-84a4-4ea2-a7e4-9c0556215888", "comment": "Malware payload (CoinMiner)", "value": "dff762abefd2ac634f87aacd920c8bdc", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228167, "uuid": "eeb7b4b3-4e92-4b88-afc8-ba92a37d23fd", "comment": "Malware payload (CoinMiner)", "value": "33136dd64b2b82f5f35d250c41060e70eb9c0028cc9e93f61b4e1d32f0163c3c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228167, "uuid": "cd6160ee-9057-4bc1-9079-7fe41b53c8af", "comment": "Malware payload (CoinMiner)", "value": "b8ea30c9d631fbb4a1f57c2873ca8aeb64c93643", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228167, "uuid": "836374f8-ae86-4ec9-941d-685ddba1fa69", "comment": "Malware payload (CoinMiner)", "value": "ccec8d9eeb3119e1ab9c5e1968e7eacd882e2856b18ee77b35ea8a5094f23f45d0568b9decdff073a6a4929d1410952e", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228167, "uuid": "3ee2bd6c-3a9c-44e0-a703-4efbca05c030", "value": "T195B633D119D0A2A8D0F2623871C66B4A2BC17125C4FE4FADBFD24D2139F1D9AEC82577", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228167, "uuid": "5a275db3-8d58-46bc-b399-df8195f68a37", "value": "c7b7b517cf49febe9724e1b897a98881", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228167, "uuid": "7a0ba090-de57-4f9e-aeb2-4c6ba63a3750", "value": "196608:D2neZjvDa5N5o9LrIbQTsbHu7THe8FhG8ryPzB3SFyFYha:D3/AU9LrIdb+THVFg8uhSYFYha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710228167, "uuid": "d880badf-4e3c-4c69-810d-b24ff1c13fb5", "value": 10892288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710228167, "uuid": "a8bbfd57-cb19-48f9-b6ce-43f4e50c0f64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228167, "uuid": "72e44b7d-7249-4fa6-9eb2-facab09de086", "value": "SecuriteInfo.com.Trojan.Siggen27.16296.12545.31206", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44eee686-e0b7-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710278823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278823, "uuid": "d70cf324-7e34-4b6d-bcc3-73d8ccda1adb", "comment": "Malware payload", "value": "ffddcafd19b4d7e26da5db200a16d702", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278823, "uuid": "8b2ada0d-b5c5-4562-9d6b-e9fa755f9ffb", "comment": "Malware payload", "value": "342a18b66dbb550c86c5f2d804ad790fa6c9f7c222ec01cbac497b149f0a5822", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278823, "uuid": "7c2a8f17-2ef4-4bfc-a8d8-fd32313c6a0b", "comment": "Malware payload", "value": "d286431d6faa17ac8880ffa836d73e8c009e1de1", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278823, "uuid": "26b4f695-3d3f-4dbd-a832-5f50624e7117", "comment": "Malware payload", "value": "15398ed3501f577975ca0d5b0e4c40c2d5e7b3d23b01244c5300e69b57ba77052a24c634751a0303fd54ef7c1a6ad0c5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710278823, "uuid": "6337e2b5-b912-4754-a6e3-f8970d0263d4", "value": "T10862D0757E2568C2020F3CF53BD11486E506B1C7EE7F650976E68B762422FEAC22E714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710278823, "uuid": "0861f1b1-469a-4718-bcc6-3795c2e85f16", "value": "384:ylRGFEG9UJIwSQ9t4KyHcWjEuJM4nprTmROKIddBT7GDQ/:YGFEG9CSQ9t40fmMRXInBT7oQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710278823, "uuid": "09895839-43b5-41b6-b133-549b31a3bebd", "value": 15756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710278823, "uuid": "554c14a5-b8e3-49af-9e6e-98982794a20e", "value": "application/x-bittorrent", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710278823, "uuid": "b41d39ea-84f8-423e-ba4b-175b76cc1fd7", "value": "ADOBE ANIMATE 2024 V24.0.1 MULTILINGUAL.torrent", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "634eee70-e018-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710210584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210584, "uuid": "f39516ce-e338-4a5b-88eb-093342418c74", "comment": "Malware payload", "value": "84acfc17591b282a117fd3a005d22ee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210584, "uuid": "fe61b98e-96f5-4838-b15f-4732a9124ec0", "comment": "Malware payload", "value": "348ad20fec7eacd400b35730d19f4af439554503335a854143a85011e34b8418", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210584, "uuid": "0837ba7f-2709-482f-a44f-f807c5b78094", "comment": "Malware payload", "value": "ab012ef794640c4d5f5e47f7f4f515cb3aec837a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210584, "uuid": "a9ad3335-9465-4ee4-b3f9-5d2b964c56e1", "comment": "Malware payload", "value": "3de4662fdb034de2c9bebe1d010c05e9aa62a63115bee57a4e97e1d514d4972d5672747a219b7779cbcee47795ff0ab6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210584, "uuid": "b9b7421e-32ec-4fde-8356-37838bfd2690", "value": "T145940110E5E87C2FE92175BD5A96BB0D8710A1D79B711A27F804704FEF80783ABB2974", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210584, "uuid": "35bef15a-6ae9-4bec-91c1-457c2c1560cf", "value": "4bfa6e825a4206816ed8756369bf3f15", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210584, "uuid": "0b7a8182-d2f9-4048-8fee-834d745d0794", "value": "12288:+UAOTRYAOFvJ8y1en4KGsS2nPAlGH6/Ryb:NRBy1e4KGePYZyb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710210584, "uuid": "6e15c6dc-16dd-4280-8900-eee8fbc81f71", "value": 438096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710210584, "uuid": "0feebc47-05aa-4104-9a5f-1e7e3288bd49", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210584, "uuid": "4b272bad-3aca-4fd9-ad3d-a1f460d0f7bb", "value": "SecuriteInfo.com.FileRepPup.13924.2370", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92b7f77-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235719, "uuid": "dd285611-bf58-4864-b7c1-e3b51d61bd7a", "comment": "Malware payload (Gafgyt)", "value": "33936c9f0759fc520fb74072f440baf0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235719, "uuid": "054e9a13-6cc3-4f2a-a136-d8763cd02a7d", "comment": "Malware payload (Gafgyt)", "value": "350a2c2d5088eb6a068550a357f9b9e036ed14efb9adac74ade660e91bd2d443", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235719, "uuid": "d79323a8-8ea1-4f3e-b83c-6db1b6d9b931", "comment": "Malware payload (Gafgyt)", "value": "72021c808af68780ed90e06d491414178df1f553", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235719, "uuid": "ebd9546e-36f0-482e-b66c-117ac9a2bd3a", "comment": "Malware payload (Gafgyt)", "value": "bcd7aa991e6df42a5e7d06521a93803706eb4a918b8217ff78a7be9828f4d3f942834fdd2b685d20bb2d27fd0cab9529", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235719, "uuid": "19a2fff3-5819-43bf-8aae-5d2e74f6f6fb", "value": "T16734021AB7619DBBD81ECE3B02DA4542409D865A07DF9F2F77E0CA58E38650F61E3C48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235719, "uuid": "cac5b8eb-087f-475f-b470-116122d94af0", "value": "3072:n1QdkyRYZs1l29Frvaq8qR/49qHEkuOSX:n1QHqu1M98VqR/49qHEkuOSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235719, "uuid": "49852e18-73c0-45ad-b745-d92ac64cfdc3", "value": 240420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235719, "uuid": "690c6432-7aa3-4fe1-86b8-93f159c4ef6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235719, "uuid": "3aadc244-1f82-4b79-9124-a8ccaf265f3b", "value": "33936c9f0759fc520fb74072f440baf0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39120e56-e00b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1710204930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204930, "uuid": "9382f603-2d50-49b3-9346-4b14c13dc50c", "comment": "Malware payload (Gh0stRAT)", "value": "39a7aa62122fa6a5a135af8fed6008f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204930, "uuid": "86f708ae-5889-46c9-b05e-90af575456e1", "comment": "Malware payload (Gh0stRAT)", "value": "356698b6b89f7ab04f2ca347f191d262dc0797e143a02acbfe2c35d4831973e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204930, "uuid": "f447d654-a092-4947-a992-fb30aa3a5105", "comment": "Malware payload (Gh0stRAT)", "value": "ecec9d7bfda18a364e97ece3bd051ed55bc462e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204930, "uuid": "00a89acf-1ab2-44d6-9036-378ab2176a55", "comment": "Malware payload (Gh0stRAT)", "value": "d139e6bb311a4932ba095e0ea5e250f1414b87d59f29e06f23d5d7ec3d6d3bd85cbe5b68ac33df81732488dd55608530", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710204930, "uuid": "9f9a4005-9107-4eda-a63d-99dfa6bc856d", "value": "T1A2148F32B5C640F7E915143044FA7BFABA3EBE861711AECB9704DF682C23195D327296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710204930, "uuid": "ed31cbf2-b2b6-4d87-b45f-6db2f9991d60", "value": "4d4c746105ec68f3b3b28040325a9d96", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710204930, "uuid": "e3319c95-685f-4f58-b5b3-9591b7341793", "value": "3072:kTeTY1Em5WBqwP3fsRQ/Xz7iastKyC/hX62xv37ntmefwDTm:kiTViWB0uL7thJ57p37tYW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710204930, "uuid": "40981d56-061f-45c7-9f87-9be238262330", "value": 209064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710204930, "uuid": "71e6ffc0-f3aa-4576-b780-4168625b9be3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710204930, "uuid": "97742834-fdf3-404d-ad7a-12a977cfbd7f", "value": "39a7aa62122fa6a5a135af8fed6008f6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc5537a-e0c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710282626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282626, "uuid": "9ab3a6c5-95a7-4a97-96b0-5378709e5885", "comment": "Malware payload (Mirai)", "value": "69edcf2ea64db0d13195143f3f913aa5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282626, "uuid": "9d99624e-24a9-4208-aa71-d248947fcc52", "comment": "Malware payload (Mirai)", "value": "35e1d0da1a0033f3c26ed4f40e77cf7d8566d4c885e1975fa2a60c3454e5846c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282626, "uuid": "c7274b31-6a40-4e05-b197-fde7380703d2", "comment": "Malware payload (Mirai)", "value": "5291f29aa03a31a8f67cd34154551b7f51854092", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282626, "uuid": "41fa8650-0fe9-46a5-9097-a5fef885f603", "comment": "Malware payload (Mirai)", "value": "08b13be6a54b6b60da5862baba9c642bca8188a978a8fb01e70f7a2b6ef402d48b19c69ca5cb645dcb1c32883578c1a6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282626, "uuid": "17c65bef-211f-4b22-a31a-4f51fba211d9", "value": "T18E436B84E643DCB2D8171671147BAF37BA76E2E91224E746D3A8A736EC41702E017EDC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282626, "uuid": "34c35552-1aef-4b88-b138-93cfa38f7f01", "value": "1536:BF14yTUx6AhcHIOROPQmIzVKSblcMUiBVFrVJwbZnG:B/4yTUxdaIOgPQ/zV95cMlrHJwbZnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710282626, "uuid": "0e5d41fc-f168-4be4-b19a-4062c5677da7", "value": 59088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710282626, "uuid": "7aca4e5d-5e0f-4098-8789-ca2fdee61958", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282626, "uuid": "e2eb9309-3768-462a-88fe-27caa7f13136", "value": "skid.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14910d3e-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (STRRAT)", "timestamp": 1710227632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227632, "uuid": "85495eef-bc85-45d4-8e28-a2a7e8c03e35", "comment": "Malware payload (STRRAT)", "value": "575d75ecae9946950af94951bfac908e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227632, "uuid": "84b2aefb-7a3f-4a02-8ccb-5ff55c7d5d70", "comment": "Malware payload (STRRAT)", "value": "374aa16abdd7a527d3500fb1d49f822263fc382706db71e0f58cc3e00045a790", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227632, "uuid": "06fc28ad-4662-4a0b-a8a7-5a25376fbd4e", "comment": "Malware payload (STRRAT)", "value": "856900c7d62b852f2f5e854f11d8b072aa3721b1", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227632, "uuid": "5ef0c2d4-805b-4bb9-8c19-b3388ea32ac9", "comment": "Malware payload (STRRAT)", "value": "14b03378125542ca0382411685e8bfc4f75a3ab0bdeedd79943a2e1dda13f434cb168797733835d926a52c0186084592", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227632, "uuid": "767b47dd-fcba-4f64-a0eb-9449a376c7db", "value": "T16253E129BED9C13AF03744B38865D073D57C69AA724DE0938FA4DD56D42EFC09F22A81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227632, "uuid": "bb641233-ca16-44b7-bc79-48577ff3cfef", "value": "1536:4jdiIZTjmn6fVQsJ4J7gTtcMbVrHCCT3Kk/:4jwINVqsJmiVrC/k/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227632, "uuid": "b58eae4b-0f34-4e90-9931-03dd94e53c8c", "value": 66182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227632, "uuid": "537733ae-c480-4476-a1bd-37e3cb0b2a89", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227632, "uuid": "5d60a52b-5c98-45c7-9219-49d80dde4676", "value": "Anfrage-Angebot.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e0e4e2c-e0c9-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710286516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286516, "uuid": "25a8216f-d6a5-40c8-8e87-735410c9e868", "comment": "Malware payload", "value": "8f0d630fc0317bf6e72efc2f709eec8c", "object_relation": "md5", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286516, "uuid": "7d6dc180-32b6-4c7a-9555-878d47f4666e", "comment": "Malware payload", "value": "387b55861b370471596725c10e55a33e82834f711aa24b01cd23a9ac9f27a721", "object_relation": "sha256", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286516, "uuid": "2c02b8e2-6d4a-439a-acca-a4707090fb3a", "comment": "Malware payload", "value": "9c030b76f2c2499f5d1d98bc87ae6e7671739b7b", "object_relation": "sha1", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286516, "uuid": "9e8e0d15-8e77-418b-b31b-f21ac274f5d7", "comment": "Malware payload", "value": "b75192ed71679d1f1434e8ac757586bb8e01f607aeef115d129c5d142411f07da4e4c78b467269809a5f8c429ea40b8a", "object_relation": "sha3-384", "Tag": [ { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286516, "uuid": "1b9d15f6-58d5-4667-b52e-15064e140209", "value": "T1ADF17E200FFE1195E5754BBF67EC73B3082EBD4099924D7C412053548E2DA81E829E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286516, "uuid": "52683f68-b761-41da-85b1-93832897cbbf", "value": "96:815RY5jfFxjM2YsZq4Lxa4f7nMex9zGuI1E71yx0nuWvkCa3KI1FBeqT3hZU/vWR:815RY5jfrYuLxHM8htWIuci6SswrQqEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710286516, "uuid": "abdc8fb6-91cd-4efd-9e31-a530121c095f", "value": 8185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710286516, "uuid": "c935e559-2be3-4353-82f0-dbb2d20b86bf", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286516, "uuid": "f07d6236-7e4f-49e4-82ca-c89224e0c3a4", "value": "112151121511215.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89661285-e085-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CobaltStrike)", "timestamp": 1710257463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710257463, "uuid": "8f5c782d-16e3-4437-a33f-8dd9ff5034ed", "comment": "Malware payload (CobaltStrike)", "value": "188044dbe72707df496c5f5f6fde7d96", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710257463, "uuid": "0451f4e8-12f4-444c-b700-ff5eeae742cd", "comment": "Malware payload (CobaltStrike)", "value": "3927c345d61acfb52e6ddf5015033023b58df5b5c638cd6e7897a1b8e5bf98e7", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710257463, "uuid": "40aeb334-43f4-4ddf-b48c-8cf9f057a6e7", "comment": "Malware payload (CobaltStrike)", "value": "821939aef0a4a14520c9a3fd6b4c28839ef5e7a5", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710257463, "uuid": "e840a1d9-5020-4a85-bec4-4912b0e5fec0", "comment": "Malware payload (CobaltStrike)", "value": "238b7504c0ae1ae10b145d4eca467ebf6b9b61618391cbbe308b47049d118d2c6616d0707d57c9339e87516864002182", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710257463, "uuid": "64b2cbc2-ae8a-422b-8713-661d218581b7", "value": "T1D884F16B72D844F7E6B6427AECA30532C73174156A11DFAF03A107096F277D92C2EB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710257463, "uuid": "6eb53d16-d0e3-43dd-96ba-0f21f45ce6c3", "value": "68dd6e8a0fd18b5e7523447cb9049ee7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710257463, "uuid": "2a79e255-6579-49c4-9ac5-8e66de4a2a3a", "value": "6144:ZRLS6xWT00aqU8FT0NyeX0efaSRv+6jMq0h5V6rHeFWoBP++SWSO:ZBS608qUqQj0eRvKV6+FWOCW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710257463, "uuid": "fa4778f3-21cb-424e-9f50-ef86db7a209c", "value": 386048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710257463, "uuid": "5080150b-82c2-4ac1-b7ec-26216d769a53", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710257463, "uuid": "12ce9dbd-56ed-49f4-abe1-68716a2565fc", "value": "SecuriteInfo.com.Win32.Trojan.CobaltStrike.4EYNH5.5772.17622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae860d91-e041-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710228320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228320, "uuid": "d01bb8f5-4f0a-40ad-8348-f264f7dfe86f", "comment": "Malware payload (RemcosRAT)", "value": "770090dbf8a70886f8211470c51d2e25", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228320, "uuid": "5bc48ec6-9909-41f8-ae6b-647c793a78a1", "comment": "Malware payload (RemcosRAT)", "value": "399a86c4cee7b35b9a2f5ee81ab95daf61c75192f8c99025bb2cbd11faa588c7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228320, "uuid": "bf47bf25-7d3d-4ba6-abc2-535d5aaa6f4d", "comment": "Malware payload (RemcosRAT)", "value": "368d0bb53222008a264e8e860cc181540a48ea5f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228320, "uuid": "210ee048-56ba-4309-83aa-d9bd9144703c", "comment": "Malware payload (RemcosRAT)", "value": "9be424016230f682d99d086f00ee2a9306c705beced9795e407b908a07147c142b9b07e8b71e6c598e903c9499839183", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228320, "uuid": "960ceb58-84f5-4dfc-b151-b84d32c54ec3", "value": "T13D65D06773E14D3BD1331A351F29D1D8673DBA722C38748E3EE4AB4C7A696C06039296", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228320, "uuid": "0ff5c575-260f-44a9-96a4-c1b39b2de0b2", "value": "bcf1ed701dda9976814ff06414fa37fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228320, "uuid": "4c15e1d6-980e-4fab-b04b-bd832bfe269e", "value": "24576:5E2wBC2CXFIpxe3ODQIcWX7sGYo2NaRJcgLyhFMQnry/XFOGIvw1k:5EGxfHWLsho2UTIFMQe/0jo1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710228320, "uuid": "6e46561d-73da-4f33-8b8b-6c420ba2a466", "value": 1478144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710228320, "uuid": "8296b27e-16d3-4ac8-8ea0-18bc5881fda0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228320, "uuid": "f7ac3b53-5661-4b4e-8492-0fffb2dee884", "value": "PO-53733732737.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112a66d0-e066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710243947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243947, "uuid": "a4382d99-2132-4511-a625-1983018e5be6", "comment": "Malware payload (Gafgyt)", "value": "3fcbe142cead7ff88270908b90e28616", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243947, "uuid": "dd44584f-db44-433c-8dca-16f168fd3027", "comment": "Malware payload (Gafgyt)", "value": "3a3fd0a45bd31de468443284b0a3474b53e2e0c5cf9b22b6e7855b42cf511c99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243947, "uuid": "5ea830a4-6c81-406a-9a03-9bed5fbbd5bc", "comment": "Malware payload (Gafgyt)", "value": "7022528e75ade797bcbfff08fc4b441e36936786", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243947, "uuid": "d6f26021-dd52-4093-98d0-98d87e32083c", "comment": "Malware payload (Gafgyt)", "value": "2d9a52cd046449bcd2573bd3f85a401868467b0417242d96fe1cc1e91bff7dd134aa6f5bf7be42d4bc8e135c0502a080", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243947, "uuid": "6d09c2c3-5aa2-4f97-9701-e40b4c8d6cd5", "value": "T1BF931A9BFA42CEB3C41310F112AA9F219D71F9FB4823D642E3646DB4DE154C25A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243947, "uuid": "04121b50-8547-45ca-be02-801ef9946fac", "value": "1536:NL+k8eK+heN2qhbckmjW4w57Vo1EOQryVwCiUH1FVLx8rbrbuqMyu/J33/ZMe0go:NLlVh+2qh3rRVo1EOLVBiUH1FVLx8rbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243947, "uuid": "51c798e1-611c-48e8-9f91-9ee44c8c79e7", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243947, "uuid": "baabc3bc-999f-433b-a656-982fa675a6ca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243947, "uuid": "0104cf29-7e89-4960-b531-0e139af1c882", "value": "3fcbe142cead7ff88270908b90e28616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8528d025-e058-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238129, "uuid": "6738c483-1835-449e-99e2-e9553ab65023", "comment": "Malware payload (Mirai)", "value": "ff88bd0ca5bd73dce90f0aa232dddc95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238129, "uuid": "54045480-a94c-4ea9-ac0c-75ccfacd5b46", "comment": "Malware payload (Mirai)", "value": "3afc0b0599d81b1c9fac68f519e99dced7a8401f13bea6e92c22ea29431feed7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238129, "uuid": "bc128a29-f6af-46ec-bc4c-1c904d10d8b5", "comment": "Malware payload (Mirai)", "value": "6723205c0109b1853fc11b98c1010ec521a1ae2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238129, "uuid": "6d69cb63-f98c-4fcb-8aab-b51a27bc6714", "comment": "Malware payload (Mirai)", "value": "f3a11bc584b362e6e9840de88046d0d4bbb7fee9ea9d2e672fd3c0082c88c956e899026cc70968dee2fa4577faeba464", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238129, "uuid": "2e66b2da-fa9c-442b-a499-991833e4eb44", "value": "T1EE73D83F2B532A63C4C9103245F34371EABAE71A387D4B53A8A06D686F05B9435563FE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238129, "uuid": "b024d646-3444-4634-8b8d-a42186dcf080", "value": "768:OdUNi9WxeI9H9H169qQEOr1pSJbOTXq3SWyWTSssVEp2uL08O+EWgoVtiAHYjoDT:qWHIE+WDqEIuL0GKNRq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238129, "uuid": "8630ae3b-d0ae-4c3b-9af2-758a06e88a61", "value": 75725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238129, "uuid": "73f086be-0f44-4fd0-b045-d09d2024de31", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238129, "uuid": "60474ef2-7168-439b-a744-8bdcf9bb62b7", "value": "ff88bd0ca5bd73dce90f0aa232dddc95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b44e0358-e023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Glupteba)", "timestamp": 1710215444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215444, "uuid": "70c2f787-bbff-4890-b6c3-2e32763a5964", "comment": "Malware payload (Glupteba)", "value": "bfeb146089595a1526d77ecb77ed1585", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215444, "uuid": "a152e959-d4f4-4e94-90f6-4c93a947faa0", "comment": "Malware payload (Glupteba)", "value": "3b7272d0f31250926d9fd53b7c46830bc9fa9a2d750380ed92739b7883191798", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215444, "uuid": "10ef6b06-b800-4698-a36f-05e03415d326", "comment": "Malware payload (Glupteba)", "value": "b68e75319b9a2870d7958f8099d66e11cef628de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215444, "uuid": "76dfb08e-e684-47cb-a7b6-a37f349023d9", "comment": "Malware payload (Glupteba)", "value": "64488422a6a0aa25c29f8577798b419df9ba833b49b2efc1397d41f3bf2a28793d0eee4762b9abbc830fdd4c5fe28793", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215444, "uuid": "f8b61ea7-3007-434f-be86-9fb822ce988d", "value": "T17E16336232E0E538F966033A8936ED865EF77C7557B8095337553A4D3DB0AD08E20B2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215444, "uuid": "e126989a-6942-4998-8239-59ac34477cee", "value": "400a1fdc858ff9b2d07a8786c4bdfa3f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215444, "uuid": "0a928abe-9abe-440a-9b33-1d6920d8ea93", "value": "98304:cN8JqIbPE4i7N72Cg8mUyrSElplXZvQ5t1MxuFIGPlSRtUzIvi3ZFCDZ:fJLbPrk2Cg8mBflpliHxFbSbUE6LCt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710215444, "uuid": "52e03463-8255-4c49-bb00-de0e02877186", "value": 4368248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710215444, "uuid": "06534d53-9fc1-4148-bbc2-cc00ff4792da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215444, "uuid": "7c10c87c-43a8-4265-a3c7-d5d78d09605f", "value": "bfeb146089595a1526d77ecb77ed1585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5766bbf4-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238481, "uuid": "72ef2c92-1cd6-4378-bd2e-b4be2e327420", "comment": "Malware payload (Mirai)", "value": "47faa238f089a8bde87a7af078e994c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238481, "uuid": "2981a837-ed7f-4e9c-979a-65e2bed9a354", "comment": "Malware payload (Mirai)", "value": "3bc99bbf2dcd2c0c91dab5d416184f71477e4145da8bf1c43988c2b131c78ab0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238481, "uuid": "c50ff317-bd45-4452-b54d-a83442c47048", "comment": "Malware payload (Mirai)", "value": "4452e1c28fe49c6f193855053a14d4d94492df3c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238481, "uuid": "47dff3f7-fc48-44be-8c25-397b63c90778", "comment": "Malware payload (Mirai)", "value": "d6ec4c9ff89095053d86fdf9e27f37670e554b6343d11142f30f9732652131c910977b82932e64f85e9ad48942b3eda6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238481, "uuid": "b1331b34-f930-44b4-94ee-27e61a7dfc67", "value": "T11DA33B31B9368917C0D492B722F34336F2F7935A21AC862E7E620ECC7F6465066577E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238481, "uuid": "3e58bfce-78d4-40b2-ab25-2ccb106708ba", "value": "1536:Ab/lIQOAFgkZYYktGCaN63jky/VR0UGX0KUas5mpq8otMRytM8WPdfBbnV/:+N63CU2+acm8EwO8WV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238481, "uuid": "c38aa904-9155-4c79-917b-477967413ef8", "value": 100740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238481, "uuid": "a919d8df-3819-4846-854f-2528e3493b38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238481, "uuid": "b03e0ca6-37ee-4e19-b509-5e773ab90c6c", "value": "47faa238f089a8bde87a7af078e994c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4229651b-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710227708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227708, "uuid": "8eddd0b2-9f3e-4134-a7d6-a1c04e75e750", "comment": "Malware payload (RemcosRAT)", "value": "26570b685186f148d866f342f94d04b5", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227708, "uuid": "963226d3-7bb3-4972-a03b-3f1cc4b2b391", "comment": "Malware payload (RemcosRAT)", "value": "3cc2f066ba77c5d0468f77580957ce0d872961f8803bd9dae47ee65a8088b004", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227708, "uuid": "ba744c83-eaa3-4807-909c-d6efd6a35fc9", "comment": "Malware payload (RemcosRAT)", "value": "46d5d6e37c2062c8c7aef94dca143520d4be42b8", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227708, "uuid": "dc5f39cf-5d27-4a90-9ba5-543942aed356", "comment": "Malware payload (RemcosRAT)", "value": "497e3900b99370ee0e125696cd28b2a2cd92d001f90f7074759e86ddabbee8f5e42be5822721434d2b553cefbd02d850", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227708, "uuid": "f177d578-cf16-4818-8d1c-11501240b202", "value": "T1CC23AE2A7251D16CC04399364DC8D1EB2629FCB1AF86970B71E4771F693A2D2CB13B1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227708, "uuid": "63efffcc-ac2f-4167-b6f6-8c7c32316cb4", "value": "768:myBP0xYOI5yVKtjV0FcuUmegv1EAoGrDwFrne7fWmmDuxby4f64AyVU:m689IoV+jVGcxgv1EnG3wFCfWmmKxbyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227708, "uuid": "77cbf12a-e501-4214-9083-0630fc27a459", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227708, "uuid": "5664159f-5b8a-468d-b8fb-75f1bdb9e26c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227708, "uuid": "48097550-1ae8-4348-ae84-4dbca757ba53", "value": "RFQ No. PO414501.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e998f6f2-e05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1710239156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239156, "uuid": "a731ecc8-f415-43cf-b05b-e9763f964789", "comment": "Malware payload (Stealc)", "value": "e533f92146fcacb8caca823882b8d304", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239156, "uuid": "fe541442-b451-4bb4-b4ea-91a8b7f41a8a", "comment": "Malware payload (Stealc)", "value": "3cf0b82b4b91ac001ede7dfe7736f42e2a5e1bd9cc6da34393ec9e18ec81a9fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239156, "uuid": "3934152c-3dcf-4faa-81f3-8fed2f02c523", "comment": "Malware payload (Stealc)", "value": "fcb2b79d08e2fb7a58142faf7db2a36f142b309d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239156, "uuid": "bc9d27ac-57ed-4753-a451-a33b91909ba2", "comment": "Malware payload (Stealc)", "value": "8fb4d963b0bb73d172c0b7a87cf597aade3ac9993f7610953fdc28ff05f6ea1ac2a21f8cd2f84b578f6331038f4f6cc1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239156, "uuid": "ae48eb9f-cbfb-4a30-a957-7046f5953bc2", "value": "T1A2238E12737C573BCFEF4BB99860621016749362AB41CBAD2DD4A0DE54ABBC507223E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239156, "uuid": "91a8b6e9-0585-416d-9b32-321dd56af140", "value": "768:ygDUz4vSd32TINlRjiniKEc3dJ3Bwj+3p5SNUMNTEFiRQ:zUz4Kd320N+nir2FMN9NeiS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710239156, "uuid": "0d262acc-4cbd-4f56-83ff-4a8e15418338", "value": 46304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710239156, "uuid": "9dc98744-60c6-4f29-bc03-feaa539394df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239156, "uuid": "a2455f5c-e3c2-43f7-bd2e-c6430a359374", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8807d051-e058-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238133, "uuid": "c8674b48-24d9-4de8-bdf1-a077fe072ec8", "comment": "Malware payload (Mirai)", "value": "5fb9ba072307a8a9798610d15217e45f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238133, "uuid": "6ab0b726-7579-443b-83d2-f8e3cc8e3d5e", "comment": "Malware payload (Mirai)", "value": "3d4518b76a24f2b90dc439f834f8ab0909c8e2398956068ff515cc3ec7aec107", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238133, "uuid": "e947562d-6873-4c33-b747-5e1b0958ca80", "comment": "Malware payload (Mirai)", "value": "75c6fff2beaccf7d32d4341a1a1004c98a0ffe93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238133, "uuid": "938fb9b3-5d95-47a5-a7cb-dbde65197e2c", "comment": "Malware payload (Mirai)", "value": "6f1f7c6e2f58a904b4c55bc0906d5e05f26489e9c99e97174b4b702b24b71f4f5afe6d431a0d4d7d34ececf586308939", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238133, "uuid": "701cbded-d488-4114-b18c-ecb81d948a41", "value": "T196837D66E4112D99C326857D25F6CAF41373D860A1871EF9A266C63C604FE8FF23D3A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238133, "uuid": "67ce17a2-898a-40d6-a8d4-dd03dd014111", "value": "1536:vz+4CnrsffwCCEvYyXdKw0qj6Dp7z7Cb8fpQIv9fho5L:71NHrvYyXEwiDp7fUJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238133, "uuid": "4c620c21-5425-4cba-986a-cfb795bc9e9a", "value": 84336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238133, "uuid": "622958d5-689a-4ce7-8c00-3d7e363b7256", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238133, "uuid": "a7a98fd5-2967-4fcc-a35f-59741cea1ce4", "value": "5fb9ba072307a8a9798610d15217e45f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e366ed5-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229930, "uuid": "120482d9-ba61-43ae-82df-bd87f590c6ad", "comment": "Malware payload (Gafgyt)", "value": "3f73515d8299f61ecebcf749459c1567", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229930, "uuid": "979d26aa-3af7-4321-9bac-9c7e67edba51", "comment": "Malware payload (Gafgyt)", "value": "3d677f705bca809d6f14c8d38704e42ac132b8b6d0d824e9c62a9979e135ed65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229930, "uuid": "4b96fb0b-04f8-4d89-bab2-9e4ca011b37d", "comment": "Malware payload (Gafgyt)", "value": "2d962f443b98882ff24ea9b9147b2689758c9c44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229930, "uuid": "84cf1a89-1ed9-4f69-8083-929518afbdce", "comment": "Malware payload (Gafgyt)", "value": "3395d7b961f37e0a52ae4d0f7391a567394c3f4824dd8578d70bb55b7855c3353e83de6c62e28a38c4460de285f8e9f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229930, "uuid": "74f393a6-1738-46e0-9de0-2d950ce7413b", "value": "T1B1B318825600D573E1033BF802AFE6220072FDFE1A57C566E3897DFC86764963791B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229930, "uuid": "d3d13485-ce33-47c3-a180-fe9c05839938", "value": "3072:Qmvla/zS8QUGzmXaxntk/TBeFpA1t+Z0Ua3hgp6W:o/zS8dgpjGTBIpst+Z0Ua3hgp6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229930, "uuid": "455a6e46-dc7b-4f34-97b4-d3a232a2a7d9", "value": 116498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229930, "uuid": "80c317df-dad8-4088-9d71-fe31b51b6ea7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229930, "uuid": "6bc69e8e-cad3-4c6d-a3b2-c4a82ed18e67", "value": "3f73515d8299f61ecebcf749459c1567", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36355584-e06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710247445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247445, "uuid": "4f8eea57-7a5f-4797-ab58-9b7535a5db37", "comment": "Malware payload", "value": "a1825bae158680ca364c7d031588568f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247445, "uuid": "929cc0a7-517a-4097-9707-63a898c8c024", "comment": "Malware payload", "value": "3ef05c2d9db938c7731708d19055ca7a507fd94032623a794cf1e266d79909a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247445, "uuid": "210ef506-92ca-4a80-94e1-2219dcc617fc", "comment": "Malware payload", "value": "6ef1bf1958733b704548ad948a1c8fbb8a58baa7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247445, "uuid": "315cab6e-7e26-4410-a168-095b7ebb8455", "comment": "Malware payload", "value": "c07894286d5e2e1d32cd65f0e8b959f44e37bc46543311d76438b8993dbd668fe3a8f69698125a155547e97019088744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247445, "uuid": "a109ea54-d86c-4205-9231-535387e3d96c", "value": "T1BAE65E8733D79DBBC8D167766EDB63384713FC325E1B4A97768A832884476885E06F20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247445, "uuid": "0f681170-b5ac-49f9-8c26-b047b14f1e22", "value": "7d20aa041315196d54156db8a50f75c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247445, "uuid": "aee8e041-a244-4db8-8379-604b59ee880d", "value": "98304:dLueuwcVLqj0KmC6EYK8Gsg6DdD5bRIXeezz25cS2FlFLHajzBGsd9Z7jo8Rtcdr:0qj0KmC/8GIRIXeQS5P2FlFLHapq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710247445, "uuid": "578e27d2-c14c-4b66-b1ba-9c8d8bfcb4a9", "value": 15101315, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710247445, "uuid": "91cff2f6-74a5-4f4c-8408-9b55623cef0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247445, "uuid": "6ee736de-4480-439d-8d16-e02d26ae6495", "value": "SecuriteInfo.com.Win64.Evo-gen.23819.1236", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "915e2cdb-e058-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238149, "uuid": "4e716f49-ca22-4c7a-bed5-a3edd3bc0f55", "comment": "Malware payload (Mirai)", "value": "9b467c51406a019024d45e7bef2bf57b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238149, "uuid": "9320a788-5fad-49ed-907c-00113b9767d6", "comment": "Malware payload (Mirai)", "value": "3f5c49a0e40c7f0795d52a90319ee65e190187e4d7648ed6938d0de9156c2d76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238149, "uuid": "216c56b3-8368-4c1f-b0b2-192fc83b1031", "comment": "Malware payload (Mirai)", "value": "506e51b855e3b62470387b434a891aaa15369731", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238149, "uuid": "d682f3da-8312-43d6-ab1b-35b222922377", "comment": "Malware payload (Mirai)", "value": "2b5efd264386e655aaa516f883a7b9750b09fa4902ca9f20a00b35444f994416240dac8a761f7148a6166c686a63fbeb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238149, "uuid": "284d1089-bc9d-4f69-a155-443cb0eb4e0c", "value": "T18A433949B643C5B7CC830BF54297A9BB5231EA399A6A0D6AF31C3CB4E7139CC7019761", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238149, "uuid": "4e9cbfc3-08d2-404b-9a94-2c75437668a0", "value": "768:O3fOIM07dJ7vgbF5ulAoGoWboGq/h+Ylyzn4nR7l2cnMOj6IH:hKvgbGlA3bBehvyzMKcM2bH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238149, "uuid": "d64d98c2-ba64-4a11-b211-1db3847a85b1", "value": 58081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238149, "uuid": "ceb8d434-eeb8-447e-83b6-fbbcb1c2ab79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238149, "uuid": "e9984c74-43d2-41a1-8338-96d15b556b16", "value": "9b467c51406a019024d45e7bef2bf57b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21554d93-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235384, "uuid": "f2e90224-ce4e-413c-a369-cfe50a25994d", "comment": "Malware payload (Mirai)", "value": "b34ef77481213279a99f54a7464f3f3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235384, "uuid": "50c8ec22-695f-4350-bc73-ad1fc3b58ab2", "comment": "Malware payload (Mirai)", "value": "4147cb9c5a1f222580318046c4c4112b114ec3e9b7f33cfa159ffe36aa411dc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235384, "uuid": "cb6db098-c9f3-4eb9-b3bf-5a756459d6a5", "comment": "Malware payload (Mirai)", "value": "66789a3559d25b411c67429d2977494e866b253a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235384, "uuid": "ffd3cfc5-7152-4323-8769-4fa1d6c76ccb", "comment": "Malware payload (Mirai)", "value": "79144384797e13903feefb6e67b7c92e3bb3369f01327db01e7dc48c645677db8b9f87805f5387888ad0fced12b378f8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235384, "uuid": "3bcc1b51-6799-4ada-b841-3c3b5e210d44", "value": "T169E3C55ABF600EF7F86BCC3752E91B0124DD595A22B87B35B530C858F18A24F16E78B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235384, "uuid": "b8d60963-2b6d-40d9-86af-0a1d28d614c3", "value": "1536:iUeZU2A05J5+YIJheEvjfa9NvQAsq56Mju0XjDCGcAOFZdXfpqSrZydQg/aX:qZU2AYH7IJheA2DQAdjhYAOFHZIde", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235384, "uuid": "330051b5-d0c3-4f3a-a2b9-15eed4f72875", "value": 146564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235384, "uuid": "6b87b486-d95b-47f5-b540-886457b427ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235384, "uuid": "80806aa0-bcc0-47ec-b7c4-d0fb37abc7c0", "value": "b34ef77481213279a99f54a7464f3f3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06da72c3-e023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710215153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215153, "uuid": "66904563-6b32-4575-8bf8-08ecc12135d9", "comment": "Malware payload (AgentTesla)", "value": "1f677f128897e4e490351e140776a44a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215153, "uuid": "6d4f20eb-130c-4c2a-8249-b305c79cca1b", "comment": "Malware payload (AgentTesla)", "value": "41e92c70e0cfad3d8a15b25c9abbc79a3145444ec2c589881b46116ccb7b0a7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215153, "uuid": "2757c63b-9738-4f42-995b-b974885f2649", "comment": "Malware payload (AgentTesla)", "value": "363cbb65b86e443f24de3d4915db01208217c08c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215153, "uuid": "fd6227e8-9140-4b0c-881a-753cf457453b", "comment": "Malware payload (AgentTesla)", "value": "c9d12c2d704a2d865b0ff8b8b2a0ead768ade8de42bb0ffee998f5bb669d06a2842fb634bf46e3eb947be8d9cee41823", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215153, "uuid": "f36e403a-af99-4f66-990d-b367d55156f5", "value": "T15473246AE70F0925DF55A67B434A4B4909FCB33E738540B179BC97343BAD81E4A2287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215153, "uuid": "57dc4da2-eee8-41ef-a528-d64f5387eaec", "value": "1536:LX0A5LXTZr17PCkCEG7pwwkBwb+ExqmBTIIm:L11dCh7pwwTSEfFIIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710215153, "uuid": "7640c1f4-eb18-4c36-8839-916a97dedea7", "value": 79923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710215153, "uuid": "27e564e4-ba6c-46f9-9317-1eda08f660be", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215153, "uuid": "13c6d9bf-0d19-4825-a035-2ee0d6e85eec", "value": "1f677f128897e4e490351e140776a44a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "683b8ede-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238510, "uuid": "18beed7c-4cdd-4f5f-8037-f8463119ba43", "comment": "Malware payload (Mirai)", "value": "628b7940373e2eafbad7db6f33abe11c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238510, "uuid": "c2ffb5d9-b53f-45b1-a3b2-e4ccde7e41ab", "comment": "Malware payload (Mirai)", "value": "42721d1f24e20e2c5291ca6c621ea72ca7290ce1aed4cf2ebcf4338a37bade20", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238510, "uuid": "19546ec2-791f-4ea9-ab79-94ee36d9bf69", "comment": "Malware payload (Mirai)", "value": "56cb4992c4315b2d13e038cbb20804a7b4d27a01", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238510, "uuid": "6b374d9c-08f1-4c4e-9be7-b6407f89382d", "comment": "Malware payload (Mirai)", "value": "1ac1238408544c627535524059b2b29a2974f70b8ad460c4e36eec81ea9fd1c979608c5744d328b982df8c02af051e9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238510, "uuid": "4e9590d7-7535-4040-ad6a-3177042d6c0e", "value": "T13A93733BAB61DF7BDC4ECD730AAA8501108DA54A12C96B6FF6A4D51CE34BD4E48E3C44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238510, "uuid": "d483b372-9578-48f8-b71f-51ca6aa5eab8", "value": "1536:HeTUMhAlGVT/0bdKw8m0Yp3IWZTVMrqxxeTG:HMuxp3IWjei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238510, "uuid": "35867797-412a-4176-a649-ddbac0f36c87", "value": 92913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238510, "uuid": "e74b1856-2e13-41e7-a983-532f88f056cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238510, "uuid": "2e989a09-c629-4205-bf28-8c3aa2117c36", "value": "628b7940373e2eafbad7db6f33abe11c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e6ca503-e0c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710282624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282624, "uuid": "b66f591e-a1be-4ce6-866f-6ea666579437", "comment": "Malware payload (Mirai)", "value": "7588837212bb827591f992887df1c2f3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282624, "uuid": "cb07d761-51dd-49bb-9d73-36a67fe717e6", "comment": "Malware payload (Mirai)", "value": "4347771522478579659903b8f73563bb9ed00155a1340c79f98e6eb98a6a1fc8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282624, "uuid": "10ba9313-716c-4538-864e-1b7459f42f97", "comment": "Malware payload (Mirai)", "value": "4b8202b9f4bfab1b5a46a33640e65a9bc6046883", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282624, "uuid": "cd25637f-e43e-4a40-a0b1-0fcb7bd665ce", "comment": "Malware payload (Mirai)", "value": "e023062a69b3accc7f44838976697134aa6165571b52d639df02284e195ed28d69dcb2914e9db331ee9082cc9c83c92b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282624, "uuid": "3ccf2857-f563-4e42-aa1a-09d733f7da82", "value": "T11F83B40A7E218FADF79D823547F74E21B75823C527E1D285E1ACE9015EA024E641FFB8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282624, "uuid": "153642ac-fcf4-4197-9959-c7c520becf8f", "value": "1536:/hXo87Kjc2OGaryS7eg4O/78benUH1wbZnLQr:/hXow4c2OGar7eg4O/78PH1wbZnL0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710282624, "uuid": "4cb48f9b-1029-4f4b-84a1-9d86cae4592e", "value": 85676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710282624, "uuid": "6bbef5c3-7ba0-4411-9b58-b666bf59e654", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282624, "uuid": "152a359a-d468-40af-89d0-9d671ad1907b", "value": "skid.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99defd0a-e051-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710235157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235157, "uuid": "4e6a06cb-f5ac-41d6-88d0-45f41488347e", "comment": "Malware payload (PureLogStealer)", "value": "5fd249a523f8006dae95752b5cf9bf49", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235157, "uuid": "ea54b894-53f4-45a5-81b8-72101311f7fe", "comment": "Malware payload (PureLogStealer)", "value": "443b3b9929156d71ed73e99850a671a89d4d0d38cc8acc7f286696dd4f24895e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235157, "uuid": "5fd8b330-36a6-456e-bb64-38e64326b90b", "comment": "Malware payload (PureLogStealer)", "value": "e6e02da45574070c899c51f2400f9bd3171b02f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235157, "uuid": "7ff4cc54-9ee3-408a-a83c-b79b320a40db", "comment": "Malware payload (PureLogStealer)", "value": "90169152bf150c2dc15f19e25497c4d75a3e22b2adf2f78bd1a54ff017f9c283a0b14063ff7c703b81d7649346729c17", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235157, "uuid": "0dbb0983-1f5e-46bb-a395-085f89fcf357", "value": "T102B3A00AFD4350F1F91B9970968BFB3F8630E22784149DA7FFC64B59E9627B2640A105", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235157, "uuid": "e756c883-004a-4277-a5cd-5965aea53652", "value": "b26a7e001a4be269742be838dadc9db9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235157, "uuid": "678afdbc-63bd-4e4b-837f-1feaa437362e", "value": "3072:e4GZnrASj3/lQLFvGwFCZ+XH+IB8wvFxP:e4GZrr3/K1Btvn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235157, "uuid": "4feb521b-74fe-4806-8540-0a7f49eed9ae", "value": 116256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235157, "uuid": "d16a539b-3d45-4d5f-b424-93495f9100d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235157, "uuid": "4d6d09af-a12e-475e-ac77-ad8014b5a2ed", "value": "443b3b9929156d71ed73e99850a671a89d4d0d38cc8acc7f286696dd4f24895e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a10a147-e060-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710241546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241546, "uuid": "1037b02d-32c4-4dad-b944-6823e8b1dfe4", "comment": "Malware payload (AgentTesla)", "value": "66444b9b6b602490577e8350deecbfe5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241546, "uuid": "dac19182-2548-46dd-915b-b38f0bef0857", "comment": "Malware payload (AgentTesla)", "value": "449c9a25e64ccbe50feb20e66626e8388a4550da5181af03652110e628e239ff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241546, "uuid": "0a95b745-9024-4a4a-9bea-519791970c13", "comment": "Malware payload (AgentTesla)", "value": "b19d74178b8dc8efe096c9b983579fae479ef84b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241546, "uuid": "e678ed1a-6a6c-4d5b-86a8-9488665a8e94", "comment": "Malware payload (AgentTesla)", "value": "c4f025af4ff06f696086dcdfb9d1302e914164eef4e70c367ce70435c1578daecb876f00982b9c5a6b967ef5a962594e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241546, "uuid": "3596a968-7005-47e9-9b99-6fd68899bc97", "value": "T10E552306F6A0E406F26259354EEADF3D6EB02E617C1C431726F37B2D3E39999AC4D118", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241546, "uuid": "cac26841-5b4c-4279-9db8-2736c3c635d5", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241546, "uuid": "f802f15b-ed04-4a20-b5c8-5bae9b4b6239", "value": "24576:4T5w6yQBiSfpWiA3ZOIWvbFOaUBb6TtQTdiFjvAtq/hlp86toK7Ip0xc:2VyQBiPLobFOLBUQgF0YLlxc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710241546, "uuid": "e7ba6c27-d58c-42d3-b830-cc58b707d26a", "value": 1396248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710241546, "uuid": "81ac6a1f-77ad-4623-9c08-bbb22fd7efa4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241546, "uuid": "a610ac47-1814-4ea8-94d8-59e1ab189655", "value": "rPurchaseorder03112024.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fda101-e087-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710258175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258175, "uuid": "861eb85b-eb9d-4cc4-83a8-05f105bdcd15", "comment": "Malware payload (AgentTesla)", "value": "7787c204730add19e625d9b8417b98c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258175, "uuid": "c0134ce2-c5b4-4ade-aa27-bbe3b70d8ba9", "comment": "Malware payload (AgentTesla)", "value": "44a2e162de1004f37a2ef99db9becf3ef81708aea25756a7ad8d550ac7d8970a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258175, "uuid": "171c126e-c135-4e18-9012-aa5459408ac3", "comment": "Malware payload (AgentTesla)", "value": "1a69e94936edcf7f6c12e0f5aabd45b1614da2e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258175, "uuid": "28dc834f-6996-484d-9a9e-85d807e6ae3f", "comment": "Malware payload (AgentTesla)", "value": "fbbf09ec7540b541bd00f7d03f920ea38c1cf0dfd3e8e955cd88ff4a68e4c569304cba0d1daa291784cdb60848482957", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258175, "uuid": "fdd23690-fe0f-4809-b85b-954de40da037", "value": "T11E250111B9045A66C3E832F50F12C27017726D6E2970D18D69F6BE9B3BFE7DB1202287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258175, "uuid": "c1600e8d-f8ce-4118-ba7c-eb2d304dc89c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258175, "uuid": "074e3517-e4e2-4398-9be3-d30271a0f98b", "value": "24576:lxENlqm1vQiWr52U5zEDk23dSXpfBErDet2A2hD1Itw:TENlLlQiWr0U5QDt3dSZfBoet2A2h3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710258175, "uuid": "df54d44b-3b60-4299-b837-d3c0c981d6d8", "value": 1045512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710258175, "uuid": "00e5583e-1254-4a35-948e-3fefb42f08be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258175, "uuid": "5685c2f9-3ac2-443f-8310-b72ddb182ac6", "value": "PO-JP10-02082jp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6bd28a3-e0a7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1710272115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710272115, "uuid": "9dc33e38-1a64-470e-8974-cb2877b348cc", "comment": "Malware payload (Gh0stRAT)", "value": "43a9c65b2d34028efe9ae3ae632ff149", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710272115, "uuid": "96644488-4ac0-4071-98cb-082efe341200", "comment": "Malware payload (Gh0stRAT)", "value": "4509872664c7b8cb9eb531edf868002e9925be16f771a27cbf12537673d7077b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710272115, "uuid": "312ddff4-7d0f-45ca-b60c-746ace68a537", "comment": "Malware payload (Gh0stRAT)", "value": "9dc945cc5d1aeeebcf0d874906b37421b78a764b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710272115, "uuid": "f244ee51-2dbb-4d83-b471-a75ce256209e", "comment": "Malware payload (Gh0stRAT)", "value": "5233791ab280761ecb4bfa6f94dacbac7c69e2fefbb39abc3d00bc8a8aba2fcdd184b0f154627f92bf245d6cf0371cf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710272115, "uuid": "af09cafd-34ab-452a-956d-7b15cac116f4", "value": "T16EC3126F1B381463D9850F3961CD9972B9396381BFFD2084D028586A713C726FFCA69D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710272115, "uuid": "485135a2-1c98-40af-9867-8edbdee64a8b", "value": "b0d2dae2d78d58a4fb9684e85ffb160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710272115, "uuid": "16edac38-5387-47ac-a37d-067c5a4fa347", "value": "3072:i6jsb9exS8NWZOVxVdqvm4drMN4sBjXa996yz/XLnD9UndB5IKP08:PA5DlZkN5Bo96yz/XTDkqv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710272115, "uuid": "be37e0db-7a84-4cae-bb05-b83a39d04634", "value": 127568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710272115, "uuid": "c977c0bf-0d3d-4547-b7f3-94904b35430e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710272115, "uuid": "845c8257-28e1-4383-b3ce-c6d230459f24", "value": "43A9C65B2D34028EFE9AE3AE632FF149.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44b5ca65-e05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238879, "uuid": "48da13f5-083e-42cf-827f-f976f9000254", "comment": "Malware payload (Mirai)", "value": "c32df52201db4234a65416f97a2a4c17", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238879, "uuid": "41817e26-7a10-47d2-be98-4f53bc93b078", "comment": "Malware payload (Mirai)", "value": "458866c2b11c4eeaa7e8b745d69e68123451df4f568b4c083aad44786c62afda", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238879, "uuid": "6c65f2cc-c73e-4cd7-b8ca-c818817921d0", "comment": "Malware payload (Mirai)", "value": "385c6a41f6cff5c87a9b2a6ad8648cfff80102d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238879, "uuid": "206930f1-b179-4904-806d-2a772b1e2529", "comment": "Malware payload (Mirai)", "value": "788487273c710fe7b8aa7a55790fd719ef1f2f07952ad3f75d8be58d305edb89bf9af0c23b405316c168f6fd5393a0a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238879, "uuid": "e1c3876c-0fd4-4efd-b829-c618cdebcbfc", "value": "T153B3389AFD828B12C6C6137AFA7E518D371123F8D3DB3207DE155F6036DA91B0C66A90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238879, "uuid": "81e4fe6b-cbbc-40cb-b981-cd3c59f41aef", "value": "1536:sTQ7najh/DHdizNGmxsFFq4vtmSEiuGoIHrxu5S5ifyK3ypvPp0uvsQg/aZ:sTAnajh/3vVAi5Xxu5S5i0hsk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238879, "uuid": "78c70b6a-fcdc-4ce8-92e6-3719afde1219", "value": 108356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238879, "uuid": "aa40b2a1-29ac-4f03-bf7a-2ece31bfd19b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238879, "uuid": "88aacc80-d2c2-4407-8f76-647141157a66", "value": "c32df52201db4234a65416f97a2a4c17", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d4901f8-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710229982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229982, "uuid": "28e42266-3a19-4790-b0e1-75f681847479", "comment": "Malware payload (AgentTesla)", "value": "4454886d711745e68315a41d2d7383d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229982, "uuid": "c5cc30c2-2758-42cf-9999-2d36d8b9e4d4", "comment": "Malware payload (AgentTesla)", "value": "4a116d875adbac028ee35274af2d72f9be5bd9b6306eff988b15341088277781", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229982, "uuid": "b82a55fb-2220-4be6-a96c-f1b16fd64c55", "comment": "Malware payload (AgentTesla)", "value": "1dcc55b2cab69771c18cade6d4ec1574ee117f8c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229982, "uuid": "f6ca387c-5ee9-483d-a642-3e68e94bffc0", "comment": "Malware payload (AgentTesla)", "value": "e69c3f33e95294be960a8b348a4b87772b40095cc624720bd56bf28809e0f017ebe053899b6a61ce2e0593c36319c803", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229982, "uuid": "251a9fc5-6f15-4823-bb67-ead5972e0059", "value": "T1FAC402505A6C8377CA9F4BFF7460954A4776D922E62EEB8E6C8037EB0C033D155812BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229982, "uuid": "88b4cf8c-54b3-4da1-86c3-1f1360db9755", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229982, "uuid": "519300dd-b839-48c3-ba8d-74cce0be7d13", "value": "12288:+4liQqbOtOfpiMeBt9HvsJqVjsEz0D3vsz9F:jItBW2JqNsEwa9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229982, "uuid": "2a9e5b13-13e1-48be-9460-eb9e52d41d5f", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229982, "uuid": "9091a3a8-dba7-43fb-84b7-a232fa6537d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229982, "uuid": "151c3c0e-2357-42f4-a7a9-f3d924295baf", "value": "4454886d711745e68315a41d2d7383d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46817d2f-e062-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710242318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242318, "uuid": "8c067140-204f-4cc2-80ee-08265bc63023", "comment": "Malware payload (Formbook)", "value": "ba86bf37eeedd179fd3054505dc5f37a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242318, "uuid": "b589dfbf-23e9-48dc-8e12-4422ef9658bd", "comment": "Malware payload (Formbook)", "value": "4a1c28982ac39eda41aba335f5b3f52c3cbb6e8a41e4dda3c429ec6eef2f4b48", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242318, "uuid": "ad8100b8-c623-48df-bed5-c22a728dceca", "comment": "Malware payload (Formbook)", "value": "40c066fefd0de1dfe3f3035910a1fcb1913b18f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242318, "uuid": "6fed97fa-f406-4b88-bc89-7bd0fe94f30e", "comment": "Malware payload (Formbook)", "value": "c02d2b2f84f8b309bce070bcb52b4446ef90969fdeab5e6e85ae6e626cb0ce4a55543677170fac4ae7ad517ee5fd3ed7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242318, "uuid": "3d06c512-232a-4594-9102-e3fe85cbab81", "value": "T11EF4128235BC0A63C6B6B6F850B5417443F2655A7066E7EC4EC236CB19FEF440AA1F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242318, "uuid": "8629eaaa-6967-4798-84f3-5e4af23b600e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242318, "uuid": "68d218b8-fead-44fb-8e81-2e3a57ded698", "value": "12288:z1CsJTENl3lp9Cx5RNv0DgdtidHe5fj+8A1jbb3lsvKhS+clecTA8CiBF7aWlwiM:JnxENlT46D0tOHeF+9173mqbcTtC+wW6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710242318, "uuid": "df5598ff-0b2b-48b4-8331-274658701af2", "value": 741376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710242318, "uuid": "31013132-1967-4cee-ae01-57abd25b456a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242318, "uuid": "5b406303-0d8b-464a-8305-b0f3e32e1574", "value": "rSupplierRegistrationtoARIBASystem.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed676d9b-e05b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DBatLoader)", "timestamp": 1710239592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239592, "uuid": "1ffa11a5-22db-4e61-a4f6-9a6074c3ae2c", "comment": "Malware payload (DBatLoader)", "value": "905ba97e9f7cc782667ec89ed7168e0d", "object_relation": "md5", "Tag": [ { "name": "DBat", "colour": "#7E0525", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239592, "uuid": "35858abc-8ba0-496d-af33-7b36c30e7eaa", "comment": "Malware payload (DBatLoader)", "value": "4b19605edf5e522a6f2e166caf40c3ee6b0743bfe8231e2a9da49008645d9591", "object_relation": "sha256", "Tag": [ { "name": "DBat", "colour": "#7E0525", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239592, "uuid": "33f86b42-8c58-4c14-873c-d071789ee277", "comment": "Malware payload (DBatLoader)", "value": "859cd1ec7ef40e08fe641088e8f8ab9b551df980", "object_relation": "sha1", "Tag": [ { "name": "DBat", "colour": "#7E0525", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239592, "uuid": "119ba486-b135-4f1e-9f85-792f46157e81", "comment": "Malware payload (DBatLoader)", "value": "594371abde8cce616341031f99c0871dddd9e761ab09924e7736354a4dbc04ef63848c1ba3dad623b9e8449616bce064", "object_relation": "sha3-384", "Tag": [ { "name": "DBat", "colour": "#7E0525", "exportable": true, "hide_tag": false }, { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239592, "uuid": "b87f657d-7499-48fc-9f29-d923c1a238c4", "value": "T196F6BE24E172D572F2770339CF16C2F4A82E7DE32964D55B6AE93D0F3E282D42569223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239592, "uuid": "e27ab110-f27f-4910-803c-399b7b10bff6", "value": "2bae2f3d58d671b95d23ec51065be43d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239592, "uuid": "edf36d6e-ef62-4235-a052-068d763388b2", "value": "24576:Ap8UpIvHMP266Di89gKgUVSLJcDz4/JDwBHUJ:A3bovSui4HUJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710239592, "uuid": "3202736d-0046-4528-8117-2af434278c41", "value": 15728640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710239592, "uuid": "936f0920-111a-4a6a-9923-9b7bb9584bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239592, "uuid": "6eed34fd-36ce-40fe-8f13-bbf856f737e2", "value": "Ckswuxhusyynxl.exe.Direct download", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "850df467-e0c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710283655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283655, "uuid": "fc174a31-8e1c-49d1-b5f4-434dc2eb418b", "comment": "Malware payload", "value": "c673697ca284f2f59960e6c386d65e64", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283655, "uuid": "0b761d13-c30a-4b0a-9873-81ff61854677", "comment": "Malware payload", "value": "4ba700b0e86da21d3dcd6b450893901c252bf817bd8792548fc8f389ee5aec78", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283655, "uuid": "dd20bc92-b0d4-4d58-b82b-a39f26ce92be", "comment": "Malware payload", "value": "feb7df1f048c7431eaf1b03f33137b3a25bf9b7f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283655, "uuid": "fd29e764-d512-4f77-8bf0-8e81401db05f", "comment": "Malware payload", "value": "f90cffe8ec2fdbdba7b2cf476b5b515006e14b7af5ec4730b3b2db6764bf1b8b4bb9778b274d140d247ee52bcbea8325", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710283655, "uuid": "bdb60568-b948-4d44-8c95-e773e3efb763", "value": "T1F7B53342C4C5FEEA895BD1A8A43034B52E412F1A36DD30870B6FD983DE7F54A4B92D1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710283655, "uuid": "79dec800-8d92-4469-ac03-2f4dc21510ab", "value": "49152:oKsM89hBoRHaAgL3W+E79dXq8WeFgCTpqbptyczMh14vw/l+6E9O:ovJ6+MbFgapwMf1Ww/l+6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710283655, "uuid": "08d6a139-b379-4f5d-be7b-f5ea75b2fdb3", "value": 2344348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710283655, "uuid": "e669d7b2-65b5-46f7-8641-587317027cf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710283655, "uuid": "6a1835b1-b1ac-4ce4-8185-cb1e05b1ff0f", "value": "c673697ca284f2f59960e6c386d65e64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fcf6bc-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235880, "uuid": "fb32e0e8-ffeb-44b7-a847-19dd21158dbd", "comment": "Malware payload (Mirai)", "value": "3d8aaa1772518385e1e1002666111c19", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235880, "uuid": "f4be7cf3-f890-4ebc-b3ab-df6e0c4d249c", "comment": "Malware payload (Mirai)", "value": "4cffb9eb4c3334d0be8ffbb0eda07072687860856dc8b669f0a5ac106203b3fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235880, "uuid": "2a123793-a471-48f4-a14d-aaf9709409c3", "comment": "Malware payload (Mirai)", "value": "7390ed39338cdd26c6166582baee31813dee54dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235880, "uuid": "9e39120e-0916-4523-8b92-cbd0c4a9cd21", "comment": "Malware payload (Mirai)", "value": "10c344504cbc2137c36e837a85bf24c8a758565a9c67f8a05403361810ed21ed4fffa8e32a80d4b29974641687a3b55a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235880, "uuid": "833956de-1aad-41f8-b50a-ac265945e053", "value": "T1A9B35A73C8256F58C15AE1B4B0B18F792B63958182471FBE19B6C2B64483CDEF905BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235880, "uuid": "ff46cc29-fade-4358-b7e1-7cc7f5e50e3a", "value": "1536:paN/Y4/LqAgewmowcSFylwv206jz8/e5L076CaC7WCbo4lNXQUyIbCWlcHOV06fT:px4Ye4H+GxXmLb0LtWW3dRd8jwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235880, "uuid": "6138af7c-644f-4798-97a3-04c32ac86d15", "value": 117568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235880, "uuid": "3cbdf636-e751-4a7e-84cb-e095e178c30c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235880, "uuid": "64df4305-54ec-4679-8b21-31df24f351d0", "value": "3d8aaa1772518385e1e1002666111c19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22dcef1a-e0c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710282631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282631, "uuid": "c246b6e0-2ba6-4522-a0dc-9328858800a6", "comment": "Malware payload (Mirai)", "value": "8749912e84f6b453c62865b2096ca4ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282631, "uuid": "d58e834a-b511-411f-ad48-2376491b94f0", "comment": "Malware payload (Mirai)", "value": "4ef20a4d534b1a17ac41f1515d2bd478f51170feb788df63ab76e341d962b78e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282631, "uuid": "432c2f0c-ea53-4e4c-8fb1-4cc49a53debc", "comment": "Malware payload (Mirai)", "value": "976ab8f98af6eb3ddcd01db350f8285312689d17", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282631, "uuid": "7282aece-f897-47ce-b83a-25b3a63eaa17", "comment": "Malware payload (Mirai)", "value": "acbe1cb881639c6e0341eaa351865139b1ede5b8d5978c967660d7cd46bde55265c7f75bbe94de3f3769d84878b55290", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282631, "uuid": "38573cff-da11-4913-a483-7512563859bc", "value": "T14BE33A56FB804F13C0D61776BAAF4249332397E493EB730699287FB43F8669A0E53905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282631, "uuid": "5ab6918f-48b0-4721-8cd2-1166898f47f6", "value": "3072:IVtbnlTIHLouauTWSn8KlO2q+XM95BwbZnIwXi0yM/9bxIC:IVtbl88uauTWSn8mO2sjBwRIwXiBM/9F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710282631, "uuid": "dd9dd364-d8b4-42d6-8ee2-84c2f22a0c86", "value": 154968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710282631, "uuid": "80dcaf88-69ca-4843-8a9b-5572cf51a516", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282631, "uuid": "a56147ec-c9fc-41b3-9e7a-bb18942dcf79", "value": "skid.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d45cce3-e00f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710206708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206708, "uuid": "d4c96a7e-f66a-4491-9ab5-4231de92485c", "comment": "Malware payload", "value": "4b98d1e6c6bdfc45ff0ed6c99a9a8baa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206708, "uuid": "ae10c8b2-d2af-4af2-967b-d31b69049b87", "comment": "Malware payload", "value": "50845a779f6be96e0bc1793f1aef8fa479c22eff904ca4e498131bee3c47a2f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206708, "uuid": "fb940e5e-8bea-447a-8d98-a65c824918e4", "comment": "Malware payload", "value": "ede19197a35de72c67d847a32744a732d12184dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206708, "uuid": "9f0caea5-1b33-4c33-a73b-e714ea1cbd87", "comment": "Malware payload", "value": "1028cb7d582210ff56afbd403e18d3f1a8fd689874712044f71f00e49882114455dab3cf58fd6f0b720164d4a98044c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206708, "uuid": "a5bf3908-88ca-4ac4-84bc-0fa28c5f94f2", "value": "T16F26023BF268B13EC46A1B3245B39250997BBA21B41A8C1F07FC384DDF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206708, "uuid": "cea66eee-c7b1-4b20-8b43-f452d0e774a0", "value": "5a594319a0d69dbc452e748bcf05892e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206708, "uuid": "fb4728be-45f5-431d-ae1c-aca9ee2e5902", "value": "98304:8SiOrWeBgMklxjf+SYn0wD1Ic1kILnPcMc:hqeBFk3WXn52wcJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710206708, "uuid": "99b301e5-3018-4185-b65e-fc65f61d881a", "value": 4713965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710206708, "uuid": "7af3f8c3-2dad-433e-84c3-75b9e5b84bbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206708, "uuid": "8dac19dc-de01-485d-8d3f-042959bd9724", "value": "SecuriteInfo.com.HEUR.Trojan-Downloader.Win32.Banload.gen.5372.25867", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "157b7586-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710232787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232787, "uuid": "7ee7adb0-fd05-478a-adf8-a6b9508c8877", "comment": "Malware payload (AgentTesla)", "value": "67f64212a6dc1dee79d39b72d1d71041", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232787, "uuid": "7c772ccb-cb71-46a5-9392-394c357bffac", "comment": "Malware payload (AgentTesla)", "value": "517b779565c7a57d487398679762a8e39266e175131a2aec673322e6af9e7f5a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232787, "uuid": "e0a27ebb-5123-4522-9855-3066db656cfb", "comment": "Malware payload (AgentTesla)", "value": "72f7cdcec9d629632b1a6b6a4d3c876313ffa709", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232787, "uuid": "0edd2307-d908-4738-b4f7-e9e7aaee9ff7", "comment": "Malware payload (AgentTesla)", "value": "ce8c927a728a0ae5300dc67e54b66c27acb8d4f489b560ca098fc8a09c59657201a54fa998b7f8a7bf4f034c52332ae5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232787, "uuid": "88f3fd91-e4f9-40e1-9a0e-102e91f8c66b", "value": "T13853062EE34F0955DF55E67B035A4B4A09FCB33D728540A139BC97383BAD81E46628BC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232787, "uuid": "3e6a4044-43ac-45ed-bcca-af8102082c48", "value": "768:j0oBG/dYXWorxFzP9l3P87CipFfwy0+z+8Le1yGDCawDIns0L6u95LapNhADL:jBeYJz9l/8JpFfwyVzNK1ylDIzL6tQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232787, "uuid": "cd181011-641b-46fc-ba27-fbc0b47af58c", "value": 61180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232787, "uuid": "4182a5a3-3058-4d28-a0f8-1ec80ea8e060", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232787, "uuid": "72175332-a55d-4a20-8da1-396ee5661c1f", "value": "67f64212a6dc1dee79d39b72d1d71041", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "481ddb13-e04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232443, "uuid": "446f5845-9f41-4d9d-b217-5d077aeee5a6", "comment": "Malware payload (Mirai)", "value": "e17994d4e4f0f2231899b52da6f333ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232443, "uuid": "6bbdbccc-4b2e-431f-a0b0-f2a51c2dc261", "comment": "Malware payload (Mirai)", "value": "527d2d443ab04223083856b7f6407711e17321b32b2fa55b43f4bb5684a3f87a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232443, "uuid": "c0fc6e43-5491-4541-bc69-746ccbb98515", "comment": "Malware payload (Mirai)", "value": "c71590fa42051826e167f8ff90a6e1d867f374f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232443, "uuid": "ba2ec3a0-1e3e-4dfc-b649-5de8bc67b4a7", "comment": "Malware payload (Mirai)", "value": "86514538d370e1b8bbd8d043a97b06adf9b0cacf3055108a522f48dcd82366f33bba10b3a9d50cbdf4e279da8235ed2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232443, "uuid": "f06b3560-ce32-4b64-af92-2267aa09de31", "value": "T11963F756B8918A11C9D512BAFE2E118D331353B8D3DF7213DE106F60778A96F0E7B852", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232443, "uuid": "033a9109-5afe-4b23-94f4-5a910dc906f1", "value": "1536:m5nWzZgiMQVhQAbbXKSJ5sVSHAiczKD8+ZVKINBD/qrUvmnirQL0I6iCgaWZWe:Jd7kA/XKW+ShczK7VRNBD/iSmmgaWZWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232443, "uuid": "499ef932-895e-4e6d-9550-268af0147d96", "value": 70932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232443, "uuid": "8fcaa45a-2ba0-4e05-9b66-bb1f091bb3a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232443, "uuid": "6a4d55a8-1f98-4dd4-8fcc-853c54ec8215", "value": "e17994d4e4f0f2231899b52da6f333ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60aa5d8b-e065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710243651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243651, "uuid": "45eb8778-c710-462e-a049-47cf551e379a", "comment": "Malware payload (GuLoader)", "value": "e04872ea5f2d4ac14209f5bd7dca3619", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243651, "uuid": "1aed2967-5183-4b4f-92d2-a666295bc898", "comment": "Malware payload (GuLoader)", "value": "52b5af73273bf40ca44592af83d300c7316449ef71f465081f68675f09d0a8d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243651, "uuid": "b2e1000c-a9c0-4d66-a3fd-e924af65e560", "comment": "Malware payload (GuLoader)", "value": "0880d4667ad5f185c101c658ed4a3c469fac5854", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243651, "uuid": "0e278267-5a6e-44d5-93ef-b7cf80cfe34d", "comment": "Malware payload (GuLoader)", "value": "2f9d1ab99616d865a2a21410cc9c51efdaec856b2b42a201b6f13ca1cdb60db2dcb543d15b76d239adf719490d0ff0d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243651, "uuid": "0a3d7df5-d50b-49c5-af69-624b9a820ded", "value": "T1FA359CE5D9C04184ED292F7854761D39502FBE7EBDB8E94E8A1DB0207BB36CB6472807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243651, "uuid": "9a7084b7-10d5-4043-a8eb-84f368a6e30a", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243651, "uuid": "8fb94cef-98f9-4260-85f0-96ced4057541", "value": "24576:+aU/LcNbKqeBSHRbrBL8GGAqf6ZIe1wQiJh:XoLc5KqeiLL8xAqeiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243651, "uuid": "f3bcbb86-dbc2-440d-9733-4e8c35b5ef9e", "value": 1103976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243651, "uuid": "b1eb06e9-3956-4557-8a09-38a14bbaed6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243651, "uuid": "9479524c-ee49-4a59-afe9-f06f70307ae9", "value": "Admin_review.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ab4113-e069-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CryptOne)", "timestamp": 1710245213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710245213, "uuid": "039246ac-bc83-4ec5-997c-ef9c21463209", "comment": "Malware payload (CryptOne)", "value": "16c61e039e3e94729a895e07d6273413", "object_relation": "md5", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710245213, "uuid": "b5ed89f0-e84a-4f39-a685-46e9982918b5", "comment": "Malware payload (CryptOne)", "value": "52fe4a83b1457aa90f8dcff3eb69326077ea71aa9fff7fd2f6b9026eda92baf8", "object_relation": "sha256", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710245213, "uuid": "0ff11533-a1a7-4ca7-ac53-164b2dace7cf", "comment": "Malware payload (CryptOne)", "value": "0d92a3a8a68cb0547d35f231a2a01f1a86343e29", "object_relation": "sha1", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710245213, "uuid": "26f5db92-5fe5-4b54-9901-3653bf33c77e", "comment": "Malware payload (CryptOne)", "value": "350622f52e9ccab6a101b0b5a5d69c1684bbb9857dc9a3b924105b6b2b7fce04c68cd9f9f4b31ad145567ca42b3ee95b", "object_relation": "sha3-384", "Tag": [ { "name": "CryptOne", "colour": "#62260A", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710245213, "uuid": "e04d6a1d-a7d0-4a8c-a809-d5c013f194a1", "value": "T1F6C4BF2BFE44B11FD96345F158A6A66ABA311F221B81AC0F63C0AF4A74B1113B5F531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710245213, "uuid": "6e1c0f4d-afaa-4a24-97ec-4c3308912306", "value": "98f67c550a7da65513e63ffd998f6b2e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710245213, "uuid": "0fa68ff6-3b5a-4e8d-bf83-e81f1a1a3449", "value": "12288:RENN+T5xYrllrU7QY6hcOPPQIv2qZ1Us7qFJ:H5xolYQY6GOPHrCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710245213, "uuid": "636627ae-297f-4b59-8ded-58ca9552675f", "value": 548170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710245213, "uuid": "effad252-a7cd-4cac-84af-40175655d439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710245213, "uuid": "c3d61224-c3e4-4d40-abdb-6e31307632ae", "value": "EOCFTL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7baf1eb0-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710238542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238542, "uuid": "fa34fe0d-63dc-4d94-8c45-845acf022d60", "comment": "Malware payload", "value": "e1ef12c1327c307f1cfee9dec7626fcc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238542, "uuid": "1e811655-67b0-4949-a01c-22eccdfb9ef3", "comment": "Malware payload", "value": "54a55f979678320d1f40d02b3bb60e0ba8639e8f3968dd93922a7f2fedf0c2bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238542, "uuid": "e4510b05-cc72-487f-bbf8-b72af4d7aa7e", "comment": "Malware payload", "value": "c571dc00092e1dc217c534ed801a7901e4f6adaa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238542, "uuid": "657c4b86-9310-463c-945c-9042e328dde5", "comment": "Malware payload", "value": "e84544b7f6c4580c0682ebfd555c2adb691d7c2a2e36d980986e7eb9ee9752960073f8a25b11baee760236c766e340e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238542, "uuid": "d6ab2df4-5dec-4eb4-9119-63d90c38992f", "value": "T14C549E11B691C072D6B111334978AFB6496DED300F6159EB63D40EBEDE302C2AA35F6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238542, "uuid": "58600718-45f9-49b5-8970-00c5a01af11a", "value": "029c1f332e79245c298bb73190a1f1c5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238542, "uuid": "56738958-ac39-4496-8ced-ab14fc813b4a", "value": "6144:f8Yh2Jv6zi1PuzW6zzuUoBtM0LrH+ietqxx2MVczt2AOWStQ:fyiLzzuJtM0ndxxs2la", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238542, "uuid": "2ef0f089-71ed-41bf-86cd-1512275a1f53", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238542, "uuid": "30ce9620-fc98-4388-a1d6-c34469cfeaee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238542, "uuid": "e62fb2f7-2f3e-499a-8f0d-1c94a5578bc9", "value": "e1ef12c1327c307f1cfee9dec7626fcc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52386af5-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710227735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227735, "uuid": "5637ac18-664a-45d7-b613-78b991e4b869", "comment": "Malware payload (AgentTesla)", "value": "09b0316ff40d27f6b565cb08e53f3ea9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227735, "uuid": "ed0f1ca8-534e-4afd-8a60-d2b734d3c5dd", "comment": "Malware payload (AgentTesla)", "value": "56a18ef03d93610834e7b53c24cb389f0f63d8296e2244a4ff1ac3328579cf2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227735, "uuid": "8fe0faf0-9800-4078-ab24-1a2cec268162", "comment": "Malware payload (AgentTesla)", "value": "9879af2fb9277576ad39b4bed5fa54928f1a5649", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227735, "uuid": "f9f29a04-b14e-4232-ba6a-d354ce3b8c2d", "comment": "Malware payload (AgentTesla)", "value": "ab81a3456dc5bfb24b1839862f24822b3c159b0d316c071b34745ec52ba60e691d8fdec143cfe810f3ea5f0334d2b0db", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227735, "uuid": "a1bb152f-33f8-42dd-92d5-27a4054bd22d", "value": "T18DE4230D798413CDD39F07721A26D5945130B6D629B2D3AC6CE784DB0B31FAA8A70AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227735, "uuid": "0c8064c3-a0ec-46c1-ab9d-0d34a2a37401", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227735, "uuid": "1c5fcda6-0522-4296-ba44-c7c81e33e384", "value": "12288:+sJTENl31LKs+7NViGlFWc+5BM45mSC4ZkaiUt1oFPp1HmAZ1M840:LxENl1M7rWc+5BM45fCug6Ip1BZ13", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227735, "uuid": "8608d476-328e-4cab-aefb-b6ca5e482594", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227735, "uuid": "82e560c4-4abf-41b6-8895-343a7ab5f31d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227735, "uuid": "b4a7c9be-cec0-4a2c-8279-6668bad2d457", "value": "TEKL\u0130F TALEP VE F\u0130YAT TEKL\u0130F\u0130_xlxs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "615bae99-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238498, "uuid": "bb28674f-2b04-4ba2-8e90-547dc82bed27", "comment": "Malware payload (Mirai)", "value": "fe76014165e95059ca110c5a1959f849", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238498, "uuid": "fb9ea4e2-1d70-4861-90d7-a3441951a8ce", "comment": "Malware payload (Mirai)", "value": "56ec8a85ea047010f96ef08aaadc90bef0649773a7fdc62027aa95fe06be7852", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238498, "uuid": "409f556f-41c6-4414-bfd0-3e1a6cb6c264", "comment": "Malware payload (Mirai)", "value": "5511761c5daccc3aab4531dbc803c0c8d4c3e7aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238498, "uuid": "2f4be152-b492-48f3-9b18-bd06d4172d5a", "comment": "Malware payload (Mirai)", "value": "f4b90526b8c6e0e9d3d2a8bade6a01851a672a59535e2de3929c9c3e091960e40b112b910e50dd3bc4aa1a5019b73dd5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238498, "uuid": "e857b5f0-5976-4129-994d-df80f492f8aa", "value": "T110930909E510576BC2D227BEFB9E429E33271B94A7AB33155E385AB42FC5B9D1D3C020", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238498, "uuid": "07328185-f8a9-4c7a-b500-614e4f4576a0", "value": "1536:bzfnTUNsr31VbQ4dY3Cpx9Ocou46iXhctIxib50Y0ZBdik+ucaBTf18+pmail+y9:TU6pQMv9OBH6D50Y0hikLLs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238498, "uuid": "34865c0b-b60e-4e42-9b08-452f42fe45c6", "value": 90010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238498, "uuid": "68a06a20-206c-4324-ab27-3304f0e33a0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238498, "uuid": "9d26a213-4b81-4dbf-ab39-00e47636c3a6", "value": "fe76014165e95059ca110c5a1959f849", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d706eef-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710235861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235861, "uuid": "5c680e5c-2a29-417f-ae4f-c67c765986cf", "comment": "Malware payload (PureLogStealer)", "value": "d66f832ddbd7f456201cd83ac77dbfdc", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235861, "uuid": "0fea5be6-66f7-44de-a8fd-841edfc3ebdf", "comment": "Malware payload (PureLogStealer)", "value": "575f1eab81c3fb5bf8e2694935e4bab50eca349d6700ac097f691827ee395e44", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235861, "uuid": "104ce5bd-8db0-40ee-830b-b96f3994d931", "comment": "Malware payload (PureLogStealer)", "value": "0b74c0abc50a61837cc1d086b0dc00f939d78afb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235861, "uuid": "a07fca7e-9b90-4348-9a32-5f3c220d6753", "comment": "Malware payload (PureLogStealer)", "value": "92379858ea8fa7c4a5ad54565313484ec9e6dddbe46df766edb6f6b7daeb733524999e96afd204724674b6e5b07fe830", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235861, "uuid": "feceea85-38b4-4f43-bc98-f970394afdd6", "value": "T1E9F5BF13B7D79B93E168173AC6D544DCC3A1A9917293CD2A798A134F0DBEBBB4C81603", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235861, "uuid": "7c50e7ed-8414-4283-8688-b003a09a77a9", "value": "49152:jEGrWpizZ4plHy39BNS8cFh7tbz5SfcGgw5ZNRv1zKmmEK:jEhXHW9fS57RzI3tHRvImmEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235861, "uuid": "9e9677c4-5e1a-4c4d-b9e5-a965e9a530c4", "value": 3338808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235861, "uuid": "1c031153-98e4-46c4-ab62-0fcc2b790a94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235861, "uuid": "8905519c-7643-4569-ad21-35765ec0e062", "value": "d66f832ddbd7f456201cd83ac77dbfdc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417a0d0b-e06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710247464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247464, "uuid": "97896874-165a-4fee-a01b-046a50cf584b", "comment": "Malware payload", "value": "c2a88caf78221d1341ef965b3197528f", "object_relation": "md5", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247464, "uuid": "1bb8ba8b-07d1-4a7f-beb5-88d49493d61a", "comment": "Malware payload", "value": "5871e1613e22726e5efa542c429360572c43fe65ad87db94373e599b21181177", "object_relation": "sha256", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247464, "uuid": "8fba476d-e023-40fc-b6e5-a6e44b15d2a7", "comment": "Malware payload", "value": "c67f4497268b58efe718421071ce8788cf313d1e", "object_relation": "sha1", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247464, "uuid": "a9e2a750-c807-49c6-a8c9-11acabd07ddf", "comment": "Malware payload", "value": "2f38a4a2b898063508fa34c774f6dd518e466d771531fde171fbf101965b1d9de3cd6f66f6b36b44113576785fb24fc9", "object_relation": "sha3-384", "Tag": [ { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247464, "uuid": "8fe8d548-41ca-4a59-abdf-53a81d3e59df", "value": "T178B4235BB422DF5A12ED10BF26A2E66732B0FF5166575C83CEB6FE17406C42218B01F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247464, "uuid": "904b3b78-3dbb-451c-a28c-a520557f6cf8", "value": "12288:JRDiK+9v/+5OTW5PTzFj+5lsnDJeXlspw8Q/k8cfsniKqi18e:iK75AWFzFqM0lspw8Q/kTKh1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710247464, "uuid": "bd67f0f8-84f0-49cf-b171-9d9472dd03bd", "value": 525911, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710247464, "uuid": "4efcd309-027b-4961-8b52-10db874cca8b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247464, "uuid": "a82d0a83-fde7-48a2-a081-9f9529c1bf80", "value": "\u03a0\u03a1\u039f\u03a3\u03a6\u039f\u03a1\u0391 \u03a0\u0391\u039d\u0395\u039b X37 4-3-2024.pdf.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b37b3b6-e066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710243964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243964, "uuid": "ee5606a5-4de9-45c0-a830-4bbbc273d340", "comment": "Malware payload (Gafgyt)", "value": "7aacf1eb2287da6a9a105a2da4043bbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243964, "uuid": "a9d0a575-6347-4b42-a00f-439481e351af", "comment": "Malware payload (Gafgyt)", "value": "592f413663c8712af9952669c7a18d88eaf2e1ea5d7d013ad2563279c8db6dee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243964, "uuid": "6a83c4a4-effe-4c91-be19-757ba1d29605", "comment": "Malware payload (Gafgyt)", "value": "29c8eab3cff0e470166ed5435296f342b1cb5fb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243964, "uuid": "8fe38f25-dab2-4ddb-9eac-b771869fa247", "comment": "Malware payload (Gafgyt)", "value": "e38124d9d0574caaba98e65118719a02765ac756f13face5c0a9ccb976ffa5d665f4f643e226ea19dd549bb3a31f3de0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243964, "uuid": "d67d3fd2-bc63-40a3-97a9-c4335c484430", "value": "T134B319037B0E0F83D1533DF02A7F2BF1979ABEE215A4A184651EBDC062719B32595ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243964, "uuid": "5862e70d-4426-46f0-9c59-c903395a137c", "value": "3072:BuXEO0ZtH4UiWLrsf3IhUukStG+wRt5hKpu4:BuXEp7rsPSgwG++5h/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243964, "uuid": "c05db898-bfaf-433e-bf70-cef33c4bf909", "value": 107848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243964, "uuid": "cd4ef601-5da0-4e09-89a4-9c88b07fe7f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243964, "uuid": "d76ae978-fb9c-4d8a-81d6-45b75be38053", "value": "7aacf1eb2287da6a9a105a2da4043bbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68d9ab1b-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710229921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229921, "uuid": "a0f93ff8-c707-4ca8-a28d-768c7ae2258a", "comment": "Malware payload (Mirai)", "value": "ce3b1bde6acd815a3693c15ba901ac63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229921, "uuid": "8d184d8b-807e-47c5-a81d-63853ef9d63a", "comment": "Malware payload (Mirai)", "value": "5943822bbe4a90a3393b8c3c83b4e5a85272b9be93d1cc9be90629eea54ba9ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229921, "uuid": "a800b0d0-5bb1-48c2-a39f-9a5f40e72fec", "comment": "Malware payload (Mirai)", "value": "1bee565498c211c2a4c7e78ce148df15f2db67ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229921, "uuid": "dec65042-9aa2-4a11-ac91-cf3602aed084", "comment": "Malware payload (Mirai)", "value": "33d796b177e93f20269987bedc1cd9f87903dc9761d39f8f3aef367c8da40a17bb990288be45abf8165194d3bd72bfc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229921, "uuid": "eb72f99d-144d-4395-96c7-51a36ace6638", "value": "T186F329D7F800DDBAF80AE33B48570906B130B7E255925B376257397BEC3A1D90867E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229921, "uuid": "4e75a630-e82d-40d3-8aff-1dcc89160ff8", "value": "3072:WUlVxmogDVcbPqQY7DkQakpMsCmxLdvwVcjbiGLvHjroElyDB2Up:FTtATMQBp11dvPLvHj9yD4Up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229921, "uuid": "45ee95e9-f235-4130-adf1-6bc9aa95bbd4", "value": 169312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229921, "uuid": "21941802-a1a2-4378-ad8b-81c80d5e8b58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229921, "uuid": "b2287704-bd46-4243-a356-4fa13b19454e", "value": "ce3b1bde6acd815a3693c15ba901ac63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28662fbd-e0c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710282641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282641, "uuid": "6017caf3-78a2-42dd-81e9-ddebdd598828", "comment": "Malware payload", "value": "eb9c5e359fe98a359cb84b7f279eff31", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282641, "uuid": "d30f5951-c796-4b2a-a85e-a3c1917102ef", "comment": "Malware payload", "value": "5a62f3354e3b995f0e1a42ea641d7d1167921e9873f73e5bead4bbfa414bb120", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282641, "uuid": "173284a3-7966-4c95-a432-c04858fb6379", "comment": "Malware payload", "value": "eea12972321d325e9ad9f0123579e2c76ee9caa7", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282641, "uuid": "1f52ca15-435d-476e-9417-1f93cb1e3a25", "comment": "Malware payload", "value": "7f8c32fb248fa34154eb3f131f9665ec09d36132ed63a8bb7c674a891ac1f1f88f31db48e84ba8f7aa9719d905e25fc4", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282641, "uuid": "be04a993-3cca-4604-844f-19e85d43b900", "value": "T148633A95F9825A13C6C502B7FA6E428C3B2553E8D2DF7203CD216F217AC781B0DABE51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282641, "uuid": "6df796d7-5c81-4b2f-b035-640af0b3e28f", "value": "1536:EnforS4GNJ8BhGLW1QUQufxwrqqythdvy+wbZnN:EnT0hGcQgxwrARy+wbZnN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710282641, "uuid": "4cb90725-1082-4011-a892-b3c441601400", "value": 70972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710282641, "uuid": "88ecc7a1-89d4-4de2-bb0e-40cca12fd5c9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282641, "uuid": "5b5df6de-0038-426b-9178-3df05444eda3", "value": "skid.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "243df6b3-e0c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710282634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282634, "uuid": "c14468cc-b95a-4c89-9ede-f2bfa620a32f", "comment": "Malware payload (Mirai)", "value": "9696dcbf96f05ac92c3a5caaac29f88a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282634, "uuid": "9ad9fdb4-62bd-4021-a193-fefcfb929917", "comment": "Malware payload (Mirai)", "value": "5b03b24ceb8f99503ac9ba07b6eeb35ab2d45cfdefddbbb62d45a663bbb74d7e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282634, "uuid": "e26b6887-ab43-414d-b3ca-3af19170cd2d", "comment": "Malware payload (Mirai)", "value": "e925b8be5e131b0aaf694d08200315e0177adee2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282634, "uuid": "3f820a8b-b049-4cd3-9f9e-c197a59dfb75", "comment": "Malware payload (Mirai)", "value": "4dc93d9469aed2a898d60ac4edae58b521d57273f74ac3bd0cae1ff5d182f25c86659050da92f127d45b6c3f49cacba2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282634, "uuid": "5be53d66-4804-45b4-a44a-a298150b30c5", "value": "T1F883095AF9814F12C5C612BAFE1E018D371357F8E3DFB2239D206F20B78692B0E66955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282634, "uuid": "e0cc57ec-5bcc-44c7-a9b4-c061499dee7b", "value": "1536:bFn+MUXoKg9Niy2I29JJC7h0KWX3Qa/9S0YIxiK26IWKzH9urd5TYolwbZnJZ:pU4Kf4g6+KKAa/26bKzH9urdNBlwbZnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710282634, "uuid": "ee501303-6872-4985-830e-ab79de482aff", "value": 83256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710282634, "uuid": "e36c11d2-1c89-494b-a8b9-a400df9dbd38", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282634, "uuid": "38e05522-1d22-4fe9-b460-66bcb0328e1f", "value": "skid.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "409a83f4-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710227706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227706, "uuid": "9ce910c5-7f93-4c0b-be20-10e548fc5777", "comment": "Malware payload (AgentTesla)", "value": "f25a01a0294796dd954083ee074c1041", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227706, "uuid": "43717102-35a4-48a1-ba9c-4d8865aa7137", "comment": "Malware payload (AgentTesla)", "value": "5c411a9a04644ae5cc44c8f081c9c95577f182e7ab9d40943991c36f6147ac90", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227706, "uuid": "580d6296-ea52-43b0-aa3a-e1a897af72e1", "comment": "Malware payload (AgentTesla)", "value": "84f2fd32925940e988bd1284fabd244935fb375b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227706, "uuid": "4e92024a-3914-483a-b6ca-47b37e8001dc", "comment": "Malware payload (AgentTesla)", "value": "7f43821543fcdb4d73af66687e70866c1f8877867de765611ce47fe4f5f165b085e0d99839c4016bbf0f8306777a54bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227706, "uuid": "ddfe092b-a979-42fd-9597-676f439a3a0f", "value": "T19C23D05432A1E402D0536F754EC8D0EB5B14BDA2EF83870B31917F1F2879A86CD67B2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227706, "uuid": "3d98448e-7877-4d2c-9743-0beb49bd5302", "value": "768:myBP0YQpLG1Lw6oKgrOy+0oUH8EEs2PrW4MGeY6:m68YYL6+3+ZUH72Pa4MGeY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227706, "uuid": "afd4541c-2a79-4312-a8b2-5e9650f6cd9e", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227706, "uuid": "0edb152e-a8e6-4afd-9c03-efb49ae92929", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227706, "uuid": "966977d7-cb81-4ba5-845c-2499629b5122", "value": "DHL_89576534576879899009079968.pdf.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e766b23a-e080-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710255473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255473, "uuid": "731aaae7-d919-4a29-af6f-426fb07216d3", "comment": "Malware payload (Mirai)", "value": "d7cdbdee3407061e3f94036b1ba7a066", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255473, "uuid": "41627f8e-2de5-4a58-8c70-09b2a6438fd8", "comment": "Malware payload (Mirai)", "value": "5d41eaa332ff6b91dcc556d779b5432b6d490776edfdf327beb5b533cf63dd60", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255473, "uuid": "a5beb638-47dc-4bb2-bb0d-718a9b7c47e4", "comment": "Malware payload (Mirai)", "value": "281b5b1b4c1d767d3a9561df539c90c502b99388", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255473, "uuid": "7d7bea16-5626-4fbc-8f3d-42258d167987", "comment": "Malware payload (Mirai)", "value": "b233e9c78c341d861525b856d322cbccee02544329fb0d51858921ff32c568ddad6455f656756fda674f360a192a7d51", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710255473, "uuid": "971307c9-749a-4c09-bd5e-388c4a047778", "value": "T1CC634A13B58190FCC29DC374476BB63AE93375BE1239F2AA37D8FA126D49E211E1E540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710255473, "uuid": "3168f85f-5155-4d35-98de-19e7a4104436", "value": "1536:GBEtqb9a7oY6uHhK0ygRZKbBqAhIVoP57atD9kuQTGJ0OGjnZ:htYQsYFwERYVqAhIePctD6TGOO+Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710255473, "uuid": "3ad12cc4-c2d0-4446-b076-3b822fc6bda7", "value": 71824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710255473, "uuid": "8f1e7033-7b7d-466a-9db7-043e2e8b591f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710255473, "uuid": "ee38bb29-7457-43d1-8b55-a5e2f0841794", "value": "d7cdbdee3407061e3f94036b1ba7a066", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe66bb55-e03c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710226306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226306, "uuid": "cf84b739-6e9d-447a-924f-2de01b57675d", "comment": "Malware payload (GuLoader)", "value": "8d4f8534e8f4fcf5cd82091f4caaf199", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226306, "uuid": "6bf0b348-434a-4dee-8903-d5e7d234c0f0", "comment": "Malware payload (GuLoader)", "value": "5df6ffa9dc38597af5f700c06deb83a367c21d8af34f8741d564cf0f6d3d4ffc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226306, "uuid": "2449ebd6-f8a9-4d09-86f5-e57e7b5ea3eb", "comment": "Malware payload (GuLoader)", "value": "458297db052e93bad05b77b00a55f4fff24a2d8c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226306, "uuid": "8fc8daac-f5d2-4f76-a35f-9be287ca091d", "comment": "Malware payload (GuLoader)", "value": "bda7db6e2a199335e8de5c5d25bbb9b62b5389bf005fe783dea183825eb09365c694742b733edd256bcab8e62d85cbc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226306, "uuid": "8cfa42e2-c00d-459a-b381-18c51521e8c2", "value": "T13105027EB66891D6EC78123024B7DF6319257D68A8B3461F7207BB1629B3F53002F91B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226306, "uuid": "f8f060fb-b27c-40d9-abc0-b8589d4dd4c3", "value": "003a54a0fe3c2a4dbf64143004ff22d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226306, "uuid": "99a8c07c-433f-422b-82d0-9c6996de7ee1", "value": "12288:A1nnU0REibppIBOK+i0B+p/mbhhHFj2ZS2b4gb5pi8uhTG+RT5M6t6J:Snfrb3IBh+v4pOWHfb5ZuFLRTw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710226306, "uuid": "7b146b2f-a7f1-47b1-92fe-9ce1953f1df0", "value": 845936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710226306, "uuid": "ee580ab0-3eb2-4261-9e64-83c7bea55588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226306, "uuid": "9c6cdac0-b048-408f-90f2-6558140926df", "value": "cuenta para pago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc6b5616-e03f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710227591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227591, "uuid": "db9a7282-f743-4af4-ad1e-c7ab18cffbf0", "comment": "Malware payload (GuLoader)", "value": "48b200b5c561bf1af3db6c9815306129", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227591, "uuid": "98c4036a-ffc1-469c-af17-39a7df972f4a", "comment": "Malware payload (GuLoader)", "value": "5eff934da617868ed23c2d84cdd2a90040f423ccda4d032f7a83d87d56f9141e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227591, "uuid": "c3914312-dc81-4f48-b2d1-bbab8adaa5e3", "comment": "Malware payload (GuLoader)", "value": "7443d4eaee4a80e62f66376a2629dbc624443ce5", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227591, "uuid": "29a0930d-36db-4d8e-b141-aad27d8b0e95", "comment": "Malware payload (GuLoader)", "value": "67f1cb482291a3a3a0e7b3fd841f1d0dd24b9d8b65882b9b45361f944d0ff3b9a8928c97b84129613b17a10de9907d94", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227591, "uuid": "e5012f85-4991-4096-83a7-a63d5a70dfba", "value": "T1EC727F1448064BEC5D8727F2444836B484F0DFB6CD30147CFD9BB168ABB87997EA82CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227591, "uuid": "506c98e7-c9c5-4de4-986d-3d0e51139478", "value": "384:8R5dRn5icadqcu046zHz0G4wmAZ5vadPtQM3B3gAu0LReyZnB4Ao+AjcDB+/gNSI:8R5dRn5icadqcl46zHz0G4wmAZ5SdPtJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227591, "uuid": "7cd8d732-31e2-4180-be15-ae223ee84276", "value": 16563, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227591, "uuid": "8fb05022-688c-4903-b264-33cb6b29cac8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227591, "uuid": "230850db-3384-4248-8309-a2f1bd1b6159", "value": "presupuesto_PDF.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80546415-e02a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710218364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218364, "uuid": "63c89b3d-4918-452d-b56b-6fbdebaf0184", "comment": "Malware payload (Mirai)", "value": "c492e3a317ef40ed194d0bb03c2b53d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218364, "uuid": "e949a359-eb6b-435f-8ef6-c9a0a44d5aec", "comment": "Malware payload (Mirai)", "value": "5f374dad8793cb1f7a3c3bb41c3981d02631b3c19a850d8cfdda3fba47c69fb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218364, "uuid": "9d2c3ab7-83b2-4b48-aef4-997d0cbdf6c3", "comment": "Malware payload (Mirai)", "value": "3fe01512967800ec05c9360cc02f1fa4a9c249f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218364, "uuid": "55e9be29-84ac-464a-a01c-6f48f9ae3770", "comment": "Malware payload (Mirai)", "value": "f72d35619f23af345f46c828275053c8489bb36269cd5b87996d1046f06388efdc6834234ccfe0de7556ece70a7153f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218364, "uuid": "c60255dc-f2ae-44c8-95bd-370b2cf03f70", "value": "T18321ABA6A7D35D27CC490637CCAF5750E362BA88859FF503E71122291C3E21A1F2214A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218364, "uuid": "1da909e7-3493-4968-ba3e-22375213a252", "value": "24:JvB/0gP9qD0at6EoKGKrUlFSy4vzLCkIddgpIsa2ohVNfK:JvBVFqDPtDrkFSy4vzL9IsUhVNS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710218364, "uuid": "a6e19e7a-5366-4698-ad48-7b9c542152f0", "value": 1188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710218364, "uuid": "bd1b34e1-00f7-4a11-9fac-3f0e723c235e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218364, "uuid": "1dcbc2ab-fa07-4b5e-aab1-144f154321b3", "value": "c492e3a317ef40ed194d0bb03c2b53d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bea246de-e0a9-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1710273014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710273014, "uuid": "fc853e3f-26d9-450c-babf-f1002afb8c3c", "comment": "Malware payload (Gh0stRAT)", "value": "4de8f9dafa6bdd3f06e40f9e63734205", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710273014, "uuid": "675a030a-98e8-45e4-a686-6838925b7cf4", "comment": "Malware payload (Gh0stRAT)", "value": "5f66f9aa79936163002d139f8a191753a26f71068e56968761c85f0f30d3d7af", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710273014, "uuid": "504ebdf7-9c55-424c-b82d-e41706ffd3ad", "comment": "Malware payload (Gh0stRAT)", "value": "8417f0c4b307cca218bcddaec0db750de385b1c2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710273014, "uuid": "136605c2-bce1-45de-bc8e-b0225c99fcae", "comment": "Malware payload (Gh0stRAT)", "value": "0829d2f73016fdbd0e5a69555683607d702d66aa7e123882bf9d7437a26f6afedeb23deda3e41c22f737c649bea318eb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710273014, "uuid": "5720b40f-ddf8-48a1-a0bf-0a2b5647413c", "value": "T1E5B37D01F98508FDF995353C14AA3737DA3FB4648A4D5E83FB24EAA50863594BF2234B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710273014, "uuid": "2bdfb0e9-3b89-42c8-8fd4-e95d834d6320", "value": "06b23d75e22c5395672367e437d87a0f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710273014, "uuid": "520805e3-2cfb-442c-936c-7c0f43304327", "value": "3072:U7tPdGYnNnVzamxH/tiZ+1cfk4Tw9b6rY:ufnV7Ztmffk6whKY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710273014, "uuid": "67dae30b-cf1e-4d4d-874d-7c46272d7ae0", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710273014, "uuid": "2ba4b06c-1712-4fdc-893e-1b4e9288dea3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710273014, "uuid": "1b3aba65-d4be-4fdc-8646-35e3439721fa", "value": "4DE8F9DAFA6BDD3F06E40F9E63734205.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "255a0d22-e007-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710203179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710203179, "uuid": "eaaec924-6c24-4424-b133-6066e0cbd42d", "comment": "Malware payload", "value": "4b916f1e7d93297ae9e0af483322abdd", "object_relation": "md5", "Tag": [ { "name": "Deutschland", "colour": "#C49847", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710203179, "uuid": "c4089436-dcac-41c8-b946-16c37ee534f6", "comment": "Malware payload", "value": "6026a42fcb095872f8982026d68342f69e655250ac52fa00a98640d4765cfa47", "object_relation": "sha256", "Tag": [ { "name": "Deutschland", "colour": "#C49847", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710203179, "uuid": "bc7a9718-7fd3-4ee4-b97c-97f4e922ec63", "comment": "Malware payload", "value": "b1be90af21c5f48672a426b14cabf3c71826125f", "object_relation": "sha1", "Tag": [ { "name": "Deutschland", "colour": "#C49847", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710203179, "uuid": "28a10bf7-a86e-4a3e-8142-e24c186271b8", "comment": "Malware payload", "value": "7b6ba11ee5edb137ac81963cf1943bf3d6ebc57b7c94cd87e4e374bc4248f533a5f56c724807c50ba76c5a3da1696cda", "object_relation": "sha3-384", "Tag": [ { "name": "Deutschland", "colour": "#C49847", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710203179, "uuid": "836a9711-c43c-46c9-9ac8-fee9903bab96", "value": "T17811329C918EE269172A5BFB83199B08A0550212A390C423733CC5CCB18C0DCCBE868D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710203179, "uuid": "523d8a0f-5322-4217-8eb7-5513177212cb", "value": "24:erzcpjIiOLxoXanQ73ViAMqjHqaBRYMmta:/pMiO99Q73kCLYJU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710203179, "uuid": "c264503f-4c17-46ec-9593-3f136300aaff", "value": 1007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710203179, "uuid": "a81cb52b-7195-4280-9253-e7e14cc64a72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710203179, "uuid": "2f5cef5c-0d11-452c-90d9-0178ebb2c215", "value": "deobfuscated.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6affbee6-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238514, "uuid": "b774b1c9-9e91-4d5d-8616-0029075f55bd", "comment": "Malware payload (Mirai)", "value": "498708c26b65e9d66364a84f4f63798d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafygt", "colour": "#B29474", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238514, "uuid": "245e664c-151e-4c5e-ac37-1bf95de863ed", "comment": "Malware payload (Mirai)", "value": "611840f286992698e05e1c01e1eb5c8207d8fc816f895f73fbcdee25b8f7f328", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafygt", "colour": "#B29474", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238514, "uuid": "27d92a70-2394-40b2-985e-7c6f101a7c46", "comment": "Malware payload (Mirai)", "value": "d601ad82d9de31c67ecd50862693e599ac4ae8af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafygt", "colour": "#B29474", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238514, "uuid": "9fcd9a82-eb33-44ff-b154-53aa6681cdae", "comment": "Malware payload (Mirai)", "value": "3ed2c4d5974b120a0f4bf5423752959807189a1cd3113eae49096f797c5ca92b3cb566e65f7f3a32064edce02e2d90e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafygt", "colour": "#B29474", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238514, "uuid": "d8fdd43d-6892-4120-ab8d-7b544b118e65", "value": "T1EE63D644F954936FC2D277BBF759028D373A1A58B7DB33111A382DB43BC5BA86E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238514, "uuid": "7a19026c-6fcb-4066-9098-fe624aa2a051", "value": "1536:Y7qwbqgeVeb/0EqY886FRIBWTYHm6tZ1va:eeVK0EP886FBTYpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238514, "uuid": "8ff75621-0731-4084-9b7d-7f4e62e85cb2", "value": 72557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238514, "uuid": "620c617b-a3cc-4003-a59e-dc7022e6f50e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238514, "uuid": "0bf80749-9419-4ee9-a753-56dc60dddc94", "value": "498708c26b65e9d66364a84f4f63798d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3c08a1-e065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1710243667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243667, "uuid": "916dab56-057d-476d-bfdf-e4cadb74ee40", "comment": "Malware payload (Amadey)", "value": "221bde86c555118e43df5fb971190659", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243667, "uuid": "669880c4-8073-4554-88ff-2d26d2d7d843", "comment": "Malware payload (Amadey)", "value": "6198e8da287ceee18021779072ba732a0fd3c63b8aa367e823c0f4fc3a3c4249", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243667, "uuid": "599c3174-aa76-4f32-b6c9-659e71f76da2", "comment": "Malware payload (Amadey)", "value": "85444e05832a97d1dec8b25bead079a2f775eee7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243667, "uuid": "0c9be402-44f4-4687-8036-afe4e38c52f9", "comment": "Malware payload (Amadey)", "value": "b7fdc502a42d4e041c5ae4101bc79c9371263c8d6c8f16ec7a8c53bb93e27250ffe7aff5e16917245ec9b40ace8a413a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243667, "uuid": "4e299695-53af-41b1-905f-70cc93d3d779", "value": "T1EBD5E127538C962DDDBE93FAFC75F72A53B080866C47AF488474ECE89A56721F14084E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243667, "uuid": "81ed8226-f8a5-4953-9f4a-443de811f92e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243667, "uuid": "c8d1afb1-eaf2-40e6-bfcc-1065b582acd7", "value": "49152:tZr3MEA+T3O/QYAZcEzViaxSDMGXbigsbDKsNaIfUQ3t7H:PAf+T7TFMwGXbigsbDHVff", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243667, "uuid": "a80cac30-342b-4113-bfae-c86459dac125", "value": 2837504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243667, "uuid": "85044c28-432a-4ecc-bf67-e22f02015fec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243667, "uuid": "1984ef96-6dcd-4ad9-a64a-a455073f5ea8", "value": "221bde86c555118e43df5fb971190659", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a0dd676-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710229950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229950, "uuid": "6eef8de0-41f3-4e6e-9381-11801ed7d390", "comment": "Malware payload (Mirai)", "value": "b89916597c3197cec137b383588b96fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229950, "uuid": "6d7ef98d-a807-46f7-a96f-8c0b08c4cfed", "comment": "Malware payload (Mirai)", "value": "622e1e772b3cec4267ed07c0ef40b13e8634f36de8175330e4a5bbc5c2d48643", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229950, "uuid": "6b7d5932-ab8e-406c-a21f-fc1df85d0e35", "comment": "Malware payload (Mirai)", "value": "58b34273da137cd7a95367a159e35d17a60f6b62", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229950, "uuid": "188e0eaf-98b2-469f-9e62-1492bc1cd4ff", "comment": "Malware payload (Mirai)", "value": "1f6a6ad9d11c5867c68bf3d1cfb308b41be25e060e27ce994b9bc0a9bd489df9cb03c7e63c2bbb801a6319c24c36cf2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229950, "uuid": "bc72b838-f03a-4d25-897e-e4fc05b89934", "value": "T16BE30845FC518B23C6D612BBFB5E428D3B2A1798D3EE72039D256F20378A85B0E37546", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229950, "uuid": "f0954039-b4a6-4683-9ba8-6a0247ceb7c9", "value": "3072:FswEbdqRJZPFnv41euhBzejf7d3B4LCGG:FsfIRbZv41VhBzCfBOLCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229950, "uuid": "bdfdffb2-6fc1-43bf-b5e5-b6e2cd0a6238", "value": 150240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229950, "uuid": "9f047874-9e37-4289-9733-cfafc6760a97", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229950, "uuid": "7960a822-6eab-4a86-a597-ccaffc0f4303", "value": "b89916597c3197cec137b383588b96fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d093515-e060-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710241551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241551, "uuid": "43cddeac-4241-40cd-bb6c-1827706f24cb", "comment": "Malware payload (AgentTesla)", "value": "f746395cebe988dde5cd5980dc67e17d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241551, "uuid": "eaa62ed7-71ee-43e7-b465-bb3031473b72", "comment": "Malware payload (AgentTesla)", "value": "623f49d69c71450cfe5211101ea64b83a1721b08c22a7169694d339711c5cdbb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241551, "uuid": "1e931bf9-0d03-4643-9030-918f82862997", "comment": "Malware payload (AgentTesla)", "value": "aa1a39dc85083d048a7e801886fd5ad7980de40d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241551, "uuid": "37f29e8d-81a4-42c5-889f-91dddd50d366", "comment": "Malware payload (AgentTesla)", "value": "e20336f533ba5923ee138ee61550decae1266991cb226d49e61bcef3afb7114c6aed0dbcaa3d06cec2e04e45059c4362", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241551, "uuid": "dfbc7fe0-5cb2-4b85-909c-f28953f5bc88", "value": "T146150256BB20C94BD4295B725D039660A666CFA43E33C81EF82E373FCB7A7C42E41525", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241551, "uuid": "89c58ed2-a0e4-4159-bc85-8a6fb5abec57", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241551, "uuid": "514c3b9c-7665-4c75-a593-f6ff0d080f31", "value": "12288:h/Sr+pAQ3inVFanfz6lNp/qgjX46pB9kwwUHh7X2BM1QzUApjk:I+AQ32HEb0/l46LWNkrQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710241551, "uuid": "a1038f6f-c05c-412d-8f5c-4370c3c1bc1f", "value": 900608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710241551, "uuid": "9d30d849-d26e-4faf-9652-80540eea3e73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241551, "uuid": "3e43db6d-f39c-4a5b-ac50-d7e32b4d60a5", "value": "rRFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63dfc099-e065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710243656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243656, "uuid": "773d5669-b060-4865-b5e9-9fa0113ef841", "comment": "Malware payload (AgentTesla)", "value": "109a9428752064aad08ec2cef2521223", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243656, "uuid": "84eeaf39-7d0e-44bc-975a-b265791a4829", "comment": "Malware payload (AgentTesla)", "value": "625cc44f2e48daac0562888e12cb821ed80531791a207f18d99f820807e79c15", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243656, "uuid": "11781d41-bc4e-4f86-9fb9-f565685eee98", "comment": "Malware payload (AgentTesla)", "value": "5652f84471235298d440a3d34e792c788d71cd5d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243656, "uuid": "71fca507-f5ac-4ef5-8902-40fe006bafeb", "comment": "Malware payload (AgentTesla)", "value": "43fb43bebf484acbf77af141aaa5419f07abed4734047e686d7cef75163e8124034238e0719a1e636ddb7d3d938988cc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243656, "uuid": "3d22e1f5-6d82-46a9-a0dc-d3a53f5c9c32", "value": "T169E43314BCDEFD3AA89A4569A10C31FD04B65BA9145B7DCE4AF08528EB7B3704EC1F12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243656, "uuid": "39df5ce4-0a73-4ae5-ab09-0a586464e821", "value": "12288:O26fdvhzykpDXkVwfKPn5Xk9BvpBkgBE71eXu+cVDwlg2gjlJ3W1hsk688U:O2ehdlUzPn5XGBvpBkgq1eXu+cNkg2AW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243656, "uuid": "eb81986b-04aa-46e0-a11f-f31b706fced0", "value": 686752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243656, "uuid": "dc5e6a7c-4300-4ff0-8a99-2ba040888e8f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243656, "uuid": "6cdde5b5-be3e-4d8e-bae6-7a363919e97b", "value": "Pago Transferencias 7821330877.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4490b66a-e04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232437, "uuid": "8783131d-0896-4690-b549-79ef3059e5be", "comment": "Malware payload (Mirai)", "value": "26592cacdf383f57bef3f1e61029efa2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232437, "uuid": "250e989c-3739-4116-81e1-fcd3f2114b82", "comment": "Malware payload (Mirai)", "value": "630aeca5b844ec36d412e36af5445ade5f389e7218c7c639b88cec12831a7809", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232437, "uuid": "60cba4bf-c7ed-43f7-bcbf-1713e68828d0", "comment": "Malware payload (Mirai)", "value": "555259309862f09c7fe04e403201e23135ee6a56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232437, "uuid": "4d2d6e9e-7a1f-483c-948d-787dca7184b2", "comment": "Malware payload (Mirai)", "value": "e52e0a7828f44c2217442a1d923699307a48f2a95e79fc1e2c04b0ae5f07ff64e694abaf21ebed26a0b827145b449796", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232437, "uuid": "f7d3b79a-b1b9-4bdf-8b49-59b7d599c7e6", "value": "T11B533922A9792A17C0E5F57B21F78324B2F5670E24A8C76E7D320F8EFF1854065076B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232437, "uuid": "86f68603-6653-495f-81c7-060256bd8767", "value": "768:47qtsAOUAoMq9reCYJr4ukj8J4JGCgY+dVU5mp5Zi0K6SGO+h9svF40:wqtsGAZSreC84Bj8J4JXgY+dVhWEhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232437, "uuid": "f7f2f45d-da70-43c8-8ff5-c60337b5b017", "value": 62484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232437, "uuid": "996ff101-0b4d-4484-8711-7c1934f6ba09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232437, "uuid": "655ad87d-f6f4-4295-b27a-b77457599506", "value": "26592cacdf383f57bef3f1e61029efa2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511ca5eb-e041-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710228163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228163, "uuid": "eacadcad-ecd6-486f-8e28-85d0b8a01bed", "comment": "Malware payload (RiseProStealer)", "value": "4cd9cc9a02063eb8fab8e097620ab606", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228163, "uuid": "7853ea6f-6116-4fce-be96-0d90533f9628", "comment": "Malware payload (RiseProStealer)", "value": "634c1d57df34afb4f4d643ab661644984f79a5c3faf2feb5821be93a99c5b345", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228163, "uuid": "e119f231-0c33-4858-b4c7-1791b225f3d7", "comment": "Malware payload (RiseProStealer)", "value": "13042435d155cba9c0170c815a3d920d1bb527f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228163, "uuid": "ff4d6029-22a0-44bf-a254-fbbb0c69c92d", "comment": "Malware payload (RiseProStealer)", "value": "735b0123e7593452976b97d72cae7282a466fd6afbbd405aed9f2e1694e817716f5fa98ba6e14b77ef59687d82abb791", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228163, "uuid": "40dfda69-18bb-4ee2-b965-0813c376e3c0", "value": "T18BE56DA3B50A72CFE48E12B8962BCD85695D43F70B2168D3981C757EBE63CC12D76C24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228163, "uuid": "a41f21ae-65a2-456e-b5fd-7e4123d5dd57", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228163, "uuid": "2b512558-7af4-4bf3-9432-e71a5236cdf1", "value": "49152:sKH3PgaWcxJd2r3U0ckhtB7KnH9ruZPsRWspsBJv4bVmT:sKH3Pggx/Uk5kN7KnH9ruZEnpsBJGmT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710228163, "uuid": "9e708069-7ad0-4347-8985-c3db682afdfc", "value": 3128320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710228163, "uuid": "644087ef-3a43-4d9e-9fc6-4129f4b694f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228163, "uuid": "35a59c67-99cb-44ce-8bfb-2f59844426ff", "value": "SecuriteInfo.com.Win32.TrojanX-gen.21459.14150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fe96c0-e03f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710227577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227577, "uuid": "5fe40768-98ca-469d-a1f1-dd4562888e9e", "comment": "Malware payload (AgentTesla)", "value": "c56dd6499649b660b3067bc967217c0e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227577, "uuid": "0e18f4bf-7dc1-422c-ae2c-b72bd2fa1ad9", "comment": "Malware payload (AgentTesla)", "value": "6393c4f9c6cc64d9637fce27fc7c75907874e4de99fb460080727b76f02204ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227577, "uuid": "3591ba94-3e00-4bb4-98ab-6f9d15df8a58", "comment": "Malware payload (AgentTesla)", "value": "555ece9368e817de6206fcf9a0573afd4a7dad1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227577, "uuid": "9629af78-bb1e-470a-9f78-4028d2f7d74e", "comment": "Malware payload (AgentTesla)", "value": "2ff9e2e0d88068c0be1bf70420090417b21d038379f9b399e2adc9e075a80184b6aee4157767c2d16133ad3e8df3f273", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227577, "uuid": "d5b6a5fd-6704-45a1-8bb1-1296f4ff95af", "value": "T18952143F41860F897E0B3FB7480675194534851C9F36E8F0B7C800E876AA594AEEEDCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227577, "uuid": "19083956-2b46-446f-9cdd-682d68bca144", "value": "384:6XZDW25JYlbPOJJ6WGwAzfTxH5Wvwn6YN:6Xc7WqWGxzftYvqB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227577, "uuid": "e6fdf7bf-3c93-4b1d-b556-06fcea6a3c52", "value": 14245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227577, "uuid": "6dab1719-4d38-4c89-a6ab-390bfdf66313", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227577, "uuid": "df84aca8-e026-461a-a8ed-d9ad006b37f3", "value": "Program 2_GDPMD 00172293.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d02cc8-e066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710244275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244275, "uuid": "e939ef53-b4f2-47d2-8493-0179983ef908", "comment": "Malware payload (GuLoader)", "value": "574425a870353d133f4465e5fe036e74", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244275, "uuid": "adc3fde8-9580-4715-aa4c-50a583133a9b", "comment": "Malware payload (GuLoader)", "value": "6430a964107c9a33f5c2569953e401367fb45af1f0e358c50ed182fc36cd4084", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244275, "uuid": "18deea41-66f9-491e-bcb8-14a07980c833", "comment": "Malware payload (GuLoader)", "value": "465c0e9e39b52412b3bc52a9a757e7553d95616d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244275, "uuid": "138d6b00-b738-4004-b064-9b5763f26c45", "comment": "Malware payload (GuLoader)", "value": "485b9e3b969ab29bbbb841bb23bf4cbdeaa123b61877cd88e1a26efe037d3f3d7c88dab417fa22ff20cd6e0fccef7c63", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244275, "uuid": "444121d6-beae-4ddf-9d36-bda18dbb707c", "value": "T13F05027EFB5995D6ECA90270187BDF6725393E289873010EB257731A6972E93002F90F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244275, "uuid": "7336e031-32b1-48e4-9067-299fa798f579", "value": "12288:91nnU0REibppIB75yoDK3z08f1AI1tuNW03+LskpuUQL0GGnNIlXKNeCPyxwUIj:nnfrb3IBd7DKj3d5cW0+tpeGnN2K9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710244275, "uuid": "2f20b4cd-e14a-49ec-b36f-8fcb357bc7b7", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710244275, "uuid": "e8578525-ed55-45c6-a1be-f048de616f00", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244275, "uuid": "657b3290-37ce-4488-bb8a-894185ba5020", "value": "nDOC - 0031224.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16a67d0-e060-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710241666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241666, "uuid": "e78b229f-4364-4b09-b7f7-b291583eeaf9", "comment": "Malware payload (AgentTesla)", "value": "d0e6c93e614601dff12df9e155bfa207", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241666, "uuid": "2dfcf495-ed84-401b-a87e-5e412095448e", "comment": "Malware payload (AgentTesla)", "value": "6465c5c2e8e27da1d51e63b186dcbc15195902502b1a4558acd025bc88ac9542", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241666, "uuid": "c2a8422c-3833-4f69-b3a1-8fbffca7b2a7", "comment": "Malware payload (AgentTesla)", "value": "9d38d3e2121b9762c707e8828c31d80be3fc48ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241666, "uuid": "e966488e-8785-4b82-973e-876869ee5b8b", "comment": "Malware payload (AgentTesla)", "value": "3d1924a204cb0fc5e79ebd694d650d6ea6e0b01095aec34a3c1be8a26ee3816c2f0ef1f2a26dfd80a31b273842cd1e92", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241666, "uuid": "2e4d15e1-1882-44b4-b53b-564220202eab", "value": "T11FF4230E0E873D35E7AD14EC04321E14296476B9AE30FD9A670EE9C039A69ECE781765", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241666, "uuid": "c2146264-011a-4d6f-8832-541fcda88bf2", "value": "12288:AagdXWKCy8GR4cPo+V0gWxT+j91X1FDv+5WLY0cc6c5Q/ufpkZ+cqEZKtQH:jcjFR4cQ+VIT+p1FFDKWN16c+WBC+cqu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710241666, "uuid": "dd3ba7a8-eef7-40fc-9bb6-426ffb01f42a", "value": 741525, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710241666, "uuid": "160fad53-8654-4cc1-99a4-d763001a17ff", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241666, "uuid": "152e2725-e40a-42eb-8443-55497c012d3a", "value": "Re Remittance Advice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14ddeab9-e096-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710264569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264569, "uuid": "7627f1b0-8b0d-48d7-8d65-e95cc01eb6c1", "comment": "Malware payload", "value": "13576876dd3b6f409d12ce2bacdf920b", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264569, "uuid": "ab9ed736-fe1b-4c95-a741-fa617bb418f2", "comment": "Malware payload", "value": "65bbfa625aa4bed8889eeaebd086f0370ec48a4f8b14f6b76564d0ec6c3858fc", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264569, "uuid": "1fdbba52-4f95-48c7-9979-381e5b31fa6c", "comment": "Malware payload", "value": "9cc39b35379499d2c88aaddac91b66ee7994ec23", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264569, "uuid": "3d58db7e-39a6-48f4-b708-92aa02115d89", "comment": "Malware payload", "value": "d5b27aceb3f10b86d01500de91e996e8b146ed983bba86955771662f4be2bf1dd9c31ad20299fafcb8bc2e25aca22005", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710264569, "uuid": "049d4654-20e4-4e1e-ae8b-79ec874813a6", "value": "T1C713E17287568CD3CD3BB93DE5DC230B2D95639A5510A7563918A682BCE36D40F5C2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710264569, "uuid": "4ccf6d90-39f8-47ad-9200-9a57fbd11f86", "value": "768:EycEGKs2+t9gB+FelRSipxEM7AppPVnj3yu+S9udz:Hrc9gywSipxl7ApP+ucdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710264569, "uuid": "2e4c7689-1888-40de-af23-cde418fec1d5", "value": 41901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710264569, "uuid": "26d49bea-abec-463c-9e62-fa9d3bdc4980", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710264569, "uuid": "346e3391-5c0f-4463-b05b-332beab8a54b", "value": "QiCard.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d10bf6e-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710229955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229955, "uuid": "013d27fd-19cb-431b-9186-d4f80a1f9f78", "comment": "Malware payload (Mirai)", "value": "f1b09fa23a20019ddd3a5aa702034c12", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229955, "uuid": "e43dc1fa-bccc-428d-be65-a98a9a175893", "comment": "Malware payload (Mirai)", "value": "65d43972221b828dbbb890cc9a12d2d149bbfe5f5a68440962b0cc7f603330e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229955, "uuid": "60a4204c-c1d0-4e7f-8950-f7672b203d23", "comment": "Malware payload (Mirai)", "value": "d0472a135ca9f3dc6c50ae0054deff18ecf26b66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229955, "uuid": "77804ae1-8d1a-4f21-8b65-c8540de702fd", "comment": "Malware payload (Mirai)", "value": "3dc8b9dec0ad8974b5895ff3d0f112ba05d7da901254625de5bf9873d3e1ad842e4f93c1a8c4c832ef065a573f734e42", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229955, "uuid": "7d7a6777-a3ee-4aed-b2a4-cd2627a61404", "value": "T1B5C38ED9F183D4F3E85B04B4603AEB3B9E72D47A211AFA85D729CD32F8D25809117A5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229955, "uuid": "d9f78c4a-5441-427e-8cde-571689416609", "value": "3072:MopX/y7dqAb9bbok5Rkm/K7SpSx3P5CZpHWGc3RJeA:MopX/y7dZb9bB5imw3hCn2Gcfe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229955, "uuid": "3c2e92e5-2e47-46c7-85c2-8b58c7d40029", "value": 123660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229955, "uuid": "f62f8073-fd7d-4a10-ab36-145d247e6d2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229955, "uuid": "dcb17f19-fece-42a3-a970-93e0f74e5253", "value": "f1b09fa23a20019ddd3a5aa702034c12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dd9ca44-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238519, "uuid": "856c6f85-87e8-4709-b5ec-53b5f854eb9e", "comment": "Malware payload (Mirai)", "value": "513a202c17e25e9210aa3c37dfab8a9a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238519, "uuid": "8e98e962-a57f-41c3-a466-1a5feb27ee49", "comment": "Malware payload (Mirai)", "value": "663e5aba3666b36b30ba1eec32437059826889ce521f247dcb3bf41e722a288b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238519, "uuid": "ef4668da-947f-47ec-995b-4ac204c0181e", "comment": "Malware payload (Mirai)", "value": "b02a4bbfbf8c1f5183a911b3d87a256b86b2ee27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238519, "uuid": "4e084adf-38af-40a9-a6cf-1cc5d8b9ae0c", "comment": "Malware payload (Mirai)", "value": "ff6c65d412b7836fb6d5916491ac4c1770ca0f462ea2b3833dc0ef233b11fe3691811abc30c299dba3d180f4af538e6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238519, "uuid": "eaf1de33-cceb-464e-a20f-4f9cf66e646a", "value": "T12053199FAB2C0797C4DB56F03CB737F08B5EB96012950188A206EED50763BB4A416F67", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238519, "uuid": "5c940b2d-bb8e-475a-ad65-088f089cd499", "value": "1536:sshPbqGS9YxQQKXnMGqMXfpAvV6FnITk3R7FdKk1:sgDCXmMBAvInIozX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238519, "uuid": "8e6ca702-2c9c-44a9-b1c5-08de5243e247", "value": 66115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238519, "uuid": "fe1f3952-3728-48eb-9f3e-4a15954db2e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238519, "uuid": "788a2c0f-7a59-47b4-8873-c853c543c2ef", "value": "513a202c17e25e9210aa3c37dfab8a9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7769cdc9-e03d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710226509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226509, "uuid": "e0e61039-67ae-4ccc-97ed-5b60a15170b9", "comment": "Malware payload (AgentTesla)", "value": "efa87a907a8ded6965915b1b2f669359", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226509, "uuid": "a64f5f60-3b3f-4086-9739-4826332041da", "comment": "Malware payload (AgentTesla)", "value": "679dc92a880a9cccce9eb21ff51c79a624a0d01567ef57c1ffda567d08abfb60", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226509, "uuid": "c3747b37-bcba-4e12-b26e-c2e5613477a8", "comment": "Malware payload (AgentTesla)", "value": "f1d20942a77e974109f31ec720a9ef4f4c73c3cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226509, "uuid": "6717bc28-804e-4767-9e8b-1012bb0c8499", "comment": "Malware payload (AgentTesla)", "value": "2d14e1b7daa8b15a0f0eeaf3ce6c8a463b79f09618117479615df77b9f913ce8057af346fad9491841108e9cf711ee13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226509, "uuid": "a43280bd-b0d4-49d1-a42f-86d527773b58", "value": "T12635DE3A27F16B4AC26B4171D7EAC2B59AE00F24CCD4D336D1762519E620DFEAD8640F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226509, "uuid": "a25ad170-6758-493f-99cc-e608cd72ef55", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226509, "uuid": "50cbe5d1-fe88-45b0-bd45-1df5c6dcc634", "value": "24576:ZcqO5jGqP3EE/rkEoHkWMGN4bfA+gqiIvma4zG:uf5jGqPUEIEdGN4bY+gqV4zG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710226509, "uuid": "e99a422a-bdbc-4dc6-9f6c-8a28be2495c1", "value": 1155406, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710226509, "uuid": "f233df6c-d873-44cd-8be7-1b7edebf4548", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226509, "uuid": "129014c3-1856-4844-8470-51fc2767fa01", "value": "D00312-24.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06e0b86d-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235769, "uuid": "3e66725d-d269-43b1-8cda-c74fb7de5aab", "comment": "Malware payload (Mirai)", "value": "49b8f822113bdff71bb72b67f15576a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235769, "uuid": "f0682cf1-e856-4089-b7eb-d67677bc7a4d", "comment": "Malware payload (Mirai)", "value": "68e8dd25ab8690fc4daa226427d54c00f5adb5f651dfde03efc9b46b65e681ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235769, "uuid": "6b39791f-1d9a-4e34-a4ee-b04000bfb851", "comment": "Malware payload (Mirai)", "value": "ce2c4745ff1ee1fdc9f6460d2ad9aac74e7d7a6a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235769, "uuid": "96329302-ac3c-468e-a66d-92c15740bd96", "comment": "Malware payload (Mirai)", "value": "bfb692fd7759e7e5669343cf5bce8add3dd5c21a0ada9aa569af5c9b3124bedd4756f4910f1d7d8bae652db1c95174b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235769, "uuid": "3e936930-9f34-49d2-927b-b06cf35f8aed", "value": "T1EE13F13AA1623D2ACE306D7AFDA0E68562C74E3DF1435927348D07985A238421BDB7D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235769, "uuid": "e8fad321-4bce-471b-85c4-fdc70023347b", "value": "768:Hu64SH4Qj97/SgYSjRmPW3fmHby9hgHIMc3W0voYgd/KtPpjvmaz9sk29q3UELyK:Ozq/dKPW3uHbShgX0gcxrmMzbLB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235769, "uuid": "78e2c895-7f5e-4780-89db-e4789b54298c", "value": 44048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235769, "uuid": "f70d98c1-8dab-49b9-95f3-e6b161b32ec1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235769, "uuid": "821f3a2e-54e7-41d7-bd6e-cff8d6df49c6", "value": "49b8f822113bdff71bb72b67f15576a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8a82f3b-e03f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710227558, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227558, "uuid": "99d63b95-6c17-45d4-a016-842b2cc85a51", "comment": "Malware payload (AgentTesla)", "value": "65014753390ea021bc4be75d38840f5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227558, "uuid": "8e43d496-396c-467c-b4e1-94c3d78f7ac3", "comment": "Malware payload (AgentTesla)", "value": "69053e4a5fb9b5634c326a4f5c72770b157907e98e26d59ae1e8554f3df38483", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227558, "uuid": "ab53ebe4-1e88-439c-a289-52a2484c28f7", "comment": "Malware payload (AgentTesla)", "value": "d78eb7a0a1bf2f810024b7a3af85dab6526825c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227558, "uuid": "6d928689-9223-47d1-93e6-31d11225b266", "comment": "Malware payload (AgentTesla)", "value": "3faaaa29b859004956f641f7762b17cbf08abdc0dbf16f994c4fc089836d400fe673c9193f24dec9b87d32347ad1b3b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227558, "uuid": "f1d568f7-9e8e-409f-979a-1f10155f6386", "value": "T106049B2DD34B02598F520376AB5B1E5542BDBA7EF38452B1306C533933EEC39A2252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227558, "uuid": "95761f7a-90de-4426-8b62-4cd7f36c572b", "value": "768:xwAbZSibMX9gRWjtwAbZSibMX9gRWjtwAbZSibMX9gRWjK4VWWllqfIvgaHHFB71:xwAlRkwAlRkwAlRJyqwoaHHfwgy4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227558, "uuid": "d906bf27-2c24-4a9a-a7d1-4c22f46252b5", "value": 186020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227558, "uuid": "03272a87-0549-41a8-b28e-830551f61e98", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227558, "uuid": "1dfbd8e0-256c-4d7f-92a2-905732f077e9", "value": "OUTWARD-PAYMENT09467.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8754605e-e028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710217516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710217516, "uuid": "736ee864-a312-4d7d-8b06-a941be55cd9f", "comment": "Malware payload (Formbook)", "value": "6916dc612de7bc466588dacfb83559de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710217516, "uuid": "11499714-d3a0-43f7-8738-640bb18d9cf1", "comment": "Malware payload (Formbook)", "value": "6956408ecee746f2fa4008b564cb84a610112a9176e531b1a97ffc8923106364", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710217516, "uuid": "6722a552-ea47-48f6-a9cc-c49e095f84cc", "comment": "Malware payload (Formbook)", "value": "672a4efddde6a95881771614d6a4c6587a591fb5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710217516, "uuid": "e9ddd8cf-cce4-40fb-99a8-e0261fd4b181", "comment": "Malware payload (Formbook)", "value": "3bdd1ca56e015a599cea2b44d92086647589492171f43852b29b28f21128448711da202a54ffdfb5dd1fea52a45df9c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710217516, "uuid": "4dae2212-0987-4c53-a71d-8a4975b56817", "value": "T1D9F40295716D0F43C678B6F84431212443F62469B41BE7ED8EE2B3CB4AEEF900A94E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710217516, "uuid": "e7b724f3-dec7-4a66-81a4-faeed77e39b5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710217516, "uuid": "8f4d7419-64ec-4d13-950d-58181665fe9b", "value": "12288:WfwsJTENl3lJp3mRVn3EmQye8dv/LCo7/lNuDGceNQIK4ofGL/a1ANGkYq:QRxENlZ3IV3Epp8dXd/jzc8QIK3G27/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710217516, "uuid": "558303cc-eae5-46cb-9dd4-ad33aad3e135", "value": 757760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710217516, "uuid": "f4ea669a-ee7b-4a59-92bb-2bb9d3f25135", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710217516, "uuid": "012d3d36-4067-4220-a455-30c32c6c4b6c", "value": "SecuriteInfo.com.MSIL.Remcos.GWMJE.tr.2177.15379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b49a0d0-e044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229576, "uuid": "cbab4d29-0b7a-4501-b458-7632a04e033c", "comment": "Malware payload (Gafgyt)", "value": "c6bb462f85f5d927aeefd2d5068feace", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229576, "uuid": "6d015463-1368-4e93-9c3d-89b160ea1f17", "comment": "Malware payload (Gafgyt)", "value": "6a214671448e390cc5068213e763fe6350ae3771db6766a5f48936ee24c932b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229576, "uuid": "f032d62b-85aa-4881-bb01-864201bd20b8", "comment": "Malware payload (Gafgyt)", "value": "563d3cb2fe1ac434a0209d77ee6a0cc14c3b15a2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229576, "uuid": "74898e9e-e194-4323-b763-9e11b6c1d821", "comment": "Malware payload (Gafgyt)", "value": "0b485d344b74cf3f8cad978b6562d0766ca185f41b52f7bf319f36a29f18c8c2dc8177b8986a9c9d2b02263e0721a66e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229576, "uuid": "4e1ade17-312d-42bc-9a9f-997c491d3d54", "value": "T1B8C3F849A141C2F6D4830BBA135BF83B00FAAE6D551B5B6AB317FDF4C67B58132113A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229576, "uuid": "7076c8c9-ad23-404b-8685-8d304a5c44b2", "value": "3072:sZDxplJdXvP5rqDUP3UsqiCMFAMLln3p8rg+Z0Ua3hgp6W:ADxp5v0PiC+Px3mrg+Z0Ua3hgp6W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229576, "uuid": "becf2622-bb5a-41e7-92ed-0e38e0524b3a", "value": 120594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229576, "uuid": "b6b40e1d-3778-4196-944f-05ba4445f7b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229576, "uuid": "3f8a1712-26dd-424c-98a0-a59b7b40ec21", "value": "c6bb462f85f5d927aeefd2d5068feace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b178ff44-e06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710247652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247652, "uuid": "4fe0be68-00f2-465e-a0fa-d54253ae1768", "comment": "Malware payload (GuLoader)", "value": "e22295dc6fabb531b840d520b0228aa1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247652, "uuid": "1c0cf0bf-47c0-4ff7-90ab-452ef3a9bfd2", "comment": "Malware payload (GuLoader)", "value": "6ba44d20fc41c76fa1cdb57f9ee0bdc05775e74cfc011f0eeef4acb03d898aac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247652, "uuid": "7c8870ce-662e-4396-806d-7bef0ff9c4a2", "comment": "Malware payload (GuLoader)", "value": "56da558089dd0693e8b89f1b83d8ddcaf927b134", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247652, "uuid": "d38ce7e2-d990-48b0-ab82-fe94e35d2df0", "comment": "Malware payload (GuLoader)", "value": "766d1dee4ca2d952c3f3d316ffcf7ba785c928f3fd4595d678a0046c8d1a7a2b28f60063f6a4b18634e2d4e6bdffc430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247652, "uuid": "0ebdb1cd-2650-4fb2-b682-784e7aae62c8", "value": "T1B5359CE5D8C04184ED292F7464761D39402FBE7EBDB8E98E8A5DB0603BB36C76432947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247652, "uuid": "212785c4-703b-47b2-bdf5-f1b2c6386ebc", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247652, "uuid": "254d3560-9878-4970-a40a-43fab2f3b70d", "value": "24576:RaU/LcNbKqeBSnXwkYNEJcGH6ZIe1wQiJhg:0oLc5Kqe+Xwk0EbWiJa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710247652, "uuid": "bdc206bf-bc05-45d9-b804-022c9e582ab7", "value": 1081848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710247652, "uuid": "35e68efc-6273-43df-a185-4abeb1632623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247652, "uuid": "3c5ebb80-d0b0-492e-a821-52f4d5114a30", "value": "Package.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a86fd8-e078-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710251746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251746, "uuid": "16ecab74-1eef-4aad-9fc2-9509d120cc65", "comment": "Malware payload", "value": "f46c2484867100fa6a04ee3695c015ab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251746, "uuid": "a7077181-5c58-41e6-bd85-72b1fe0ef24f", "comment": "Malware payload", "value": "6d4fd32c3bbb14cf1d56e72d60a5bc89fd48ed6dd04c547c7a51f7e43fcd0d8a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251746, "uuid": "6356ff58-cb9d-44a7-adde-a63accdba3f8", "comment": "Malware payload", "value": "9ded673d0fe11000c58b3989dbffbce0398b3a21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251746, "uuid": "c07314a0-6183-413a-ab44-ffaddfab4fb8", "comment": "Malware payload", "value": "906d93117674f84e71f3f63f03a1450259cc167e32d4835389f1f65c6c7d6683e68466af552a0c55dba8f778d9ac1971", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251746, "uuid": "471ab188-2767-46cf-af2a-8f215809d39f", "value": "T18D457B4EBE2885F1C5AB8079C593944AE6B274D60B358BDB13A98B1E3F239F44D3D710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251746, "uuid": "55bd3e84-f8b2-46ab-9c55-9255aafd0407", "value": "bcc417dc5f379d94b6dca5009b8d6da1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251746, "uuid": "827818bd-c69b-4f6b-8953-3f1330857606", "value": "24576:1Qnuk5k53w6tkx11n3auPcLu0xLUzXOL1w4dWIvfXns:1Qnuk5M3Bu15dcLTxKXOL1w4df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710251746, "uuid": "0d84547e-2cd8-4a8c-a7c3-155a12f6fe06", "value": 1171456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710251746, "uuid": "1973c212-b31f-4447-8220-1128d8e9b19d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251746, "uuid": "fe86cd64-0afa-4d25-8219-d25558ae9777", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658ad32e-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229915, "uuid": "13400fbd-3a6e-4ce5-bee2-bc76fca11bdc", "comment": "Malware payload (Gafgyt)", "value": "5ae4d62d177d3ea5bda216884c749157", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229915, "uuid": "9464fdd8-d0b9-46df-9ebb-79ba3419c2bf", "comment": "Malware payload (Gafgyt)", "value": "6df1af25a96ddc44417bd284750566f94f98e35c1483e3b4c8b100afe9085278", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229915, "uuid": "756d0402-cf89-46c0-ab53-6ad9ac30a16f", "comment": "Malware payload (Gafgyt)", "value": "f404b658dbb9fee7230ffceeae32bbda23e63410", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229915, "uuid": "f7edff9d-262f-45e4-b949-6f1d037db00d", "comment": "Malware payload (Gafgyt)", "value": "135493178eb81e44101265f6ea171cd04b436ecbfc3525a0b58aec80aea6283408bc8fea7348ea03f62badb501c4db75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229915, "uuid": "e8755ce0-cdba-41b5-bf57-c4f5eed435e3", "value": "T1F2F3E601D5508B6BC6C35BBEF755A1CE73729E986F873306C719BAB027D02AA5E3D201", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229915, "uuid": "0e4490c0-ae4e-4070-9629-75ccb3511d36", "value": "3072:EVazlAqsJt/oxSMpJ6H+kpP6P510FwKfXtrz/Jai7m4oa1uAB6HlqMlM0myotq8b:EV3RtrTJagTBClqkM0myotqauUr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229915, "uuid": "0f426a90-f99b-4984-a577-bb9da13aecb7", "value": 164079, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229915, "uuid": "b3b950eb-79ed-4ec7-b2ae-345c356bd458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229915, "uuid": "664ebf05-e3a0-4f5a-a053-d26286e3184c", "value": "5ae4d62d177d3ea5bda216884c749157", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8733825-e09a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710266669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710266669, "uuid": "b3294df1-04d6-4266-a844-b96af37f3128", "comment": "Malware payload", "value": "46f21a3232cba512bc0363a5987c006b", "object_relation": "md5", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710266669, "uuid": "4113c61d-53b0-4afb-8bdc-2838b683d5fc", "comment": "Malware payload", "value": "6e36a59834bd63f344198515b31fb9d803ff1d82300ea36acf8886d0e7938311", "object_relation": "sha256", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710266669, "uuid": "8efad178-8f50-433f-93e1-182fff5a75cc", "comment": "Malware payload", "value": "0a3466dac90c48765a14958a4c43e0104ea300d5", "object_relation": "sha1", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710266669, "uuid": "7a519588-6cab-4c78-8edb-eae29e3bedc3", "comment": "Malware payload", "value": "d48e81961f6fc9eb0e1e0d2224597b08046b4ffbdc7e9f8f01f9fb46af6a183b39c1ebb17a3f08f6c17fb91149e00389", "object_relation": "sha3-384", "Tag": [ { "name": "DUCKTAIL", "colour": "#96AFC3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710266669, "uuid": "5222627c-f9bc-48f2-89d4-792a654231fc", "value": "T186A5234EE117C5F1FB17B03974669C2A5E818C2964D927AE224CF53B3932271242BDBF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710266669, "uuid": "eacad8f3-faa2-4e04-9999-0e37ed1ad7d7", "value": "9fbd12d1610c70e6de645386942f140d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710266669, "uuid": "1545ca88-198d-4cfd-afd7-6d437cf993de", "value": "49152:yQV9By+36+u8WKMccTMLe3cZknV/aR1diJymrnXE9MCqu:trs+q+u7KMccTYe3cm8fiTrnXA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710266669, "uuid": "26bf7c70-3978-48a4-877f-01551482ab8f", "value": 2176008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710266669, "uuid": "afe99f0f-2050-4ae1-afff-485bf15cc18d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710266669, "uuid": "2375c4ba-ef70-4668-b3f0-4537db228b66", "value": "Recruitment policies for candidates throughout the contract period - as well as payroll and benefits JD21 .pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6f5dddd-e066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710244279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244279, "uuid": "c24b4f24-3218-4c4b-a227-835e1464bb54", "comment": "Malware payload (AgentTesla)", "value": "982243b204913c47347d8f1d06fd0fef", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244279, "uuid": "357a827a-964f-447b-9722-aa5ab0530140", "comment": "Malware payload (AgentTesla)", "value": "70307bc896bbbf7da1fa3e03fab00c3a1a0606fb90db78ba00679ffae1f538eb", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244279, "uuid": "d33f1bcf-c534-4c54-aee0-2c22439146c4", "comment": "Malware payload (AgentTesla)", "value": "0988b52e80ff7cb0ec94815be7988b48b0ab5c0b", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244279, "uuid": "aa7efe98-6163-4dad-8ce3-09bec59acd14", "comment": "Malware payload (AgentTesla)", "value": "9094263c61e5b928aca621e8655b93c0c90f4cf28d5cc5e3e2a2c5cbab652708a5b9511eba17f8f8aeb12eba7ed66b48", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244279, "uuid": "8351b115-f021-4b8b-97a9-0c0a6c51f0ec", "value": "T15A92C01D6A50EC1CBDC99F771934110CAB531E6BAEBC408BB7B41B70D3A2680FB68611", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244279, "uuid": "050c0a5f-c2e6-430e-93bc-dc81953209c5", "value": "384:3zOM9m6OsTSMe41Cmrry8aewh3GwJS/Bawx6ssw2Q38k6i2g7XqK/:jOMy0So1CAZQ5YltswB3V678b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710244279, "uuid": "253f2b09-2180-4b11-80d1-b7b5a79196db", "value": 19536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710244279, "uuid": "0458d1ac-3d4d-4045-8d0e-134f977ed5e6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244279, "uuid": "f36ec998-aacd-4d1d-81c3-ddfb51079439", "value": "nENQUIRY_FOR_QUOTATION.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ad70dc-e076-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710251011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251011, "uuid": "ca136057-22ef-4b07-9a69-f6e74bbe42ed", "comment": "Malware payload", "value": "583c51e0bc0581e91f5bd39a13932662", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251011, "uuid": "cda1fd2f-f5ca-4781-873f-2b7063669bc4", "comment": "Malware payload", "value": "7040ad3d7ca0e4ed43736ecb89ce97531df5d95e2ab8c850fa8a764c232b1384", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251011, "uuid": "75ccf919-2bcf-4e79-adf9-fe4600197336", "comment": "Malware payload", "value": "0573eeb4c9ff2c0690046e07d5e4df46c201fdee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251011, "uuid": "3f47bbbb-4746-4b68-a3f6-bfbae97cd7f0", "comment": "Malware payload", "value": "e5f22f60628529eef8006d7e90c8f2580de6ca505cba52d26c7a0b0656df4daae098d06648ae9a8f0a2f174733a4bcf9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251011, "uuid": "462de798-5c20-4ae9-90af-4e6354ce7022", "value": "T1A3868C43F85495A8C5EED230C675D292BA317C844B3027D33B61FBBA2A77BD86A75340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251011, "uuid": "16256773-57d5-45da-ab96-64dc2178e95d", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251011, "uuid": "74e198b3-b173-4dca-a8d4-e9fb919c9b24", "value": "49152:NmToVE3JtSrb/TtvO90d7HjmAFd4A64nsfJJq3UEIYcZyW4iEs9mA3sV+2T5EPfS:63Jtdm4jYEjMbdQ57QLRa8QPmZ5Pziz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710251011, "uuid": "59e178e0-2f35-4d8e-8eb4-1ff7bb38355f", "value": 7925760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710251011, "uuid": "c136c5f2-b820-451e-82f5-acb676721e6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251011, "uuid": "da2fd771-6420-4537-b758-4142034cf1f3", "value": "SecuriteInfo.com.Trojan.WinGo.Agent.4990.16560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6483a4ec-e018-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710210586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210586, "uuid": "260a17a4-8bc4-4c7a-a71a-77178af7c0ca", "comment": "Malware payload", "value": "57e7c8876f16f909deec0784cedbb138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210586, "uuid": "ee4968c2-5bb0-41d0-8bdd-f633e3312a06", "comment": "Malware payload", "value": "705be33e0bed95c6e1b236a15b1dd0144ce6576f808c965e565d6047740f9c94", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210586, "uuid": "c8b91339-a225-4d8c-bef2-f8cd8beb0878", "comment": "Malware payload", "value": "94b0424a1235a51b6000a99d157da7a0e620d5db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210586, "uuid": "641e437a-8978-4978-bff0-3e25af2c1271", "comment": "Malware payload", "value": "b94cefb5478299dcfb7a3ad612aad6d4a08af6abd85e4132e62fbb1eeeae2cdec6a9a13fcf8eaf56efe6e55c4880552f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210586, "uuid": "d27b9a7a-50c9-4ea6-aa3d-fbada8fa1499", "value": "T1E7132951753C901AF24DC2F62836D8B938167E3016A68C0B7AC99F9D2EB26C374A530F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210586, "uuid": "05e2314a-9d3a-476f-9962-cc4f87e3cfb2", "value": "67bc57cb45a888fd6b4e273e938143d1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210586, "uuid": "d48318ad-06fe-4781-a2ae-4ac448f7b3e2", "value": "768:IzVr/eV4lb4MWXeRyhA9DfUv/rkj6wIXEdPhV4:IzVr/eVWcMWX+ZzI/Aj6wIXEdPhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710210586, "uuid": "12c6e56f-67b2-4812-8b26-c7d0bea66529", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710210586, "uuid": "b7d32e5f-aaff-4c11-b82c-ae042e74c623", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210586, "uuid": "e856fecc-12b8-4dfe-9bad-b6a7cf9f27f8", "value": "SecuriteInfo.com.W32.PossibleThreat.29777.31400", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "884b0be3-e03d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710226537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226537, "uuid": "69dfd298-3e53-4a07-a77a-afae7627bd59", "comment": "Malware payload (AgentTesla)", "value": "299f8c6ca2b4f05721a1e7020c875b94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226537, "uuid": "282a10a2-75a5-4cd6-aad4-fbcc55402451", "comment": "Malware payload (AgentTesla)", "value": "70789e3f84f581492ec430031f43fd38594dee19aeabea479d14e3d30eea4d47", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226537, "uuid": "ae26f20d-42c6-4da4-a3e0-2d94b3aded2b", "comment": "Malware payload (AgentTesla)", "value": "84e7e9801debdf209aa64843e028ed6287d40ce2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226537, "uuid": "b73cc7a2-1585-4c81-9773-e155b4182fe1", "comment": "Malware payload (AgentTesla)", "value": "12b01a0813f779083a787786dfc6da3dfb5e02815bb69cb388fc4a71f0f9cbe166760a5c42652b2dfaaa1d1cd854150a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226537, "uuid": "873e633c-0353-4a8f-93d2-27c184846038", "value": "T1BC1502516710CA9ED06A4B764813A6A59369CFA03F73CA1EF82F377ECB367C46E41121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226537, "uuid": "6194c92a-41b3-439a-87dc-9e5779f4bbd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226537, "uuid": "f6c0b866-aeb2-4afd-93a6-9bb54c487926", "value": "12288:Sp/Sr+pAQ3inVFamzVO6HSn69uXD467R5ASI54eEOs9SgeRDMaDAl1:V+AQ32HrRxHS1D4674sOijeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710226537, "uuid": "91e11d35-a084-45bf-8734-618a9e1cf18f", "value": 893952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710226537, "uuid": "9f470616-cca7-4e21-869b-7d4c67085fcc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226537, "uuid": "d4e466ea-73fc-4a82-9951-e9d49a89695f", "value": "RFQ-4320018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74183548-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710229940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229940, "uuid": "7894149d-6370-4808-8310-fca09c0d7e8c", "comment": "Malware payload (Mirai)", "value": "133e37e969cdc3127ac55f7f4c25d32a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229940, "uuid": "5c26af51-4d96-4e2c-8581-eb076cb4c7f1", "comment": "Malware payload (Mirai)", "value": "713d2cb2d21a9b8dda79acd28ccbf06866b992353a9322b85bfc237d8804b978", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229940, "uuid": "7f032bdb-7023-4ed0-a286-028141da8373", "comment": "Malware payload (Mirai)", "value": "46ac0353c5d10e082ade6ffe84bdbb6fc6116ddd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229940, "uuid": "4a35976b-cc3a-4f51-aaaa-5154b6639e67", "comment": "Malware payload (Mirai)", "value": "e5beb4607660103e3cbad19f7343207d18f6806e7200f77e6f27a5cc3112c97703ddd029b9ea9e6ec623a2c098575b62", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229940, "uuid": "83c81840-f472-4aca-bce6-099995093113", "value": "T148E34B0BB5C184FDC8DAC1744BAEA537DD72F49C1238B26B37D4AA226E5DE211F5DA00", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229940, "uuid": "e7828f70-29f3-4c08-8117-1253feb937fa", "value": "3072:iVy/QHH/tBgLC72hqbaBcwkAR1D0/Sn2JndFdu6TPJK2LiF4:iVy/QHft2C7Zg5IhPRu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229940, "uuid": "e0ac6e02-ad42-4d97-b47e-28914330a42e", "value": 155944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229940, "uuid": "e9b28391-b693-4cb8-8f5f-5d0c99423c3d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229940, "uuid": "57f18f8a-fe0b-4b4e-a91f-b0efbd565256", "value": "133e37e969cdc3127ac55f7f4c25d32a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5218e001-e0b6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1710278416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278416, "uuid": "d67e277d-2196-4ece-b877-0e7246f6368e", "comment": "Malware payload (Gh0stRAT)", "value": "628a717185fda735c65f634cd8944896", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278416, "uuid": "3effc834-27ef-4918-ba03-2e3ca33ceada", "comment": "Malware payload (Gh0stRAT)", "value": "71619cf91a5213a6681eb975d170e5a74e21e75af35909d6d2842ca90b7f97d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278416, "uuid": "2be12520-ab21-44cb-b722-b23f0be45314", "comment": "Malware payload (Gh0stRAT)", "value": "de5531a6d7a774d21b84df370f20e9e70bd9957c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278416, "uuid": "e686a8a0-e64f-4c80-a836-106bf7310110", "comment": "Malware payload (Gh0stRAT)", "value": "468e3244710e7ed26da2b4baf406af6f428c3fa6a94aad9c7bd25f7665ae6a0601e06b2f91f461d2e3072ee83cbe17bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710278416, "uuid": "84912cbc-eaca-4b64-9e12-31df42437ed8", "value": "T110048D12FAC448FAE591153C14A72B379A7F7D74CF494A83EB14FA6A0C726D0BB12247", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710278416, "uuid": "876adf03-544e-4bd3-b616-6f6155864cd6", "value": "1d1a38da13d04677f392f9ca4e289b52", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710278416, "uuid": "2cbc2379-1026-494b-b64a-59598b74830b", "value": "3072:ScWYIOets7tPdGYnNnVzamxH/tiZ+1cfk4Tw9b6rYGPeqov:FWYF1fnV7Ztmffk6whKYeeqo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710278416, "uuid": "6e7ad2e4-db15-41b3-bd60-cac597fdfbf5", "value": 188416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710278416, "uuid": "4c52c636-725c-455d-8de4-5c0e15d499b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710278416, "uuid": "3026569d-3db6-445a-a332-9e6c3db6b39e", "value": "628A717185FDA735C65F634CD8944896.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e6d996-e073-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710249830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249830, "uuid": "3b9732cb-2ff6-462e-bbc1-adc87108cdc4", "comment": "Malware payload (AgentTesla)", "value": "27e3b06405bda4e46142d2d8ff6589e7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249830, "uuid": "cc9ef352-472f-457c-bbef-994e5513d9a0", "comment": "Malware payload (AgentTesla)", "value": "718bdf94dd3385b02256011e20334806a95a81c9f7e81abe8830b6a7514e8c9d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249830, "uuid": "a5671dc5-4963-4835-9f13-63ed2b23d153", "comment": "Malware payload (AgentTesla)", "value": "39f5e4710a89e9fc771459a5df7816c8ca51ebde", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249830, "uuid": "635010ff-c088-4767-b81e-cce60940a1cc", "comment": "Malware payload (AgentTesla)", "value": "9e110992b95c2413603afbfa86e71ee1fb603a7f58cd672d2b2be9e6623ef7f338ecd14a595a11f8fb593acc5cc26848", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249830, "uuid": "d15428bc-a099-42fc-8c76-c46a3997ea90", "value": "T115C4015055E98227CEDF4BBF705492498B7ADB32F66AEB8CAC443ADF08437C29542137", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249830, "uuid": "7b327bdf-9ebd-4f25-90d6-f3e195a5bfda", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249830, "uuid": "34f7b2ef-3736-486c-93d4-760d99efc5d4", "value": "12288:Jqc1iDPxNqEjTVpH9gANOR2iHQqtIwmU/8TizF:u5NqCpHfOXjBRzF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710249830, "uuid": "9606895f-89d9-459e-a830-909bbe9103b1", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710249830, "uuid": "667e57bf-0bdc-45ad-8f97-accd2c59c29f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249830, "uuid": "8f6a02ed-c287-4654-b197-e6e36beaabb1", "value": "mimezx.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9951cbe-e076-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1710251075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251075, "uuid": "5a20e907-d6e5-4efe-b91a-5b7a19eebd43", "comment": "Malware payload (Gh0stRAT)", "value": "7ad3f2440080b451007041ab312cd44f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251075, "uuid": "bf91f5bc-74e2-45c8-8bed-333aa1229f75", "comment": "Malware payload (Gh0stRAT)", "value": "7193cbc2f1fd3e79ff7d710e11d76f3c22a16e1373fe7638e8f68cc02a8278e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251075, "uuid": "09fe954c-81e3-4f47-a18b-c0b356495b71", "comment": "Malware payload (Gh0stRAT)", "value": "f27cb8b1cb151f623d4f3ab266a1a6fe0b78a90a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251075, "uuid": "b5e83a49-b26f-41b5-bac3-ab84e6473945", "comment": "Malware payload (Gh0stRAT)", "value": "914676ed46b40be220146924dc9189c422c8c8693954eb863ab42483b63accd0fffca9cb902c7bf8ef6154c7f11dd1de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251075, "uuid": "1ee748ca-20d6-4a18-968a-456bec438d36", "value": "T18895F1860A06EF97DD6C8870E556EAAE03E33E3ED41784D89AD736D608DBD15403F827", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251075, "uuid": "990f265f-ab8f-482c-96b1-73254b81e239", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251075, "uuid": "8d7c8551-b4d7-46be-a8be-12ac35b4fb62", "value": "49152:nNGMCKrWDercJet5CGs6o2DE712M6MR5yttt9BR1Iu:nNGMbKDer3L3s6oiwf6U2tt9BR1Iu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710251075, "uuid": "8ff41d36-5d27-4f44-8d2e-253c5904e7b7", "value": 1904640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710251075, "uuid": "60a97e6f-49aa-44ac-80de-604cca8b5882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251075, "uuid": "c46fed34-fd05-4226-a4ea-e47d416963d9", "value": "DataRecovery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10d59e73-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232779, "uuid": "cc788896-b364-400c-b8b8-f08258b28b8e", "comment": "Malware payload (Mirai)", "value": "275eb6cd6b3069ea7ece58b0d6923752", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232779, "uuid": "b1b6f9ef-7139-4c76-a955-0297fbfd1573", "comment": "Malware payload (Mirai)", "value": "71fe95680f2a063f4a836a443438e5309c9d44637de8761d7ee5615caeb8cbdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232779, "uuid": "aad404e5-1f51-4832-933d-9429ef146189", "comment": "Malware payload (Mirai)", "value": "8c50cd5bc74c92297472b8cd5523845d842dfe0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232779, "uuid": "c3b42b35-6da9-4c77-bb02-2a0b859683be", "comment": "Malware payload (Mirai)", "value": "4b2b8796241ae51b001d91cb34b3090bb1936ce471c3f5934d4638eef7069a155ae0f5426200eccc6b3e6a42bfe81445", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232779, "uuid": "bc0a1e54-1969-4e9b-8728-c1b134942ad0", "value": "T1F273830ABF650FF7E8AFCC3789E91B45248D641A21993B797D34D818B24B64F49E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232779, "uuid": "5cecd73e-cc9c-42b1-ae0d-318b27ff0492", "value": "1536:vGFfut16/jhZRcogB2UHqsZMDuPSwtOA3B:+Ffut16LhLgB2U/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232779, "uuid": "e03b9863-8029-494b-bed1-848c725af480", "value": 79884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232779, "uuid": "70c569e4-9100-4444-9970-2cc3b89b1097", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232779, "uuid": "1dcef1fb-e7f1-4386-b6b7-00821ab88933", "value": "275eb6cd6b3069ea7ece58b0d6923752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8be7a2-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710227726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227726, "uuid": "1c230edb-8f4c-4e67-b133-d327aebf26dc", "comment": "Malware payload (GuLoader)", "value": "2d168b71bf3bafa63933f5d6588a6616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227726, "uuid": "dd184e9d-85fa-4398-b2b9-6d8b0ae98a97", "comment": "Malware payload (GuLoader)", "value": "729b11475868927dd9ec51e070254865d83c1fa2c9eeb54c0a35a57226f3b5a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227726, "uuid": "9a022237-aaa4-4b3f-af03-4bbde634d7d7", "comment": "Malware payload (GuLoader)", "value": "20dfd6c262a2ea392ff06b21b1e23d6ce51974b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227726, "uuid": "c5ce4cf2-5fa4-448e-9ff5-877b92b591d9", "comment": "Malware payload (GuLoader)", "value": "f26d3121494c5eb340f19f956f7dc11322bcae9d70e83ff02596bf6ce0aa5098300aaddc051a4a8c67d214315b9e3593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "UPS", "colour": "#972105", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227726, "uuid": "d53a4099-e88d-4ab0-968f-04f5f495f58a", "value": "T11B359DE5D9C04084ED692F7864761D39502FBE7EBDB8E94E8A0DB0613B736CB6432907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227726, "uuid": "9966d813-eb3c-4cc3-902a-c7b624a521c4", "value": "7ed0d71376e55d58ab36dc7d3ffda898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227726, "uuid": "c87ca6a3-9b40-4360-825d-59ffb7dd80a9", "value": "24576:UaU/LcNbKqeBSgS9dAEZ9AA76ZIe1wQiJh+:NoLc5KqeC9A1iJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227726, "uuid": "7c00c462-c79a-4002-84c4-1f8f0018c4a0", "value": 1094864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227726, "uuid": "d0c52a34-3f3c-4801-b2d5-aca3d561061d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227726, "uuid": "f8a54e8d-1653-4f02-a486-8e7aab284a36", "value": "UPS Delivery.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "056c030b-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232760, "uuid": "a33ed359-b2d7-4b32-81ba-132aa215f986", "comment": "Malware payload (Mirai)", "value": "d7c4782718799cbe62e89ec440b7027a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232760, "uuid": "665c1644-35ce-4d6b-94d0-789132149c2c", "comment": "Malware payload (Mirai)", "value": "743298d6e1f3e6e420500318f2d1a321998ce5f8618d2b4c85aa20da45edf13d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232760, "uuid": "adf6261d-0c63-4881-a420-a7caee900a24", "comment": "Malware payload (Mirai)", "value": "c64ccb94765790f5cf9a0537166e5b963ca91bf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232760, "uuid": "f99ab939-fcb0-49c2-b083-9a7983c66844", "comment": "Malware payload (Mirai)", "value": "c5c1fe3eab4dbfffba0b0ad9f4c94709851b050bcdd0637e271f5945b67042e40f9bfbe158ce720c155fd582d24a49e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232760, "uuid": "25ab9895-b5b0-4e22-9701-51061ccc9b30", "value": "T18C234B41765C0E47C2A65AF4253F27E083FEE9A020F4F589260F8B868275E77518EEDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232760, "uuid": "a4daae53-d266-40da-abb5-4f80a181de9a", "value": "768:FqkwvgVaz33B0bTGAX9PRskRpywFwyK7WhtdC5AkBPdtVABUksb5W7yyEN:yYVreAXV5ywFwyYyjwZN4/sQ7y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232760, "uuid": "3b1e2d6b-b261-4a8f-b1a0-51cf0c7d7055", "value": 50092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232760, "uuid": "8364a359-04a8-48d8-8cd4-c8a7467ffe7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232760, "uuid": "b612e9cd-623b-466a-8e8a-d9b88f142bc4", "value": "d7c4782718799cbe62e89ec440b7027a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe16fa64-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235754, "uuid": "7b23388d-fbea-4256-a765-f7303b766fdf", "comment": "Malware payload (Gafgyt)", "value": "353a2334ab8edc23860ba493e7dc648b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235754, "uuid": "40cf38cf-0976-44ed-b70b-c9956e0e8148", "comment": "Malware payload (Gafgyt)", "value": "749323cfb597821692df02dbd309c1331099460822b24663dae16a065d23d2ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235754, "uuid": "c440081f-b7ae-4f22-ad7a-d59c5b357ed4", "comment": "Malware payload (Gafgyt)", "value": "00baca913d3d7ef33ed352c37c505ffa4859215e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235754, "uuid": "b0e47d8d-4751-4c39-ab1c-3fd4f1546b03", "comment": "Malware payload (Gafgyt)", "value": "f9b4161ae04846865fc91d09d25f78aa3505452c7bec7aba412cff53dcc2826381ce4fbbeac3bd0d05cac963bbfd1273", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235754, "uuid": "1b4d7306-4b79-4da8-8ff4-1a5e3f9d69f0", "value": "T187E308938B66C636E7075AB5126FEF1143B3A0FF28C78A90F3499B7445C24CBA190B5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235754, "uuid": "ff59e1d4-057c-4a9b-a136-2206e96d64dd", "value": "3072:HE9rx5elUUrxUVVpSE8JqMPOltGDalhupRwWriH90PfNatph1:MxPaEx9MGlSekiH90PfNatph1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235754, "uuid": "589610c4-7184-4e4c-9b90-a3c6bed26f95", "value": 152241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235754, "uuid": "9c6dbd73-ba3d-497f-b42f-62bfe31a29ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235754, "uuid": "1a132889-0b15-4396-9e17-f85bab93e3e0", "value": "353a2334ab8edc23860ba493e7dc648b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b78ff0-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238532, "uuid": "066b6cae-e53a-4f88-b224-2ca0eebafcf6", "comment": "Malware payload (Mirai)", "value": "81fcf13f58106ad65b924e764020ad02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238532, "uuid": "ddc53894-94cd-4674-8c6d-0c64962a1bc0", "comment": "Malware payload (Mirai)", "value": "75fab1ccba01a9e1a755d9f2e869cef3c59cceb6d8be62894ed54c5133b9ab66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238532, "uuid": "a4b3da7e-3835-4536-b70b-45127344996f", "comment": "Malware payload (Mirai)", "value": "ae00f0c64cde69a30f031e946dc5b0d088f467ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238532, "uuid": "d6393d1c-9fae-439c-ade5-9ade5097b1cc", "comment": "Malware payload (Mirai)", "value": "a68acec3e454ae3e7e8168ae746462a9cfb2eaed17455b59bfbce3e630cde158078119165b0223afacc81f6c535a896c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238532, "uuid": "259a1262-6c36-48aa-b4c8-ff668b2d2947", "value": "T126532BD3BA55FEBEF40BE33E48D30725B230BA16459306626367399659373D4382AF06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238532, "uuid": "cfec586c-fab6-407a-a91b-8c4d48809850", "value": "768:PbCA4ai7DOPJLFR9JsB8B8y/C1JsHuixVqojTweOuQbRskAjvwRgIP:Pxa7DqFLo8B8y/+sHuix5jT/OhbRsNKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238532, "uuid": "92d0e2e2-5506-48cc-99ee-17bc803ef907", "value": 62490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238532, "uuid": "1a0edf04-ab6b-4d49-b864-b1f41966b93a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238532, "uuid": "4859d509-c7db-4979-b486-a57625d4e948", "value": "81fcf13f58106ad65b924e764020ad02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0517f245-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710227606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227606, "uuid": "efdb4ce6-8052-42e0-bcb9-f6a604534526", "comment": "Malware payload (AgentTesla)", "value": "41260c6f81f78ee61ccd078108ac0917", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227606, "uuid": "69a91184-48e1-4023-8a28-c583366d61ec", "comment": "Malware payload (AgentTesla)", "value": "76c88e4b377d41dfe161b376980bfb00e7f6de64ceb4176781c593a6a52ab903", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227606, "uuid": "ff03b7dd-1a7c-4dce-b498-62d1c90bd4fb", "comment": "Malware payload (AgentTesla)", "value": "d4ba2f476db10bbe352f5dc55b01e9c49e1a34e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227606, "uuid": "ae40e1d6-2003-492c-aa13-624fc44505a9", "comment": "Malware payload (AgentTesla)", "value": "fb0aa1e67e4762afaf91909d020e29a26c1904c11998ee8dd43170dc33da099f33e422c2a145c5fb7289a4179b4cafd3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227606, "uuid": "10a0aa25-5b6b-466a-95dc-1755457206dc", "value": "T1EB52051C54BE2FAB7A1B2FB0BC0334029374C55386B3C95DA6E83138F515898FE758A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227606, "uuid": "820a4d3e-b58b-481c-8615-8ef3e87ba4c6", "value": "192:HQymqKcgfBbe9/CplkEQOG4HfZM9mmPX70+rVz3Q/ll3DnF+Boe4whBXsivvXq:wxG/wQ0wPLqv5IB2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227606, "uuid": "d5abbc0e-1177-4741-9aef-ac903583c996", "value": 13828, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227606, "uuid": "b1ba2386-f863-46f3-a7c8-7978b875736c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227606, "uuid": "b93b1d77-3fb4-4417-acb0-73f8aae689be", "value": "SIN2400136001370224.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "129fc699-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235359, "uuid": "545fad54-b845-4a2d-a6ac-34420f4b34c2", "comment": "Malware payload (Mirai)", "value": "c144565816d85f480daa9d196bdea6ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235359, "uuid": "ee35e6e6-9e29-41fa-87f7-438ee85e22d3", "comment": "Malware payload (Mirai)", "value": "76e656a5f8aad6e82eb8c1056014b9d3bfa93212f9daa8b2dc30f81a55fc0334", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235359, "uuid": "16eb92be-d217-4a72-b026-b63f64ede552", "comment": "Malware payload (Mirai)", "value": "ace1551f888779db71c259f1be3e46f97e927ee3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235359, "uuid": "7431aa0d-3243-4b84-86c4-cb3e6d534b4f", "comment": "Malware payload (Mirai)", "value": "f531c06bf98a7d2b189860ee891a0eae91770d1bd587ad9ce7d11eaec0f4b954f335fdf40d1afc9f42124c9b4a5d2782", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235359, "uuid": "d7a24685-ee01-46fc-a50d-b5685f2ad61d", "value": "T192A34DC1E343EAFDDC0A06716067FB36CD79D6B93219E982E394DB36B821202C515E9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235359, "uuid": "9c02190e-c04f-4775-98e3-0b7c70ea8acf", "value": "3072:FZqdnWyOdUncjG39RN9HMogHCU9rQIlx9HkSr9GbFWt:FZqdAdicC39RN+ogiU9rbljrt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235359, "uuid": "9947e655-72ff-4999-a4ba-8b9575ebb951", "value": 99536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235359, "uuid": "dde23a02-0256-440a-899d-f2a99aa1e9db", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235359, "uuid": "6dfef4ca-81a5-45fc-8acc-3ef2752697bf", "value": "c144565816d85f480daa9d196bdea6ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b18b356-e058-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238139, "uuid": "ae699dd8-569a-46b1-a9f8-2c3e26940e76", "comment": "Malware payload (Mirai)", "value": "89dd6975db3cfb4a2775e45ddce303ed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238139, "uuid": "84c5c62d-3c0e-442e-9bab-d660c6453995", "comment": "Malware payload (Mirai)", "value": "7732faae762581f77e1d4923540cabd1878e2c96fe9386ac74f64f424e5bf31e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238139, "uuid": "8a8db627-3368-4a7e-bc64-a9a92e65a002", "comment": "Malware payload (Mirai)", "value": "6888e2fb5aca801eeb3bff9efea0897d02c39bb6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238139, "uuid": "186101ec-ab99-4213-9f71-e7cf05fa1790", "comment": "Malware payload (Mirai)", "value": "b3e6cce861e12c339a138c2a6d50eb7e8c9fda8f6e33e796af233f367133cd0e81dfdcaf470e9e5ca5bd6ab0aec7c09f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238139, "uuid": "d5b9fd80-3c19-4418-a017-b74b9ef5a3c5", "value": "T1E49353397E61BBBED67C82300BF76F70C346219236A19341E26DEA185FB124C5C9E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238139, "uuid": "040cb0c2-ec62-4bb6-9fbe-3e2fdae17078", "value": "1536:qBevWRyetnAks/A6r3XS0ykGiD6/mvFDmgYjdXfh4ikxRwH/e0qUbG:zviVh4BPQe0La", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238139, "uuid": "76b9bad5-0bfc-4ebf-af9a-118e91d46d65", "value": 92913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238139, "uuid": "65dbadac-f99b-4c3e-8fd2-6a9b778f8efa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238139, "uuid": "e5feecac-b03f-4de8-a190-ba194b8b2cbb", "value": "89dd6975db3cfb4a2775e45ddce303ed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0436e0ce-e07c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710253374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253374, "uuid": "825f5407-4f7b-44f5-8240-a797e6b82546", "comment": "Malware payload", "value": "cdf63db0018c07734811b9c0a2f500e4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253374, "uuid": "c84900a1-61d2-43c3-b22d-d2e030c1e59d", "comment": "Malware payload", "value": "78f0c07cdd949d10e3bc5ff0ba586fca955508a8592bcf934bb748da7af10783", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253374, "uuid": "ad716f9e-1930-4a96-8f03-994024b90ab1", "comment": "Malware payload", "value": "8d51c45026f896cfebc48859752e505f5523bb06", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253374, "uuid": "2f815e8c-fa8c-48ec-a7e3-e7feee33de35", "comment": "Malware payload", "value": "6e62907400ec2691aab5b9239da76eb80612dc118ae21e863e9c27745b814adf8280019d34b7a8472759722dc17623c0", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253374, "uuid": "58a538dc-75f1-488f-b7d2-e8d8160eea6e", "value": "T10094AC322408DCF47B8D3B3EC442AAACDA8EC45A879B460DF81A54D2FE94B5D83455F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253374, "uuid": "0c03a0ff-5593-42be-98d8-4cc45c7c9cdd", "value": "6144:Ai+nFbuytKa7GqhBFvUqHTVpmRk9mG3sEeY3n+edaN3QtZAL0kqRuZbsocNi:YbuoSEBFvUqHm2mhEe+zQ6yIHobNcs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710253374, "uuid": "e30b09e2-05c1-4b62-a572-cbaef625ac66", "value": 438840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710253374, "uuid": "018f2578-5c6c-487f-9ccf-fd21813ec845", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253374, "uuid": "b1b450c1-b264-4c12-91b4-5e1755c1fafc", "value": "Idiocrasy.pfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15b75e0-e067-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710244672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244672, "uuid": "1fcea291-f471-42a3-8c69-8698cb279ffd", "comment": "Malware payload (AgentTesla)", "value": "bf55b803ed8f7fe4ffeced1f67e24831", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244672, "uuid": "b5b0fadf-31d0-4d59-b136-404e394adacc", "comment": "Malware payload (AgentTesla)", "value": "7910b03605ec48755430556c949355a8011277c9ce3504649120596e8e30c81c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244672, "uuid": "7d971a1c-444d-4599-9540-9922ff7ceda7", "comment": "Malware payload (AgentTesla)", "value": "e69c40ad8fcf908ed50c8f14e03b2b0e4409df9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244672, "uuid": "00c0487f-58ee-4523-89ee-b02eb3238c54", "comment": "Malware payload (AgentTesla)", "value": "5c7fb769631c8cc0f054671f2d18e6bd69e89f644315ac86f59525713e0f0866dc962cdc882ba15d36f8524f107748a5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244672, "uuid": "31ab0af1-6d3b-4a93-843d-236999683c58", "value": "T16FF4123FAE09E959C23C093B44321AAD83B5F1525313FB7B4CD4B3B0AA567F50A46267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244672, "uuid": "8b7a1447-05c4-46c0-934a-0296b106a10d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244672, "uuid": "c7377e79-1f6f-42ca-af82-0504be20d8ab", "value": "12288:BIejJLbois3QZTLdgdNaGO1Dk/9/BDxj+Xr2yJJPL9z79I4sj7vKEiW:XjJLb1+uLdgdNyIF/BFyLTLXs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710244672, "uuid": "3c385562-6433-45c2-a2e8-3f5a1af35939", "value": 752640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710244672, "uuid": "136dc2fa-00de-442d-80c0-fda36274821c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244672, "uuid": "3b5b8925-b4aa-48a7-ba18-ae537baee6b9", "value": "rgbxxxxxxxxxxxxxx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba7945a-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229925, "uuid": "09031803-1dbc-4888-835c-72aa4d6d0a34", "comment": "Malware payload (Gafgyt)", "value": "727e0c7128087805ea9f85da49eb6a0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229925, "uuid": "f216496f-88ba-4970-a601-0f7efeec2c93", "comment": "Malware payload (Gafgyt)", "value": "791729ebbdfe35ea27215c707cb1d804c1952bb1704dda9e80013e8262dbf80b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229925, "uuid": "bf125579-ef16-464a-9adf-89b299a5b90c", "comment": "Malware payload (Gafgyt)", "value": "11f3a381a316233c60f970035d0dd77b0f52b51d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229925, "uuid": "ace60c82-7427-4647-9ed1-e6e2d0ffd8e4", "comment": "Malware payload (Gafgyt)", "value": "aede7b69f1eb0c3fa0d43909d350731a9778ef628f9f3a57ea7dbfd7cda4935f1617cbcbfd709d5fd25aacfefd9b0cbd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229925, "uuid": "67b7ead5-00ce-4d34-a39e-f88930466ed1", "value": "T1F60497AA3A606B7DE198877147F7AEB0C2A878D72A92D342D22DE6045F7034D1D5F370", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229925, "uuid": "899f9382-07df-4b42-bc55-946a63e5d4ad", "value": "3072:4olavYAtNLSXBZ+e4Smfyf+lsqDpyi88s:4iadLWx4xjyf+lsqDpyi88s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229925, "uuid": "11f1b055-e66e-46fb-9bd9-c95cb5b5a94c", "value": 181745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229925, "uuid": "0a022f63-be96-4e41-b97c-4dc6267bc27e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229925, "uuid": "d1424235-4fb8-4f34-9bc5-d35be5a2d854", "value": "727e0c7128087805ea9f85da49eb6a0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e5cad72-e038-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1710224185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710224185, "uuid": "3c506042-027b-4287-a7a8-a471e2ca8339", "comment": "Malware payload (Stealc)", "value": "32d8198114cee573fba8ace54e53e18e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710224185, "uuid": "cca57386-1b3a-4e05-841c-15491f4c0ab2", "comment": "Malware payload (Stealc)", "value": "79dfdba5d752dd540e73a4578e275ac77b56595c8eb407ea2102531a67755573", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710224185, "uuid": "855a24ce-724a-4e9a-8eeb-42a8e4ba6406", "comment": "Malware payload (Stealc)", "value": "a67cbe0fbbdabce0c32cafe24d8085843443fe31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710224185, "uuid": "b3f6c25c-3cf1-485b-86d5-103914706b5a", "comment": "Malware payload (Stealc)", "value": "fd538fa95c9717305c9a81ecd8f9efb703cf4cb3d017232d693b924165be73688147ae8af3d9ead539ab53ada2a0d644", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710224185, "uuid": "4a886149-d4fe-4b7f-b8eb-b02cd1983b02", "value": "T1C1A52308F5168EB2DA4229708E1BF3BF24317D60ED129E47FEC61E6B39B17849791346", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710224185, "uuid": "f1819b16-5eb3-4b69-9e46-616b9b4b215e", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710224185, "uuid": "18ba7d3c-a21d-4bab-ba14-fa0a07acec6a", "value": "49152:LK4oyE6/uz97Jy+TnwzovfdMPd6wBY1BBq1wSwHDsp:Voy9/uhVyUnJMFBv1wk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710224185, "uuid": "89b8bf3f-9982-4ff6-ab04-fd4323cb508a", "value": 2146398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710224185, "uuid": "8d8f8f5c-fc3c-49d1-88c0-57af0922f9b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710224185, "uuid": "43ed0374-b662-4483-9714-0558ff6b4185", "value": "32d8198114cee573fba8ace54e53e18e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82077018-e058-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710238123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238123, "uuid": "0dd92469-9cd9-4758-8c99-32344c737fb3", "comment": "Malware payload", "value": "02d41aa95dabc56ee4ba74aec95e54e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238123, "uuid": "268bf73d-c017-4525-afff-2fd1445a6a98", "comment": "Malware payload", "value": "7ad9623c6f8dc291523e606284d5313030f8d869b8e18b80a917ba2995335a95", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238123, "uuid": "70e37787-cdbc-4814-98ae-e85fe05e75ee", "comment": "Malware payload", "value": "11e4d5c1fd06926a1254bbb40ff0509b0ce4e1fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238123, "uuid": "e3df5700-c4d3-45ce-a667-7df314a1b560", "comment": "Malware payload", "value": "99c1de821bbbdbc629ff6154147ccd58c56cddb4ab6f057814770d650a991a20a01d56bfe9f7ebb45bec24bffbae1f34", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238123, "uuid": "ae6f92fe-221e-48a9-949d-6e52de76aa93", "value": "T1B6547D10F182C072DAF215321979AB72866DA8340FA456EBB3D40E7ADE703C1AB35F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238123, "uuid": "a07fb949-05f5-4876-ad56-1423013e2e40", "value": "606435991ad7a726f5027386af3a3f17", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238123, "uuid": "a4696cd8-2b22-425a-b65d-3c6aa6619c79", "value": "6144:bT8Yf9OWtMAjcUTQgrJug7lUlCkD8pubIBtDMkCFJ4JFgaj/lHilAOE6o3t:k6J9xgYubIBQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238123, "uuid": "64a5a586-a73c-4c7b-896c-1ea2d7127a7c", "value": 299008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238123, "uuid": "f2575872-6f6e-4a42-aa43-498e43563800", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238123, "uuid": "676e11c6-1679-44a9-bd6e-545c4b18912d", "value": "02d41aa95dabc56ee4ba74aec95e54e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4edc353e-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235890, "uuid": "d7828b82-7569-41fe-bf71-86118d018d9f", "comment": "Malware payload (Mirai)", "value": "51522ab04e587ff279b6c2e4cbc60ca2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235890, "uuid": "aaa99dc1-5a89-407f-bd1c-b7c28e1ba0db", "comment": "Malware payload (Mirai)", "value": "7c2f9ba093d75971e6dd21e4d3cacdb80ae6d241290b9cc7db7ddd22ae4aa626", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235890, "uuid": "8e65d075-ca6a-4b5e-b5db-97b4d77073cd", "comment": "Malware payload (Mirai)", "value": "feb3d37445f1d300b9813c140a8ebcb77b987512", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235890, "uuid": "c901feba-7e4a-4a3f-ac15-c15b42d529a0", "comment": "Malware payload (Mirai)", "value": "ae9c73b3e6ff6a7b1486ac7e01fed9ab10429808277d9a1f060c56a97c73b703e2c9d8b0b9714eb6bd16d0bacced28df", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235890, "uuid": "59fba8e8-bb86-4e9f-b504-5e793ce20633", "value": "T191D32A05B30C0A47D2632EF43A3F67E093EFDAC121E4F640256FAA8A9172D365585EDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235890, "uuid": "2c6de855-4454-4a05-95c6-7651c57af4e7", "value": "1536:6ApYWLEkYvb5Ip1+P1kyxgxpzvTLLNcsvtggg/LPMvgvAVIRc732d3qSC5Ggkm7X:uw1mkyxgx97f93gjPMNVom7jjOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235890, "uuid": "9013d81e-bee8-482a-85ba-085667753779", "value": 132344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235890, "uuid": "8520eca9-a6cb-4ffe-9c02-479bfc903933", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235890, "uuid": "956642f7-84d0-4a32-bc09-ab67b3395f51", "value": "51522ab04e587ff279b6c2e4cbc60ca2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a09a320-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235828, "uuid": "0a73ec09-7064-48da-9f25-2b9cb5ab6b3c", "comment": "Malware payload (Gafgyt)", "value": "ac6b387503db71cfffcffe84a4f5782e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235828, "uuid": "b3540575-5c1c-43c4-952d-76c0154da16e", "comment": "Malware payload (Gafgyt)", "value": "7d3e3a6d427265fb7f08f24e0e3ce6f3525c062c7b116ecedbdc611cfadf0c42", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235828, "uuid": "7aaf9fca-3cc5-4548-a211-afde8a470da5", "comment": "Malware payload (Gafgyt)", "value": "4b30c1fe7c67ddbcddd51ec1e52dbc4a9bb230df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235828, "uuid": "34cfd8a8-a07e-425e-b65b-8c0d345958c6", "comment": "Malware payload (Gafgyt)", "value": "f6323ad582ead821dddcc5522d589b8aa78b4d25002a1759d38322acce97e6580bbdc0d0eebf7e144cbce01eb85ebff8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235828, "uuid": "eedf9287-1f20-4e6b-8e19-382505d259e6", "value": "T1C20451EFFF1843DBD64F02B4292673E00FE89561139051C2F5999E402FB3279A92B6B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235828, "uuid": "878dcd70-b2a3-4494-bbb8-cd3faee7b83e", "value": "3072:J5L/8hXUJnq1fMV6adonSRl+3jyhtOjjWtJ2vi7UUfWSDP8zumTkAreB0X2cNGUu:J5JaBwhsTOu1r49KDsPHs0aozetKNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235828, "uuid": "1bb04902-745f-4ce0-abf1-b5770169e812", "value": 189761, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235828, "uuid": "d18f1b94-df02-43d7-b34d-8437cd685e27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235828, "uuid": "90243ef4-b398-4a20-bd0f-bc84d9012444", "value": "ac6b387503db71cfffcffe84a4f5782e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "943d7ba4-e046-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1710230423, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230423, "uuid": "9c74a1ef-971e-4c02-bccd-92599c258aa4", "comment": "Malware payload (DCRat)", "value": "74582deec90e9e6cbb177747f118c643", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230423, "uuid": "dc5361e5-acde-44b5-b866-f7e21fce5d9c", "comment": "Malware payload (DCRat)", "value": "7d78076dac303316f0329e628df256a55b07bbea46ed03097e7bd33a6e52085d", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230423, "uuid": "c34af600-22b3-4717-9762-771594475689", "comment": "Malware payload (DCRat)", "value": "c3bdfe4c86c51e3f0b31e299b44811607e9c6486", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710230423, "uuid": "87b87074-527c-4dc4-9aff-aa53303b7532", "comment": "Malware payload (DCRat)", "value": "63c6666fed8d83b4a34648c981c6973875324b2bf7f7628d1c8f0696693bb5a4cbd254f2e13c0509542254a980f6faf5", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710230423, "uuid": "69517699-563b-4c23-8581-e5943450d825", "value": "T198453B127A47CD12D12D163BC6EF409847B8AF407E63CB9B7EAA335965113A35E0E1CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710230423, "uuid": "08640afd-4321-4b14-9a41-ea8596210c44", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710230423, "uuid": "fc6bf4a9-0fec-4f81-abe0-02401cc2cf73", "value": "24576:B2G/nvxW3WVn1U2mELngQfXOcUBP1+efJwP3R+4G:BbA3IDmAnzXOcSh9r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710230423, "uuid": "6182da6c-2bf8-4810-8fa0-fca6c54faacd", "value": 1228017, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710230423, "uuid": "7555624a-bf08-4c38-a0c0-27f1e127fa3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710230423, "uuid": "ca4707d6-ea0d-4391-b55d-d93aa50d3326", "value": "74582deec90e9e6cbb177747f118c643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b257b16-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710238568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238568, "uuid": "42504b27-248f-48dd-ac7c-a861e769efa2", "comment": "Malware payload", "value": "926e633033fb462904853e8b9a4ec7ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238568, "uuid": "966b460f-ad15-4a97-a877-3be4125024af", "comment": "Malware payload", "value": "7e371c07bff4263082b0b30b82322fb48719bccc07d2fc079af7ae0f1f3ec42a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238568, "uuid": "fe96d4ab-726c-4dc4-87f7-240292b43894", "comment": "Malware payload", "value": "d7625644197028124f09ee756d5855342719a5ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238568, "uuid": "3566da01-b3d2-408f-9289-b1385cac6297", "comment": "Malware payload", "value": "a17f1d18910e3f4178aed93524f593c689e29e909afeaf739e4b657dc624760aa7bfad86d1974f9968368e5b0b9a1d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238568, "uuid": "1c2bced8-8734-4658-a325-779e918539bc", "value": "T12A868D07ECA146E9C4AEE234C9A292537F717C491B3123D32B60F7786E76BD06A76344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238568, "uuid": "ea08b93f-21ab-4d8b-b51d-1c520ae5fd20", "value": "c2d457ad8ac36fc9f18d45bffcd450c2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238568, "uuid": "71ba6284-a07b-4560-b2f1-44cdd0e9625f", "value": "98304:8hFX6muRiwcE4BjJuL8rbNTe+SVhz1nvaKipYuJgmBzM/S:fmuRjej13NTehzz1nval16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238568, "uuid": "fdd46298-c30d-44cc-98a5-ac3616646544", "value": 8612352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238568, "uuid": "05704a18-0aa1-4a2c-ab0a-723e55dce769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238568, "uuid": "260462a9-2afa-4ab7-8e27-4e6780c8aba0", "value": "mspvc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a93fdea-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235856, "uuid": "dc58be0f-529d-4b1d-b012-c659fb18434e", "comment": "Malware payload (Mirai)", "value": "d2901faf46e015900967d750bf30ab46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235856, "uuid": "c36b2909-f960-4176-8f48-de8d5b3f4933", "comment": "Malware payload (Mirai)", "value": "7eff9ca53cbb43deec86852265eca849c804b6f1abbdea0edca98b2587431904", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235856, "uuid": "8fb545b3-3ff6-4244-941e-bf91e28ed55d", "comment": "Malware payload (Mirai)", "value": "ecb7c92b618ac2b231e6cc587e0e4b169a7a92c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235856, "uuid": "001f56fd-f6cc-4e8d-bc12-9e4ed05915a1", "comment": "Malware payload (Mirai)", "value": "bc32639d8f8ccc9770147ddf66d35d07a47b5577b4dbb59c62c8b69f0d54b9266f7e40988e9aaba811896e5d08e2c55a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235856, "uuid": "778bdfaa-4836-4b49-aa88-c1c25d8a2e29", "value": "T1E2E30A56F8819B12D5C111BAFE1E124E37231B78E2DE72029D246F747B8A87B0E3B905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235856, "uuid": "1835fcd2-7896-4405-9f44-195444340967", "value": "3072:ZCOCUpBAVDXmk4wzgqa6mqeo/bPUCm3giWRjc:ZCLOADX+wz3aJpl/3giWRY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235856, "uuid": "de84dcb2-e288-4a80-9e82-25aff4c9abbd", "value": 143260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235856, "uuid": "3d68f34c-ac6e-427f-a3d3-292ac33fbff3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235856, "uuid": "28563ba0-5406-4277-93cc-b30261889453", "value": "d2901faf46e015900967d750bf30ab46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2166095c-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232807, "uuid": "c9871bf0-879b-4238-b94e-22df98e96e24", "comment": "Malware payload (Mirai)", "value": "1aa85b39469021dd5b5e97669889f688", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232807, "uuid": "f2557cc8-3dac-452f-bfcb-0a856288514a", "comment": "Malware payload (Mirai)", "value": "7ffe779eee5cf76730fd36b91a0ddf4f79b4cedd10b6b74cb7891d22a83a0c8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232807, "uuid": "a00ca203-4958-4cf9-8429-abd4632eab20", "comment": "Malware payload (Mirai)", "value": "c94671d0baf6617b5e82a09cbc0f0939ab4a8225", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232807, "uuid": "619dd205-6d16-43c7-9f7b-53997b17d5bc", "comment": "Malware payload (Mirai)", "value": "0e26d07366c87808a5de8aaa3ad19b530b4c5a00f0eea1220aaa2e128af3060073d788614371ae6947d797368efa4df6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232807, "uuid": "d8d62956-c8e1-431e-aa33-188dc796a73c", "value": "T16D335B22A9791E2BC0D0F87A62F78728B2F5070E25A88B4E7D620F4EFF215D0555B1F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232807, "uuid": "ceb43f6d-385d-445d-9171-c0f84ff8bbb2", "value": "768:M7U+SjoHq9+scN2wNxyxnu3Vt71squLXuO+hhQSDF29:0U+Sj2S+scNNxyxnKT712chO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232807, "uuid": "30e17d02-d416-4197-90fd-acfb789b6729", "value": 54724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232807, "uuid": "ce7a9d49-2d6c-4736-98b2-ec68493f79df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232807, "uuid": "b0355b4d-3691-4430-9b53-076e2cab10de", "value": "1aa85b39469021dd5b5e97669889f688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb3219f8-e05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710239186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239186, "uuid": "3d2c303a-8f8e-43a0-811b-74b6364a4042", "comment": "Malware payload", "value": "3cd812c6891bc3eb32f42c49ec52f78a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239186, "uuid": "d2a80208-f997-418d-a159-d103e73f8402", "comment": "Malware payload", "value": "803d2c20c95690fb3dbbef19e788d4632c5bce99faea979003014afbf1334c58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239186, "uuid": "05e921cc-01f1-4ff0-83c9-dc33ab3c86f8", "comment": "Malware payload", "value": "0203a377e71cbea4d6b4715128f384eb3570e60f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710239186, "uuid": "a13d64ef-9b91-495c-99d5-297feb6a95ed", "comment": "Malware payload", "value": "a58879069bafb2df7f11c67fcc2d01ba92497ddd12def7e5d1acf9d77bb2e950cf4f1e86f31ce5f55467ceb542189f25", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239186, "uuid": "f28b98be-8ffd-4d1a-93c6-43eba92158b8", "value": "T1FB95AF43B35502ECD06AD1B94B66DB12E77338811B21C3CB23A4A2A65FD75F49DBB390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239186, "uuid": "f226927b-d545-4eda-8311-95ed2b8971e7", "value": "222e62bd6dbb2972c71d5c262e988741", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239186, "uuid": "13b1c763-cd58-42fb-9002-c41b57aea0dc", "value": "49152:lbDT392fPdbA6zi9a0q1u6e7AxX4TogJnmjs4RxkcF5w:lbDh2I6EhYxkW5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710239186, "uuid": "9d3ce95b-ef77-4a4f-bd77-96bc746b4b4c", "value": 1974272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710239186, "uuid": "ef6df3ca-29b6-46b5-b0f2-7f46a5da058f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710239186, "uuid": "7008e6e5-5651-47ff-a14b-e49a83784897", "value": "SecuriteInfo.com.Variant.Cerbu.203511.29180.28624", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13518702-e0ca-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710286900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286900, "uuid": "b884c0cf-4de4-43d6-ad80-b03ef3503b2a", "comment": "Malware payload (RiseProStealer)", "value": "c5c6a2fc004f12c9fad6fb83334f1b6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286900, "uuid": "cefab0fc-69a7-45ca-944a-c0725eb05f7e", "comment": "Malware payload (RiseProStealer)", "value": "80843ae7c4678ee88976e678d357cfdb95fc5d7542e85d7f8f273ef06333a2e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286900, "uuid": "a6c1adb4-2f91-4daa-84e5-fe3f513eca45", "comment": "Malware payload (RiseProStealer)", "value": "3d761784f28fc07e5684200d618ae34833ef511b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286900, "uuid": "d0e100a0-1d84-4a05-be1a-ac5c6385f2ab", "comment": "Malware payload (RiseProStealer)", "value": "c0e650f752b7796f17cd25c9e33fcd4f479abe272619ac163df89c92d7084a8a7589278a03d3a403f73ccdc138b7635f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286900, "uuid": "4a59739f-c41a-4ab4-a95d-3c72df92e940", "value": "T1CCE56CA2F545B2CFD4CE1374912BDDA27A6D43B9472409C3A86C74FABDA3CC115BAC24", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286900, "uuid": "146d5114-7228-45da-9efa-9c5d68455fae", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286900, "uuid": "c6b42953-7c91-4487-83f6-186ce4c6c534", "value": "49152:KKH3PgaWcIm36ccDrd8/7a1B7viLA+05q4fCBE35M:KKH3PggIZnd8/7a1B7viLA+03uEu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710286900, "uuid": "fd89fc1e-dafe-4558-bd86-039fab6b330a", "value": 3082752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710286900, "uuid": "9d9456f0-1280-4200-a3ff-8ab5cefce673", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286900, "uuid": "03849f62-f9f7-4821-b5e4-6f9e5ee2582f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93b3146f-e072-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710249320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249320, "uuid": "f100b3ac-3607-4616-8045-9bc20fe50634", "comment": "Malware payload (AgentTesla)", "value": "ef3baa8498780854ed58a30e84921384", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249320, "uuid": "bec1ea5d-373f-4a51-99c1-d030ceaaa91b", "comment": "Malware payload (AgentTesla)", "value": "80f85a304c4c55f89fcfe941a5bfa1923a766dca4080f9811535c4c51d90da6c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249320, "uuid": "629cbc92-5695-4171-b702-f8516a59f623", "comment": "Malware payload (AgentTesla)", "value": "fcabd5b10510255995d57499a1f3b0caa8c5f0e3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249320, "uuid": "7bfc0fa9-2631-4209-987b-607f032894cc", "comment": "Malware payload (AgentTesla)", "value": "56380dec96a20baa36c06baa08b182e6a935e9858cd41cadbc678e959e962b3f27c3293c6d21d98d25a00cdda839c010", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249320, "uuid": "19421637-d8d7-4069-910f-362fa8d0714e", "value": "T1B2F40184347D2E23C5B8F5F85079102843F6761968AAE7EE0DD736CB5AFAF400664E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249320, "uuid": "fcd00b28-0d83-4545-b39e-52840e8a70bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249320, "uuid": "ff67b22e-4e6a-4eca-b138-b995494d5423", "value": "12288:fdsJTENl3lZP1lTrxtIy9+gRkq7ScCwaC4TUyEDXkssw:2xENlnNl3xP9+g2cCwaC4TLps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710249320, "uuid": "80f752ba-06d8-4263-bf5e-baa4c19131a0", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710249320, "uuid": "4a5414c5-708d-4913-93fc-8068c4d52448", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249320, "uuid": "ae4d0fda-6854-40c8-87d3-0bde49b89c37", "value": "quote 030214839A - Toron Alim..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d87d90-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235398, "uuid": "f503b162-04c9-49f5-8a81-6a1f260e39b1", "comment": "Malware payload (Mirai)", "value": "2c67f5a0e5f30c9c962888aa871840fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235398, "uuid": "7d62b074-561a-410a-a870-fae3a3767fc0", "comment": "Malware payload (Mirai)", "value": "83e32c98f387022a00426f6eb279bb6ebf86816be32f81cac12cb27f7049d364", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235398, "uuid": "74f82301-989e-4dbb-a128-06d0e5185301", "comment": "Malware payload (Mirai)", "value": "74de41d697879702f597592bc92c32cfbc1110d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235398, "uuid": "c808d13d-c09f-4fc4-b50c-ab49b815cda5", "comment": "Malware payload (Mirai)", "value": "4fe02eba514827fab137ce84328f08b279ccee392b0060178b2217ba60234a6b5c151323ef35fd322c0c59a493bf6c8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235398, "uuid": "bd0b37d5-83b0-439e-ac41-3337543d60fd", "value": "T130E38DABBB8B0264C45301F00BCF5B9EBE9325909EAFC9E36D79B53B64391C78511B50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235398, "uuid": "07959216-5781-4e94-a213-4cbdac96350d", "value": "3072:mKgiEsEJXWe94kTLs7ShTu+bVe7pLRkgtLq:m8aJXBnLFT9ZmVLq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235398, "uuid": "5f8a7701-0c5e-4f84-a1c8-1a8e1fb09c7d", "value": 148892, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235398, "uuid": "372f3644-ce5e-40ed-a9d9-d5af2d753d60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235398, "uuid": "2e4d30b1-ce98-4291-82d7-6286a6c33277", "value": "2c67f5a0e5f30c9c962888aa871840fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9f36e5-e04f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1710234140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710234140, "uuid": "7f1be679-d15f-4356-80a1-2335019e8906", "comment": "Malware payload (LummaStealer)", "value": "4b89fef89114efb69c1b2005c629d303", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710234140, "uuid": "f868f4d5-99e5-4bea-a965-96bbd53229c1", "comment": "Malware payload (LummaStealer)", "value": "83ea761d6145f0d38b46c3d85622ae7f4fcf1974b8118391598dc59470319cd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710234140, "uuid": "94014cc2-2e79-4904-8a8d-b2abdfe45917", "comment": "Malware payload (LummaStealer)", "value": "b03aeddee413357b2a9bad2e408c59894daaea9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710234140, "uuid": "e3746f84-1602-487e-bac4-1d3f65de1750", "comment": "Malware payload (LummaStealer)", "value": "75cf3fb5b0bc91d05067c62748dbcc90b15cac414de77843e79a932fa50bb102a4ee3c6d4455addf18516f4a12135534", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710234140, "uuid": "5770ce72-20d8-4eba-83f5-522cd9f10304", "value": "T15CC5121BB7994E12D2880B3BD0DB8902A3FA65D57113EB19788423C54D4337ADE5A3EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710234140, "uuid": "3c6df8ec-49ce-489f-b147-49ade4551868", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710234140, "uuid": "577010ab-4fd4-447d-a13f-dd739902d552", "value": "49152:qySElN35h08+hTAYMyC6I29RduqkE9MKwL0+XM/Wk:qANyfH9RdRabM+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710234140, "uuid": "839453b8-8c2e-4d81-9caa-5c295f92717e", "value": 2515080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710234140, "uuid": "6846e939-0399-4cc0-8151-55386995ea80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710234140, "uuid": "38fc2adb-e739-474a-ae46-1d90899cf736", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a75e5be-e07b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710253170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253170, "uuid": "648fff9b-fee7-4a76-a45c-0be8a9f7df98", "comment": "Malware payload (GuLoader)", "value": "f5dcd8d6e15a1893bfbde898c31aad3f", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253170, "uuid": "f730b399-4505-4e14-945c-1231d0619f5a", "comment": "Malware payload (GuLoader)", "value": "840da5eb639d739bd4e957e0e020821b8436f3e1816bbcb3744a8ae4960e2e9a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253170, "uuid": "94ef28c5-ff59-47d3-83de-565e1fff42cd", "comment": "Malware payload (GuLoader)", "value": "745733e2269b92e625d705e2c9da8b0f4b46afed", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253170, "uuid": "49e63a17-c802-4400-baf3-64b8c8d06393", "comment": "Malware payload (GuLoader)", "value": "93cfc36a8d39aeefc5376ea6de59f93b7a505ba5618f096f712062346b3e3f974380df2a136b8ca10136d566b718a8f3", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253170, "uuid": "c6c8f3a3-8377-46bc-868d-fd68c2961f26", "value": "T12FB1D00517F90A61F2B34F795CF766318AB6FC25EA258F1F0099038D18A1610D8B9F7B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253170, "uuid": "924af772-8f0d-4dfb-945b-5036a55dad43", "value": "24:8WEeO2d+aV9pyAnc8Pkr+/4l+nQ6wY4XYBdd79dsVvNyvNeab4QCmo:8WEP2zncF1dY4IBdJ98KcakQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710253170, "uuid": "047fbafb-bb42-4054-ab3b-6c0cc57c5e3b", "value": 5139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710253170, "uuid": "469105c7-83aa-4d24-862e-3ee428b87518", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253170, "uuid": "893de83b-d4ab-4e6a-a848-ccfc56ae45a0", "value": "PortnoyPatti22.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270a2de8-e0c0-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710282638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282638, "uuid": "d53dafa1-587c-4594-89c8-5497621c13a3", "comment": "Malware payload (Mirai)", "value": "22a66bbe084efb0e7e33700afb791c98", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282638, "uuid": "4ea2b71a-12a9-4f60-a202-fa3602bad008", "comment": "Malware payload (Mirai)", "value": "8443219a78548f6e2c5643bd1d268da2f8349f757d226d374e3b2b1e590f62b0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282638, "uuid": "e26fc91d-970d-41b8-aca5-ba30fe67fb01", "comment": "Malware payload (Mirai)", "value": "0c754d52d1ae002cf696176103daa5694c513d96", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710282638, "uuid": "67a16bf7-cd65-44f2-971f-a10a0b7e32df", "comment": "Malware payload (Mirai)", "value": "467f3c48937d9dbd8bc752b7502e28e36d67616b83b7bbd3228a6fd75cb9763f40ff355cd6ee846e2f2a393218f385e4", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282638, "uuid": "d05ed562-f72d-4c8b-8639-46bc131c95b1", "value": "T17393C519BB511FF7D89FCD3746AC1B02388C958622A93BB67574D828F24B24F15E3CA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282638, "uuid": "082666ac-871d-4268-818d-3acece006e5b", "value": "1536:NUYHi4GHWD+ABUqG3N4SfxMW4ZXH1RQVkwJDwbZnL:NUYHfG7p4SfeW4RIDwbZnL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710282638, "uuid": "ebe96e11-a8bc-44f6-b08d-17387cbcccf6", "value": 88844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710282638, "uuid": "9fb6ae74-a662-4acc-8732-eb10edcf0b68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710282638, "uuid": "d353b20d-fc38-4c43-bebc-ab7d0d76ba55", "value": "skid.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "159667cf-e07f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PythonStealer)", "timestamp": 1710254692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254692, "uuid": "73a787e6-59a4-4559-aa1c-71bbf9887064", "comment": "Malware payload (PythonStealer)", "value": "7d6fe4b7d02ef38ae9345c8069147aa4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "python stealer", "colour": "#3AD32E", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254692, "uuid": "fb5b3b08-314e-4801-8f9c-236b141a1722", "comment": "Malware payload (PythonStealer)", "value": "84bdc132666663f119baeaa1e6893c6c80203e18ad6c85b0b7e4216dac5fd11f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "python stealer", "colour": "#3AD32E", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254692, "uuid": "d8c2e7eb-703b-4215-8206-88da70ca2427", "comment": "Malware payload (PythonStealer)", "value": "80f0e49060450cdb31e067bf673ae5903ed44cd1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "python stealer", "colour": "#3AD32E", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254692, "uuid": "0087cdf3-69dd-4862-b4fa-2d5d270dfaa6", "comment": "Malware payload (PythonStealer)", "value": "11d4eb2df6172c7614a042fddbf5215e2e018a2b1a4c0a463c93306c4fd39cba226687c16c4886526bea6f688f101111", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "python stealer", "colour": "#3AD32E", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254692, "uuid": "96c623c5-2cd6-41ab-b03b-f0f836758c53", "value": "T1BD2733E2A3510075D8D6503D803ACAA75923B48D5FB8994E27A5BF173EE33C28877E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254692, "uuid": "d3a6c00f-0af5-45b5-9f73-911bc3552736", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254692, "uuid": "011fcfa2-bd3f-4c6b-afe3-72d6af0a30a1", "value": "393216:5EkZQtsAMP8AxYDX1+TtIiFA/IFcnr5bQuHoDo:5hQtsA/X71QtIP/IydkrDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710254692, "uuid": "a7fa7bfe-2754-45c3-8877-a007d29f5e4b", "value": 21969912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710254692, "uuid": "b8a896ec-a3dd-4ec9-8b48-3bac06bed282", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254692, "uuid": "fbb37cce-cfe7-40ed-b951-f73f2cc018da", "value": "document14.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e724bf-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235734, "uuid": "4c95fef2-b7ae-4aa7-a873-adab8a3c5523", "comment": "Malware payload (Gafgyt)", "value": "e3f87ce6261f40aa5a741bdb104104cf", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235734, "uuid": "865d1551-5910-4c03-962d-322184488d3d", "comment": "Malware payload (Gafgyt)", "value": "84cba738fa841b91cbe677b2b742c127099bc30e6cc1231043727e458ec469c7", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235734, "uuid": "e5d1664f-82a7-4891-a5e7-c5e18e909bff", "comment": "Malware payload (Gafgyt)", "value": "0dccf82c0eadeb2a799f7234792d74a5a80abf86", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235734, "uuid": "fd84ddc8-d8ae-41dd-b8b8-8aede2722703", "comment": "Malware payload (Gafgyt)", "value": "05f144977b974349bff2486abad75c2a4ff2362df3ab5545660b322ebfe834d3848311be97165bb82e27e7055e4d2d89", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235734, "uuid": "655d16ac-0025-4a7f-9bad-5113155dda56", "value": "T1EB04D71676C38CEDC053C7B55A8E946B71B0F12F822E503367B1EAA03F1DEA199A7351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235734, "uuid": "d8b6917c-1f5d-40cd-8469-36c72f252c2d", "value": "3072:6D2nR8chKhMScJqCKBqoE45zM5NCUXA6BlbZ9aC6rpqPQmPOLVPU8oJDHX:F54q8w45z+DlTyrpklPOLVPU8oJDHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235734, "uuid": "b3de5cff-1864-438b-bb4b-fbffd8225b09", "value": 175488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235734, "uuid": "c5d2cee9-f830-4f6a-b15f-ce755ce08413", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235734, "uuid": "037522e7-4b07-42ff-a04d-cb7efc6fa601", "value": "e3f87ce6261f40aa5a741bdb104104cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ca7a34b-e044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710229551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229551, "uuid": "965d2cc4-033f-437b-b067-d72a8debdd2f", "comment": "Malware payload (Mirai)", "value": "3b5d6ec7e3cd2902a51736b3bc5b5a4d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229551, "uuid": "19be3959-4cc3-484d-b005-c11d03cbd253", "comment": "Malware payload (Mirai)", "value": "857a212b0821f0ab9b723911d4cad313cf919355eecdba02190bee296bff2fdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229551, "uuid": "30b829cc-bfdd-42da-a9ab-fdd9a3965069", "comment": "Malware payload (Mirai)", "value": "a715febfbd5c4e806abc85a5e536199d934bbe91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229551, "uuid": "f0167965-8b43-4426-9029-e5dcc4ccf447", "comment": "Malware payload (Mirai)", "value": "bf7a559004dc2fea0c99ff8bf9db2300432949b8cd6c8c5a72962a99e1b07e864b93b4230a6f9f0d61b30d3f451d4d3b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229551, "uuid": "b6f9e454-9986-4ec1-b370-f7811eaa2506", "value": "T107142A46E6418B13C0D727B9FADF42453333A79493EB73069528AFB43F8679A4E23506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229551, "uuid": "c1b4f45f-d2d2-4c4e-8570-4943726d6e63", "value": "6144:mTyUqJZk4au2ROU82nY1PRiKreX4M/RkWZrX:mTyhZk4au2ROU8q2EPXt/CGrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229551, "uuid": "2f464cea-9339-49ac-931c-e95762c1641f", "value": 201278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229551, "uuid": "ee7b5d6d-262c-45e2-8f40-4eaac7dda47e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229551, "uuid": "28d224cf-8ef8-4978-8875-8d9ef6daf989", "value": "3b5d6ec7e3cd2902a51736b3bc5b5a4d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40103d0a-e05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238872, "uuid": "10ef56a0-bb69-4d0a-99d3-eb695e1747e8", "comment": "Malware payload (Mirai)", "value": "6050c728e054cdc48e7d59b1241d42db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238872, "uuid": "93413c37-9ee8-4e66-a6a6-bf7d3cf623ae", "comment": "Malware payload (Mirai)", "value": "85a18fa2b6d8b279361d09fb704985a8b664b7ce95faf47fd7f7b70d47c84f15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238872, "uuid": "3dd8c813-b76f-4d83-ab3f-37bda53dbf08", "comment": "Malware payload (Mirai)", "value": "6cdce0ea854b869e6e0a1c9631ca998a10dcc7d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238872, "uuid": "70c1c441-51b5-4cc3-9710-02376cb230c1", "comment": "Malware payload (Mirai)", "value": "bf6e1bb493c1ace5f33186670520a4a841a7415599afad9bce20e8176d882dc39c1dcf67a88fad5b351613f131ca01ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238872, "uuid": "af45fa20-a880-40a3-8411-e8bb6a7c5c05", "value": "T1D0144A4AD6814F13C0C617BAB6AF5249332297A5A3DB73079D18AFB43FC764A0F23505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238872, "uuid": "72b11e7b-b92f-4bd4-939c-26f334583cb7", "value": "3072:aNktD8YlhZKME7KZUXgo8PSFzaI2peHn9SU4Z+1Fro40GSv/1M/9U+yvq/2t:a6tD8YlhZKMEmZMgoAwzaI2peHngUzZ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238872, "uuid": "2fad2cff-a765-4696-b9ab-00ebe2d55898", "value": 195202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238872, "uuid": "b5b41e1c-f88f-4962-9a6a-a0b515f41f89", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238872, "uuid": "f70f37c9-622c-4268-b7d6-9a7afa0470ea", "value": "6050c728e054cdc48e7d59b1241d42db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dde1a8c6-e07b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710253310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253310, "uuid": "61947eb4-adac-4544-b7c1-d2e7af7d1298", "comment": "Malware payload (RemcosRAT)", "value": "509b686113fa747c388e53509e0c6989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253310, "uuid": "77ef64d9-2727-476e-ace8-b98abc7cb482", "comment": "Malware payload (RemcosRAT)", "value": "86570d4ebe48c2094fee14bea9be48469eca42e0dcaee444c5cd6aaaf9645d28", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253310, "uuid": "73008177-99db-4f07-b4af-a98c9da37772", "comment": "Malware payload (RemcosRAT)", "value": "1b307bad2fe0a0a2bdeb35da29a5b6b93f64d131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253310, "uuid": "213bce38-6a09-4de5-a388-a57ee324c4d4", "comment": "Malware payload (RemcosRAT)", "value": "55fee6d88ce69d25f139f18e880d55df9e1728a36a91b1f7af9bbea2c0ce949b33ffb4409a289de7a8f02289bcdc4946", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253310, "uuid": "4c3483dd-968a-4414-86c5-62f11c78416b", "value": "T108D35616FF6519F1DA0980B56F0063044A191E927D8F4E36A83B3CA8D5BFDC14F94BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253310, "uuid": "c505eaf0-5795-4b76-be4c-9a763eab7efa", "value": "ba072a972fe6c47c8cf7a0347bb0af7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253310, "uuid": "a19d7848-7e95-4385-a8e2-bf8e0d205de8", "value": "384:dz6kMrov88/sYWS0YWbiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiLiiiiiriiiR:dV7/s1GSV7/s1GMV7/s1GXcV7/s1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710253310, "uuid": "0416efa9-4683-40a6-912d-830ba704f6cf", "value": 139904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710253310, "uuid": "5721f28c-e7d0-4340-b704-a39110d0420b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253310, "uuid": "5d0965a9-467b-460b-ae06-b5135d7a6511", "value": "dummerslops", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d032d52a-e0b5-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1710278198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278198, "uuid": "7051a52d-8795-4e86-b3d1-225e269578a2", "comment": "Malware payload (SnakeKeylogger)", "value": "8ad01c64b357780c078e44780c322600", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278198, "uuid": "f774b4f3-3f49-4272-a1f3-13bd59e61b69", "comment": "Malware payload (SnakeKeylogger)", "value": "88137ef5ca05130558e846da3d480008f2e5488a7543872195f64daa5a04b365", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278198, "uuid": "ad55b060-21e7-4015-8c3e-c191bf35f0ef", "comment": "Malware payload (SnakeKeylogger)", "value": "a016f5f6ff8a89557e34b5e5173dfc8a9a50b6ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710278198, "uuid": "a161f231-d1f7-4db1-828e-8547d41834d6", "comment": "Malware payload (SnakeKeylogger)", "value": "482b87d2bf51227d5dc2ff14f61deecd53270b1cfeb2e971bdc4e49f562384e336787d5697c6cac2bd4c3bca32e85729", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710278198, "uuid": "d7f1416d-aeb1-4846-9f51-ec9542e2fc83", "value": "T179A4F1109AE98373CADF4BBF78644545C7B5DE25E30AE74D2C8077EB488339166422BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710278198, "uuid": "ca3fef7b-1318-43b5-b1b9-acd3be9dfc3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710278198, "uuid": "5ebdcf2a-ef47-4acb-a09c-5e7cea123c08", "value": "6144:q+hiQ1o1emq43RaLJM5hp8Sp1YX7RdE66hYM30mztCiLAzvmBsOuRLX3+0Wtz6t0:74ZqGhF7uidhYM7COQvmBsOeetyAQF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710278198, "uuid": "6446e077-245c-46a2-b58f-b2c356eb506f", "value": 470016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710278198, "uuid": "80e6b5b7-a48a-47f2-9b90-e837d47c9be5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710278198, "uuid": "740bd00f-0bbc-4ddb-9720-c2b0eca93068", "value": "Q88 09284823910.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8222161-e031-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710221464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221464, "uuid": "7c8068bb-2690-46c8-b163-a2d0170d6ae8", "comment": "Malware payload (Formbook)", "value": "14271c14e1b6bff19ae52bf6698ba756", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221464, "uuid": "11195d31-07af-44dd-a1a2-6870bbb677ef", "comment": "Malware payload (Formbook)", "value": "8926417110b368be42eddfd31b1d422c2e1d41720df7c4cfa215ba4400ca63c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221464, "uuid": "b1e32bf7-3c31-4280-b3c3-495fa45e094c", "comment": "Malware payload (Formbook)", "value": "7d09786943ba09873c1f18b6eef696421f315d23", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221464, "uuid": "f639b59e-3793-4b39-8dac-252ad8011f5f", "comment": "Malware payload (Formbook)", "value": "503b8b72a74b9b1114bd4e96d21b176543b4bb536559128c08c93e60c88ed0aa1ed28a902432ae89b264775378ca25a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221464, "uuid": "7f818f3a-6c42-4cca-b929-448ff198409a", "value": "T1D4E4019A75BC2A43C67AB6FC54B8206807F2364964B5D3FC0DD636CF88E9F400A54E5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221464, "uuid": "72b0b5c6-acf6-4410-a303-2836d34fd32b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221464, "uuid": "63a5b200-7123-458d-afe1-066f861ace46", "value": "12288:u/sJTENl3lRSbFf1mEwO7mXzxH0baYTajSZk4WcG3hghOXz1DILTEVylkR:3xENlfl7OY10bayJOyCzRgTEVp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710221464, "uuid": "79602b93-e4bc-4e45-865f-8019d28a9b05", "value": 685576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710221464, "uuid": "e4053b83-1ec5-4268-bf02-073badcd728d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221464, "uuid": "ee7ac126-4207-4f8f-b617-794f79c09cc0", "value": "SecuriteInfo.com.W32.MSIL_Kryptik.KQK.gen.Eldorado.25151.17463", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aeff4dd-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238487, "uuid": "7ea97a66-c788-491e-af06-8f4aa43d370d", "comment": "Malware payload (Mirai)", "value": "b099eebf8bf906e8e05c589980db8cee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238487, "uuid": "d0c23e10-ae38-4ab5-bd89-7162f3586a51", "comment": "Malware payload (Mirai)", "value": "89427732a6c7f8309fa9a82bbd117c28ae7d3246bed321f24880ae1dc901b304", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238487, "uuid": "a83e1155-03b8-442d-b4bd-47d707fd7408", "comment": "Malware payload (Mirai)", "value": "aa4c7a2687f62a80ea6e268f0824f29c76242fbd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238487, "uuid": "a57ca444-8816-4ef0-8717-1749c2d02e76", "comment": "Malware payload (Mirai)", "value": "4c2781a8a6c8ffa33cad0d24898a2e72f2700233793c724a8f02f9b5aeaefb98be23e92cac95a1870058e0873c3cbed3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238487, "uuid": "c71e1fe9-8f17-4ab3-b42c-324add2d5447", "value": "T169C32B08EB40475BC1E237BAEA9F428E33339B4477EB330A5A3856B43FC5BA94D25515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238487, "uuid": "fd888775-ecb7-4739-a6a2-b0392b15b36d", "value": "3072:vYzGxinnOexHX4q+N+NJdJcnb/3oUM/9Y30g:AeinnZl4q+N+ndcb/3LM/900g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238487, "uuid": "2dd8c6d8-725d-4bc4-a0ac-230efaa27356", "value": 127183, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238487, "uuid": "e267c3fc-f7ad-4473-b630-64276beb4ebe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238487, "uuid": "9afe0623-c9ea-4d7c-9e9a-88e66ff9f6ce", "value": "b099eebf8bf906e8e05c589980db8cee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25402d5f-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235820, "uuid": "d1b9e778-fe8c-4664-994a-6139e4689027", "comment": "Malware payload (Gafgyt)", "value": "da69e030858eb5080fc21846accf9f95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235820, "uuid": "9ca6f142-3b10-45b5-bfc4-4a70a1c49b10", "comment": "Malware payload (Gafgyt)", "value": "8bfd4a6c08ba1bc98979645e9fef85e4cc6ed6f2f9a5d7da5d8088c9762ed0f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235820, "uuid": "68e0df93-405b-48f1-8f6e-b4ed549cd5f9", "comment": "Malware payload (Gafgyt)", "value": "36dce9bdd0347047a5f3bb8feb0b70d76be6e879", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235820, "uuid": "3308592a-a951-4a7e-b2fb-34454ba261b5", "comment": "Malware payload (Gafgyt)", "value": "13190a484cd68893d7957344418af5316cde6e176b91d82c3834ef884b0f8e89e6c6b84baf476c0fa44f90cdbf561b63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235820, "uuid": "5595837b-5b8c-436e-b078-84577c38007c", "value": "T1EA04A8449C645B6FDBE3ABFBF74471CE727646891F833309D3284AF013816EA991A253", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235820, "uuid": "7f2e1ac3-5df8-4557-b550-f56ad67ca580", "value": "3072:BhG4IGXq11zXqwL5S5NZf1t3aLUUGPNZibtNf8eNgJs12Zhvc5PsEsEUxxQLzJl3:BUPzfku9D8xrbY11EoO5Dt0DR1M4X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235820, "uuid": "5d390538-bfa9-4370-b109-066e4e042fc9", "value": 189163, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235820, "uuid": "f9d7ecc4-9320-4ccf-9574-0ea3893e3f0c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235820, "uuid": "9ce4cde7-7131-43f6-b46b-d916f6232c52", "value": "da69e030858eb5080fc21846accf9f95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de664b51-e03f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1710227541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227541, "uuid": "1ff3bc09-cae8-408a-98e5-397fd203160e", "comment": "Malware payload (Loki)", "value": "e991e9f93c6f3487453e7511c9b0b767", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227541, "uuid": "0cbbca97-8db1-4320-845d-bcdca7bc2dcc", "comment": "Malware payload (Loki)", "value": "8c8296a38b24ee003a3b4e97aee798b986324a9b3291ad9e2c2e4daf55a185eb", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227541, "uuid": "e8068557-16d1-4909-aa50-ad6da5961fe1", "comment": "Malware payload (Loki)", "value": "421e68dbd220669606adcbeb6d784abc1ed6b10a", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227541, "uuid": "fc394b23-ea96-406d-96df-9efc0ee8601b", "comment": "Malware payload (Loki)", "value": "35dfe8f6539ffdea9efdfd925f2e5c684ab1ea3aa3b176199270131c91b3560b209ebc5397701656ad33d92eeac4ffe1", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227541, "uuid": "af23d290-6583-47dd-a2fe-09c34dee4e19", "value": "T15F049B6DD34B02598F620376AB1B1E5442BDBA7EF38512B1306C537933EEC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227541, "uuid": "53d33a50-ed47-429b-9771-8449baf95197", "value": "3072:JwAlawAlawAlZkZJ+vvt9Ohwk8dK2g9hHq:JwAYwAYwA83+3t0hkghHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227541, "uuid": "ad653019-ba02-41c5-9df7-0fa23ab12422", "value": 189457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227541, "uuid": "fe0fc49e-b4f1-43f1-8e20-8dda2d390afd", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227541, "uuid": "593aa6df-51c7-4248-9df1-562424dacb3e", "value": "Avery Dennison 873311 MCH.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17433c86-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235797, "uuid": "4466fe32-d882-44c3-9fe7-08e6dd589528", "comment": "Malware payload (Gafgyt)", "value": "f25b8f549653f493d7bbc118e0c50f38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235797, "uuid": "06681ba0-0b7e-4f36-a505-1b2f9e2f95a2", "comment": "Malware payload (Gafgyt)", "value": "8d1e93849fd5dfbab39ac3e509e7ce8b1326e2bbeea698458694a853a408213f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235797, "uuid": "8d5c9cde-8448-40ed-b152-36fcb99f1e08", "comment": "Malware payload (Gafgyt)", "value": "f61202e50b8a822dfc88900434a722fa248e7f4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235797, "uuid": "047a83f3-3a4f-4cac-a0bc-8a91180a410c", "comment": "Malware payload (Gafgyt)", "value": "b829ab4c0c62a92bd4418eca3e58990ac1b151084851a953ccc9e92ee214f6bdb30f9bbe77d7170821c25b7039871a82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235797, "uuid": "7fecae5a-ea87-4ce4-86e9-b212f2b7ed41", "value": "T17114C80198A0575FDBE39BFAF755B1CF723657981F83330AD3185AB013C12EA9929287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235797, "uuid": "fc19a8ec-032e-4ada-b643-7e3643109925", "value": "3072:k+JGgYQ9ACfN+MI/kWX4dT6+IYuyoJWtT9raedxGzKKP9LKO4VmNZKh64FCtZp2J:k+JVRvJaP6wZHtm9VHqlmyN4942Yk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235797, "uuid": "10cf1e6f-5860-435d-ad31-553fe661036c", "value": 208675, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235797, "uuid": "ae3595d4-df92-4f22-8811-1651989c38be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235797, "uuid": "3027eb9f-4231-4acf-8707-d3c474402040", "value": "f25b8f549653f493d7bbc118e0c50f38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c1c67b-e00a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710204407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204407, "uuid": "cea89585-5364-4e66-a59a-05580ec56e4b", "comment": "Malware payload (RemcosRAT)", "value": "854f06916282c2274e9f76ede01050d1", "object_relation": "md5", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204407, "uuid": "c78eddf4-6efb-46d2-8cfa-2355e457e526", "comment": "Malware payload (RemcosRAT)", "value": "8d4dc1660173a936930fb215f698da0456c216e7fdb32e55ddc808ec9e46acd6", "object_relation": "sha256", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204407, "uuid": "461278da-c421-4683-8ef5-84e10c85c1fd", "comment": "Malware payload (RemcosRAT)", "value": "9a31cfc18ad490e56c6889051c55305fece37a65", "object_relation": "sha1", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710204407, "uuid": "d59e6297-b341-45f8-ac67-3ff7739ca50a", "comment": "Malware payload (RemcosRAT)", "value": "f4d1c3858387add8f90a2aacc8cb0d5e4776e531d8ee801cdbdba30dc8832471112d7fe234bfe87953b88b09118a0fb1", "object_relation": "sha3-384", "Tag": [ { "name": "deobfuscated", "colour": "#E157C8", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710204407, "uuid": "c6707a5c-7cca-4eaa-806a-894464d81c95", "value": "T10162E195C7ACF990558D0666F2D69132BF8F3F473CCBA584D5C6D359E0278C83700226", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710204407, "uuid": "d781cfa0-9a12-44f3-80dc-a06602577dad", "value": "384:kTJhHKxwIna8iiptGQdaAASPKsrHgJIPJ+pAsu2PzC9/KC:k/SRiiX5ahLsrHepNU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710204407, "uuid": "1c60c625-f94c-48d4-85ac-3f807e3dc4a9", "value": 15887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710204407, "uuid": "ee3c49e7-aa75-42c6-b902-ffe770ef9d95", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710204407, "uuid": "64111fb1-8143-4aa2-8732-fded5e24b1ec", "value": "REMCOS-59c861a26a84d17beb487803322d60ec30260556d20d550ac309bc85851eb378.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5daa981e-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229902, "uuid": "07d4b740-74ba-444c-8b59-05f5f12a962e", "comment": "Malware payload (Gafgyt)", "value": "dbe375089077f808e4cabe83f8dbc8d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229902, "uuid": "4ceb0d17-6d11-41b3-9809-ed7d8ff6bed1", "comment": "Malware payload (Gafgyt)", "value": "8e08646d1d8841bbb04f7fe1067083117f00a53844f91003ccebf47a9ce79d6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229902, "uuid": "9f7c631d-16de-4065-82e8-0e0415bd4d77", "comment": "Malware payload (Gafgyt)", "value": "61bf806a3bb37a1d4ded5608e030f9793ebf57cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229902, "uuid": "a113a872-5dc3-4698-b4ea-cd114d459318", "comment": "Malware payload (Gafgyt)", "value": "8fc7dd762277eb1dbaacb1641cf36e0e156aa3d49f35c09108ac294436697f2beae1a079540a1d95e0f387dec23121f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229902, "uuid": "bf46d115-d39c-44a4-b733-1a15d2a049e1", "value": "T16304412A7770AEB7F94EDE3B02D95601108C9D490ADE2F6F7365EA28E35A44F50E3D40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229902, "uuid": "bcea5a2a-54f4-4206-89f1-52b26dff76d7", "value": "3072:ADE55CmnLCa5/x3EM3WdyfiSDEoeuY4imDPyf+lsqDpyi88s:ADm5CqLCa9x3EM3WEfiSDEoeBmzyf+lW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229902, "uuid": "942f7b89-9bbb-4846-8aa7-3907c6330bef", "value": 181857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229902, "uuid": "387e75bd-d98c-4424-842e-c0647e4548b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229902, "uuid": "da973f96-2b93-4f6c-b6fc-2f57c4664856", "value": "dbe375089077f808e4cabe83f8dbc8d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de6f510-e044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229580, "uuid": "77588e3c-e0e9-4690-8fd2-b767b2437f7c", "comment": "Malware payload (Gafgyt)", "value": "762dce38b05d78ef8751de083d195c9d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229580, "uuid": "c87ab7c3-9558-4910-b946-04a170642ff8", "comment": "Malware payload (Gafgyt)", "value": "8e104ce762064d26fb0212db1ff79b08f77dec1f6ca51293943c37a2f166ec71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229580, "uuid": "644bc249-4342-4256-97fb-5d85de7f2c26", "comment": "Malware payload (Gafgyt)", "value": "9f42a52ac468a78b5f63b1bcb736c1ac9e149203", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229580, "uuid": "5ec52b9a-7234-4632-819e-16e94a7b759f", "comment": "Malware payload (Gafgyt)", "value": "57efe4c78e521b98a11eb9b1f77a576aa07c754cd9c5493d3d646780052cc22577c4bf197c3779e7144e2c2b66f286fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229580, "uuid": "ee08236a-8406-4454-9d09-a6cc03acbedc", "value": "T19AC3D7834A20DEB7C053AA7177B25524B795BF690B1F0A867E1DB6A00B3F4CE741F660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229580, "uuid": "b8720261-b460-4bdd-bc31-1c586b7973c6", "value": "1536:Gq1BB01khn6wRiKHiKWSNI0YgIksoiB0hCa3kVPybJ7ANaub3SnFRRT0IAf1BgeG:/z+dwRlWCYgI8hnnIOnFLT0IA9BgeJ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229580, "uuid": "8745fdae-ef9c-457a-9676-9fbdf20c46fb", "value": 126583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229580, "uuid": "5675f3b6-eb5e-4ee5-bc95-246fecd263f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229580, "uuid": "1d643f95-bb98-48e7-8bc8-2c1d4d27fa32", "value": "762dce38b05d78ef8751de083d195c9d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91f589e9-e044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229560, "uuid": "d574c214-b76c-4c76-8f86-4e982772808b", "comment": "Malware payload (Gafgyt)", "value": "f45b543332f5f2a9b0849a57aaec3734", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229560, "uuid": "2eb83c5e-6542-4b80-b306-68f85df2a60e", "comment": "Malware payload (Gafgyt)", "value": "9050d9abf55d52e872e6dd7a2ea0e66b105a1290dcb024259437d485e3d86cf6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229560, "uuid": "94ed6c66-78a1-4153-8678-31598104d3b8", "comment": "Malware payload (Gafgyt)", "value": "f5516d336e733fbb3161c93daece84e441b4391e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229560, "uuid": "8281d2c3-36c8-493f-9655-95d4d1e37083", "comment": "Malware payload (Gafgyt)", "value": "9aa6506b0c3fe6836e5a0a7bb4d36fcc9fe7e7bfb18b6926af79541b95a2682bf1082a74010c87bce681c7cae5976c46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229560, "uuid": "d200614c-49bb-4d93-8f30-e47ae82c9201", "value": "T18AD3D583B420DF5BE44B4A3647879321B7F6EF5C9A431232731779529BB72D229B2B40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229560, "uuid": "99d107c1-5c68-46f7-a213-564b4087fa82", "value": "3072:87SHfY7cPlx2vCZEt3gozw9dySDO19zBPmLc0IZcHgeQs:8G/YEi3gozMySiHzJmLc0IZcHgeQs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229560, "uuid": "b9e7e3b5-b300-44ef-a640-39f0dea8e6bd", "value": 137454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229560, "uuid": "60a32490-11d5-4a86-b5d4-f94ffb0b2ebf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229560, "uuid": "db9f49a8-5615-4dc9-b78b-8552fb1af97b", "value": "f45b543332f5f2a9b0849a57aaec3734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c1b454-e044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229565, "uuid": "eba85801-6c84-41ad-86de-8bead6b0636d", "comment": "Malware payload (Gafgyt)", "value": "592654e0c92ee27a4f45ed1780f0280a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229565, "uuid": "41178756-6dd7-481a-8893-a9525ddcd2e4", "comment": "Malware payload (Gafgyt)", "value": "905a9b11c835c93edfdc7664ce3856f5131ca729b7d16430bb7e50b5ce85236e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229565, "uuid": "99c7a657-74e5-4f1b-901e-460745e20d15", "comment": "Malware payload (Gafgyt)", "value": "ac2e4e55841ad3ba6c6fed36d2b7a5fb802b3e5d", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229565, "uuid": "efd74cfc-fcc8-48ca-8b43-9246dae97ca7", "comment": "Malware payload (Gafgyt)", "value": "76a8f5d683679633f50d588f38a87480b0aa365e9629190753883be10e70ef5f09c0ae3edae5144ddb42efb15ee6c0f1", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229565, "uuid": "3b07db7e-510b-4588-96eb-ceb85081ba06", "value": "T15FD3F81B2693CDBAC0438B785B8EE01374B2FD3F073A51066781FE682F35AA5599B351", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229565, "uuid": "edc5637b-c463-4c2b-905b-c329c2c93170", "value": "3072:PScFgwftVc49xR4Jj9xC2DMChEoZX3ppEYeRlVUncRSdws:j49TCTM3HeRlVUncRSdws", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229565, "uuid": "98a9ed47-098b-416e-b372-a2c908893e4d", "value": 130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229565, "uuid": "1a79977c-fe78-4830-9ebe-a668ae3a849a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229565, "uuid": "487a37a8-0227-4e11-8f09-b3c2f75c1807", "value": "592654e0c92ee27a4f45ed1780f0280a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d63d8e-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235841, "uuid": "5565296d-6312-42a4-a80d-1a62dc040969", "comment": "Malware payload (Mirai)", "value": "cca283dc2f62bac1a54c7237a0d3383f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235841, "uuid": "bf4b5f73-45fb-426b-bf2b-22aa70824a5d", "comment": "Malware payload (Mirai)", "value": "91ea49f08ca076fc30f656ff417970b5de1edd6b8c9f7667ed735412c01e6351", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235841, "uuid": "106cefac-cebf-4fe2-a4bc-47da9171cbf4", "comment": "Malware payload (Mirai)", "value": "cf1981a1d314f1ffd94699de117962fc0fe62ec0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235841, "uuid": "b089f8b4-7bd6-49ad-aefb-ba5a12eebd5e", "comment": "Malware payload (Mirai)", "value": "e6c575026e7d7eab5c3e0e4dee4e14a993c876b718c49329220df2ef626ccc351966e8ca8ada799dc2c8e1948b9ad286", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235841, "uuid": "5dad40cd-a65c-4462-a0a5-811b46e843db", "value": "T186E319D7F800DEFAF80AE33748530806B530B7E245925A372257797BED3A1991867E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235841, "uuid": "e60905d4-4811-4520-897c-ea8990545177", "value": "3072:eVIr3cLhb7+L3zWPVnAsY0ZuvVrjbidL/5K+8yGXWiwNW:4IrDSP1AEZuoL/5syG3wNW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235841, "uuid": "cc6625bc-3bcb-46f9-981d-1dcc7c94803e", "value": 150464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235841, "uuid": "c1e98cc0-5efb-4893-97bc-901f6ba046bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235841, "uuid": "2478a995-15a0-4f8f-906a-09315635921f", "value": "cca283dc2f62bac1a54c7237a0d3383f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0960d1-e05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238865, "uuid": "3803d0ce-e1d0-47ae-9f1c-881f47a96aad", "comment": "Malware payload (Mirai)", "value": "48fb3c4fbb117f828ec3fcc22d63b862", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238865, "uuid": "aef002d2-bf34-4da9-9bc5-f0a142beef45", "comment": "Malware payload (Mirai)", "value": "922b84cb80a448e8692ad3d4150521d721e903056fb2259968f32601a9b21edf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238865, "uuid": "24cef2c1-4f05-45a7-963a-9ba3aae95724", "comment": "Malware payload (Mirai)", "value": "6eadfac5380667b038570a1221a296bf587a2950", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238865, "uuid": "e9be9d9a-f51f-41f9-a16b-30e137eb1759", "comment": "Malware payload (Mirai)", "value": "6142a95b45408beeafa7aaab1a27f2828a4c66b0b6975edaf4e15003ab17c1b8f66ba0fd8293658023ee4219582d4a21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238865, "uuid": "3ef316a1-4990-403f-afc8-85f7e5975ddf", "value": "T144A39E61E0145DE8C277013861F98EB41F33E88466471DF62AE387796047A9EF72DBE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238865, "uuid": "e1b51f6e-fcbe-4b9f-a1bd-9aff384e992a", "value": "1536:NI/xMBRMJaZALFCk7axfLs5po4Y+4S1gr8p/fKIshYHlQ/dCKaC/Qg/az:NIpML4qALAkiLcoz+rvCIDlQ/dJ/a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238865, "uuid": "49b33fbb-cf92-4cb3-9b00-0395510551a3", "value": 99876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238865, "uuid": "a9cda05f-5349-4898-b207-45322a5e4b50", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238865, "uuid": "a784aa07-d644-4b78-8cdc-32ed2d0a36b4", "value": "48fb3c4fbb117f828ec3fcc22d63b862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db4d9b8-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235351, "uuid": "35379686-2072-4525-9357-bb83cfa787cb", "comment": "Malware payload (Mirai)", "value": "834ea46abeeef007bb62643d1891a2f2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235351, "uuid": "521128ee-2424-41d5-b7fc-3257543cc2ef", "comment": "Malware payload (Mirai)", "value": "929bd882f5ae1e2265b229b66e1a02515cb2fd9660584c1d68025865c0b8c132", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235351, "uuid": "03931377-c581-4321-90cf-990be151ee48", "comment": "Malware payload (Mirai)", "value": "601161ad76e8bc76041e542ab27d047476362ce5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235351, "uuid": "2e4bfb0f-72c3-4259-b42a-cb56cb0cdab0", "comment": "Malware payload (Mirai)", "value": "2c03c52f510c0979f30e8930f4144db16a4e65415f5fd14f4ada3840ee7c35ad3a136ccc2f0c17e4c62a3831591a05bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235351, "uuid": "64c8d421-8b0b-432d-b45e-913e589242fa", "value": "T18F937DC5F243D0F5EC8705B15137AF379B33E0B91029EA43C3696972ECA1911EA16BAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235351, "uuid": "77b93b3b-5078-49d3-b566-19f0f0dce767", "value": "1536:sUYl80AvyebhzEzASUn3JIaJi7M3gLkiNgKVL4GRUS3tkDNH7:sUYq0ovNHS43JIPIWkDKVEeBMB7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235351, "uuid": "987c24f2-0d5a-46e5-b639-a87d82b440e7", "value": 89672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235351, "uuid": "4316ddd9-b3ab-497d-b442-18db7ec834f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235351, "uuid": "17158641-5b02-4ab2-a8db-542277935ddd", "value": "834ea46abeeef007bb62643d1891a2f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9084146-e066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710244282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244282, "uuid": "37aeda53-587a-4d8c-8c37-8930a6240682", "comment": "Malware payload (RemcosRAT)", "value": "16b9f70555b15f5d3b1550f28d8d980e", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244282, "uuid": "74fabb83-1c68-4652-97ac-56b1e89e8785", "comment": "Malware payload (RemcosRAT)", "value": "94c14a6a1ad7b49dd99ae4d637848b7f276afae89be27b85d00d0f1e80ab0424", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244282, "uuid": "24368d41-1374-4599-84f1-5cc548fee825", "comment": "Malware payload (RemcosRAT)", "value": "ce0a37875d8579cc2206f5581cf614e9e2963d26", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710244282, "uuid": "3d585661-f7b8-4fe9-b7d8-4848f5fea7e9", "comment": "Malware payload (RemcosRAT)", "value": "3e2ab17efc7a44cae8675cd96a4844755e7a82fe0719e1bb72e29163d6a3c1435b7a35a117e010205d65d46d73282c5a", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244282, "uuid": "fd152f7a-9bbd-4af0-a9b9-d99e868db1c6", "value": "T11772D0751E9BB424E86CE83B61EBC8209B3993295DAB1E20E80750DD734C751FED35A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244282, "uuid": "c5c5c92d-f791-4fe8-8ab5-b585d18341e5", "value": "384:EDRzpzuyjJiTrCTivfecJ74xE7KmKXbetefRbmQJ:qFzuyjJUrki3axitefxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710244282, "uuid": "47068015-0141-4e19-806a-d1c325997e8a", "value": 16101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710244282, "uuid": "24441a80-4b6a-4cb2-89a0-3f984c5c5c95", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710244282, "uuid": "123cc7d1-8553-4db7-871d-f62d16e3e916", "value": "nPayment_Advice CCL9737347893_pdf.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b94a0d-e066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710243953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243953, "uuid": "b14e3fd1-c37f-49b2-af86-fcb68b026cd0", "comment": "Malware payload (Gafgyt)", "value": "564c4d1f7fcd1d51b3b6a0108b39fedc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243953, "uuid": "b99d082f-1e92-4795-86d8-c1b8a5c8e2fb", "comment": "Malware payload (Gafgyt)", "value": "958bc1903b2e27a7c207bb4b3d954439d1ebad7c00195bbf227223c8013f8b46", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243953, "uuid": "6e51665f-7f3f-4961-accc-fe0bfd088511", "comment": "Malware payload (Gafgyt)", "value": "409956f5aed3b02a922dc04c173adc88810cbdf9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243953, "uuid": "fd536cfb-83ac-463f-a168-d40eff5bfc86", "comment": "Malware payload (Gafgyt)", "value": "41c9c5c6a35204fdaeba4869b252875a2d90429722ca1917c800b030f373865cbe062859ff402520e3e97ae7b9021c8c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243953, "uuid": "a9ed2564-5454-42aa-bba5-dac7769d0bcb", "value": "T1E7B33956BD018F53C2C315B3FB9F47887B2667F8D2EF3203D925AFA1278A4D60926950", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243953, "uuid": "1cfd0152-9930-4c16-a7be-cbd2152f5911", "value": "1536:VFL4kuv3i9NweyEEW47XGF2r4aYBCmerwO0J23+ZbvRdQr19xvT5hOpMXq:VF0RS9S3TGQkameT073AXT5hOpMXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243953, "uuid": "e486c1cd-a8ad-4030-ba6a-e3078b17ff36", "value": 107720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243953, "uuid": "3923d4de-6bb3-4a97-9fae-4af24b11bfd1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243953, "uuid": "bdfbd2c3-e49d-4004-a570-7c8c06330c66", "value": "564c4d1f7fcd1d51b3b6a0108b39fedc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edede522-e0b4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1710277818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710277818, "uuid": "89331674-1a50-44d4-8257-5caa8949be95", "comment": "Malware payload (Gh0stRAT)", "value": "5d35de0adc79f9e9bd8447c7afee7a04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710277818, "uuid": "644286c8-7ccb-412c-97e1-9c4989fdbf40", "comment": "Malware payload (Gh0stRAT)", "value": "96031de4aa553a6a5b15f7c5e0ca0795d2cd7fba2e41a163bc8e20cdbf45374a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710277818, "uuid": "5078eb53-5367-45f2-a2c1-7134fa1986d3", "comment": "Malware payload (Gh0stRAT)", "value": "72960eb12a8b654db873d6cb44af2a7adb0c0f64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710277818, "uuid": "566a241b-ab38-4e19-acd1-d04404b588d7", "comment": "Malware payload (Gh0stRAT)", "value": "b0fee23b49c1e8a29502bede4500ed2c7e84c23964f321a066e29d3649a50daa2e79188ecec06f531628d82931fee7cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710277818, "uuid": "bfbdc878-0c8d-4a15-8c27-9f17c40303c3", "value": "T12B34126E284104B7C561D0B640FECE011BF64C2B666BD96EF7E8FA4A0C247D4D4B71A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710277818, "uuid": "5fa58779-5c59-4bc3-bad6-7d9d55c078a2", "value": "08c3cfa15260bca26f874b5bdf8dd146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710277818, "uuid": "7f2a6d68-fb90-4370-a10a-877917912418", "value": "3072:j+HDVTtkdiAojheSc5ch491vxqHMkumn0lBE4vvaPc5nm7gynXVpX8BH6umIgqV5:6HR8iAoNbc5+4z4z45nGgyXVwHlmXC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710277818, "uuid": "6673ffff-2ad3-4317-b23f-efbbf5362d6b", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710277818, "uuid": "978a8df1-f72b-47a0-b4ed-c8dd18138c40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710277818, "uuid": "d689a588-b196-4324-8cf5-deaad7eedb92", "value": "5D35DE0ADC79F9E9BD8447C7AFEE7A04.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7313fe7-e03f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710227582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227582, "uuid": "155e6ef3-6de8-4c99-8b6b-1df94a00a7cc", "comment": "Malware payload (GuLoader)", "value": "5229dde99400afefdc112dfc405f1125", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227582, "uuid": "9e0a6c3b-63e3-4359-9261-5192091cf7b4", "comment": "Malware payload (GuLoader)", "value": "9891d11606d08ef7a6e09203c27ca3c5c6b0058edc3b9b52bfca2e2cca701d01", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227582, "uuid": "2c2fcf92-df79-442d-8526-aec40338c2b2", "comment": "Malware payload (GuLoader)", "value": "01267c8d92b21d5dc32d85377e50f9f972d3908f", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227582, "uuid": "0c459f6e-e80c-438b-bc80-063bef0104c5", "comment": "Malware payload (GuLoader)", "value": "e344e0eadc4dd9fef208de1147dedae3fd5b8e235f51a8f78d362bfe571a150bbe5a41c531a49bb95a1932a37f95f324", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227582, "uuid": "82c192e1-bcab-4eb0-9319-1b9619b614e9", "value": "T10FC217686D022065862B12FBB04E8579D50940FB9E51453A3E8CF93E5C6B748BF6EC8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227582, "uuid": "961e6271-40c2-4f3d-9889-166f7a0eb5d0", "value": "768:4iS5dMsnJbeeJLqHVGSFhJQyUM+DTZHLXBr:4iqMsqHVG8XOLX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227582, "uuid": "272cf76b-2a31-4c5b-8857-f3c71a78f506", "value": 28154, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227582, "uuid": "0221e23d-5b1d-4eba-915a-e9ef3f97ce9e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227582, "uuid": "58cd39b2-8fb9-41c8-b0a4-044b510c5970", "value": "RFQ- Titan Machinery SRL2024100044-11RO.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c074679-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235885, "uuid": "96031fd4-2a9c-415b-a8c8-7e5e51a1d084", "comment": "Malware payload (Mirai)", "value": "0aaa031c847c8da7aed61acb4f458b69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235885, "uuid": "3647c1b3-e7d4-441e-9da4-9dea02271180", "comment": "Malware payload (Mirai)", "value": "98d0764eb94960c448a05f01c8e5c831d3e3d99904620d870eef718866799b34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235885, "uuid": "33d1e4cd-4190-48ef-b9ca-d369ac0ccb3c", "comment": "Malware payload (Mirai)", "value": "5ac5c0f6c053506d1458174863a529504b17141a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235885, "uuid": "044c867d-1937-43d8-8896-6371b2f8e662", "comment": "Malware payload (Mirai)", "value": "8a4ab82f6759e9e9b67656fe22eef52822818802aa96decdea3ef9a242f4eacb6da582f8e8ff7dbc8f4b6d3709146ef5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235885, "uuid": "d2fccb8c-2e7b-46a1-a5d3-25eab3c484d5", "value": "T15EC31945F8415B23C6C212BBFB5E428D3B2A17A8D3EE72039D216F61379B95B0E37542", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235885, "uuid": "1aa1075e-e241-47d6-b138-25c57eede8fa", "value": "1536:JS7SWWnG5vTCINDDBIt+XL1uAFDG4VDNET8CPUEEu16q+vkZJblfmwywbFUgmTAW:s7S7g+iBvb1ub4LE4CPUEgq+MlkjT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235885, "uuid": "13afe11b-5566-4dd3-b2b9-05ce619c3fcf", "value": 129792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235885, "uuid": "4866450b-fbc9-4b93-a9f7-9e0ad61b2d9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235885, "uuid": "f4695210-3ec5-43aa-acd2-17590ef62ae8", "value": "0aaa031c847c8da7aed61acb4f458b69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0305ee1d-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235763, "uuid": "359d6ead-2dff-4ba8-b2ee-9ee2e1ea9edb", "comment": "Malware payload (Gafgyt)", "value": "0f071d9b13631c82b360d5857f6550c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235763, "uuid": "92eaca41-0bcc-44a3-86b3-21846445f8c3", "comment": "Malware payload (Gafgyt)", "value": "98ed402f271e026ad362d4ebc30e1a5e04578c81cb7702bc60af7c263b0f46c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235763, "uuid": "94f1e020-0eae-42fc-91df-c17e538294bc", "comment": "Malware payload (Gafgyt)", "value": "91809625d0fa0094fb9dd7b924f0c10af2f30ad0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235763, "uuid": "1cc85be1-28c8-48bc-ab28-527bc4463aec", "comment": "Malware payload (Gafgyt)", "value": "31431e3d8aaea89ffae1d1c2539ace7b203ad9ec578311d41585f7b6aac88947d61583fd20ec02af378276f56dbc2813", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235763, "uuid": "00070609-77bc-41cb-93d5-ce111b2f4abd", "value": "T11014B9449C645B6FDBE3ABFBF74471CF727646891F833309D7285AB013812EA9919283", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235763, "uuid": "235957a4-5e85-4e7e-a40b-cd67365df8c7", "value": "3072:KYq4CGXq11zXqwL5StNZf1t3aLUUGPNEibtNf8eNgJs12phvc5PsEsEUxxQLqJl2:Kl5nXrSo95pbpMoZCQ9gOS1SeX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235763, "uuid": "fe55b6ea-ad3e-4ee9-b8c2-24466ce4ad56", "value": 195725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235763, "uuid": "7aefafe1-a961-4783-91a5-2e736a6e8652", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235763, "uuid": "90cf02d1-9aec-480e-8db3-35db7341f8ba", "value": "0f071d9b13631c82b360d5857f6550c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bf40533-e08f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710261601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710261601, "uuid": "f0f82978-bcf1-457c-bb3b-7ba067190275", "comment": "Malware payload", "value": "e712f7853f09f263df3c012e4e9fad57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710261601, "uuid": "d9d757fa-b28c-4b36-90c9-31b701ad332c", "comment": "Malware payload", "value": "990ebe210d7459c86374c5619291981062176930e857312974f89df1f72395a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710261601, "uuid": "b7c6a213-d216-4afa-9aaf-0388cca5236b", "comment": "Malware payload", "value": "0cee125bc2f87d9808fd09ddb291f029a6c43dba", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710261601, "uuid": "64fdf800-f357-4381-948e-49ea89b682c2", "comment": "Malware payload", "value": "b5945c0a9fb62b3da832cb66538faf7ac2e75252ef08bb6b88e2a482c22f8aca9a8b0cd271f14227af7a46e920ef05c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710261601, "uuid": "68af8f70-e936-4e53-85d0-aef8866df985", "value": "T1B3C4E729736659B0D179C07DE946865AED603095133C91FBA2C1C9D8BF603ECBB3CB92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710261601, "uuid": "f0bedb2f-d214-4417-b940-eacaa1d1d28b", "value": "23d72874da0841595662fc34fa277974", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710261601, "uuid": "37593a7a-be18-4c52-afbe-1982c21eb2e8", "value": "3072:AUIiPA+da3ZuB6eorSehlVzt3A/ND07T/HpZM/3vmJTQSaMm5/6peH9LHqWyQoBB:lAQeJtiU/c/4WlUuCATSPd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710261601, "uuid": "bb4fe3a9-78b6-493a-bfdf-871c7b00b3c9", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710261601, "uuid": "e6dfc68c-3b4f-4246-8f20-d8bfc73779dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710261601, "uuid": "897b9683-13b5-4ed5-8b0f-cb3a8b058330", "value": "SecuriteInfo.com.Win64.HacktoolX-gen.20470.24449", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "842fbaf2-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710229967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229967, "uuid": "d0fa57ad-c7ee-4b6a-8891-108ca6997244", "comment": "Malware payload (AgentTesla)", "value": "377b1b018fa5a3eaac01326100bd1219", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229967, "uuid": "38c0db70-ba84-46d1-90bb-032709262bea", "comment": "Malware payload (AgentTesla)", "value": "99cba0a4969c5cf818a8f6abec732cd9976ccff9c01ce07d78e67db1c030f4ea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229967, "uuid": "5227d37c-654f-4576-a603-67b8a559cc94", "comment": "Malware payload (AgentTesla)", "value": "24dda5dd49317b415476e5ce2e60b1cab4230519", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229967, "uuid": "a8ac7881-fae9-4989-a997-98908e5ee948", "comment": "Malware payload (AgentTesla)", "value": "534c048cc9238961de7453337a23ceae89c3dcb3a8a33681afdf53be217b5952c187d2d13df23e0dec9cce8fc14f4f5e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229967, "uuid": "050cbb4f-6652-4014-9b0f-13d75a484d02", "value": "T102C40150569CC267CA9F47FFB8649155877AD632E12FEB8E7C8036EB09537C208821B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229967, "uuid": "af6fe7d2-bfad-463a-ae05-da19f650a14e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229967, "uuid": "1ec363f3-df65-4cd0-a845-e56d1384ee5c", "value": "12288:+XliQyswb3EVq3FRU4la/IEFsEzqLQHZNF:qwswlnraRFsE3NF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229967, "uuid": "f9a9ebaa-10e3-4eda-948a-d182a110f418", "value": 577024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229967, "uuid": "104f940f-42c9-4d9d-a4e3-41f655cc5528", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229967, "uuid": "921c8f17-71c6-4e5a-911f-524534ad16d1", "value": "377b1b018fa5a3eaac01326100bd1219", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4f77de-e00f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710206710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206710, "uuid": "6d38f365-e9fc-4126-9d91-d109d22732e3", "comment": "Malware payload", "value": "9ea6b20bd66476300a0ef9860272a18a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206710, "uuid": "f4b58a71-7768-45b7-8466-086cd53fc166", "comment": "Malware payload", "value": "9a15d100389330920a56299b862cb3fcc54e9625a097eec3a1e90c3d64cc9032", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206710, "uuid": "f5f8aef2-c01a-471b-a092-230aefdb71c2", "comment": "Malware payload", "value": "beff68fa6b0f2157372e21aeed9b937950511b06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206710, "uuid": "a6572205-0c63-4293-b61a-3482bf9da626", "comment": "Malware payload", "value": "b5b9e7892dec551e16a93e171b160634e1777943ae57f418d19fc6cd17e9a8853a8195a39fe10887acbb26794060c47b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206710, "uuid": "2803f990-34f5-48ba-8dec-fa173a7d0243", "value": "T1CA958E2037E08E16E16F27B1A4324A164771FD057362D34B13A4B6BE2CF27468D977AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206710, "uuid": "67a458a8-824d-4eaa-acf3-a4ca3ea609b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206710, "uuid": "80de2862-92b9-4c1b-a72d-94164b2ec474", "value": "24576:erGX4ynVmbQSP4gWvS/iR7PRNH9Z0K5Rbm95g/knnqkkZm:ldYmS/87z0KXY5g/kqkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710206710, "uuid": "27f447df-5214-4a26-98f8-c4f2364aaac7", "value": 1905859, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710206710, "uuid": "801101c3-29c4-434e-8029-f0bfc3d6cbe5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206710, "uuid": "064ceece-bb81-4435-8f39-5b271b073e41", "value": "SecuriteInfo.com.HEUR.Trojan.MSIL.Reconyc.gen.19801.4379", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48307117-e074-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710250052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250052, "uuid": "50b69b5e-17e4-4b00-ba36-393dc67be9fc", "comment": "Malware payload (Formbook)", "value": "431d2141d5c933804aedcab8718a8ff2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250052, "uuid": "c3c07acc-0f53-451c-a837-9fb895671687", "comment": "Malware payload (Formbook)", "value": "9c2aa09d9451a44b40e576dcc7bc5fe6e89eea44bd851a84b962ac94ae9abe25", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250052, "uuid": "b753d1c3-eac2-425c-9aa1-2e29e0e078a4", "comment": "Malware payload (Formbook)", "value": "7eb37e4f590da06bbc48e4d53cb2651a7ca1f9a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250052, "uuid": "3c1a5d9d-da85-47da-93cf-92188f09eeae", "comment": "Malware payload (Formbook)", "value": "dbcb9d5a2a634a2f469098475f8ce67888a88de7d95e455a67ea7a41de503424f027b1ba49525d264b58bd98ff8ba3b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250052, "uuid": "4b56f86a-2438-47f4-9f82-3da229631a0d", "value": "T179159EDE17D4F804F37F6FBAB564F094C6B2F4CA49AA825D0841A6DD3BB324479C06A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250052, "uuid": "1d710481-b5ff-4dd6-a7ef-d88837e01dea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250052, "uuid": "82f9d8d7-10f7-4a99-a12a-01f6338da3a4", "value": "12288:Nlt6bNBOmurJaYfumFKW3hFbKLEk20D82Yv9L1NN4lhUE8znN/KZCGO1QHNNsTrh:t2OFrJhuo3hZgE+8TlLnAb8rcZTtqT+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710250052, "uuid": "e4c88e0d-90e5-4fb7-b6fb-813eefef28d7", "value": 956928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710250052, "uuid": "b8268323-87a9-42f9-86ff-b521588ad0d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250052, "uuid": "39cd8c49-3f4a-4fb2-b8b6-a4933b205ea2", "value": "rChristineWolff20-45409-0-1243-ZE-7791-1-7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2499822-e023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1710215441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215441, "uuid": "d99f2bec-d0bc-4336-bb83-6b0c43422bc1", "comment": "Malware payload (Vidar)", "value": "7fe4b339fdab8707ea5bf11c17f2f64e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215441, "uuid": "139b114e-1870-427c-982d-0217cc971ae7", "comment": "Malware payload (Vidar)", "value": "9d57caba82184844fa627ec270f6b421700205361c5560aedebefde54e93a60b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215441, "uuid": "8f3d7b14-8c2b-43b0-a6dd-c287a900a8b5", "comment": "Malware payload (Vidar)", "value": "4014c7c7bbf892cca448e271b7fb23548d4c420a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215441, "uuid": "44c44299-4fa0-4a86-a06f-95c3a5c0cf56", "comment": "Malware payload (Vidar)", "value": "065f79f3443c68672349aae41bac3ad8c1899b6fd8e796a9671756a0e70bb3c618530b84cd6fd8ccb29b2874f9901914", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215441, "uuid": "9897262d-b571-46cf-90c2-4b464d3d31e1", "value": "T12336233341750199D4E9CCFED53BFEE472F7027B5A81ACB464DA59C62A229F4E203A43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215441, "uuid": "2b610045-e9a6-4919-acac-25a76866b4d0", "value": "e15e7135565f28d684ef019d89c4c474", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215441, "uuid": "8796b690-b173-437b-8966-52b99a9f4a3e", "value": "98304:/saGswP8ywT1kQMNS5lWjeRKg8SEKf34L9vqskwyQ:/sfsSkkxIfXRKp3GoQsd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710215441, "uuid": "81c120da-b387-4ca1-9b66-010abf361904", "value": 5062464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710215441, "uuid": "04a32073-4d76-4a0f-909e-85766c5ab920", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215441, "uuid": "8ea51f3b-20ce-41b0-89de-fede899817c8", "value": "7fe4b339fdab8707ea5bf11c17f2f64e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17f7510c-e066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710243958, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243958, "uuid": "73f1068d-5b3b-4e76-bab6-c275fcc376ca", "comment": "Malware payload (Gafgyt)", "value": "95911cd032b8f571fe52901be20d4cd0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243958, "uuid": "2681e7bf-c62e-45a3-9029-e24420575261", "comment": "Malware payload (Gafgyt)", "value": "9d57d178953edd886978e2de0cc214a2ef9d1c31dde22c12e61cde7b7e1b3a1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243958, "uuid": "aec41e99-042d-4f28-baf2-61684cc0a291", "comment": "Malware payload (Gafgyt)", "value": "53a24c9f6c53dc5f864626d44d19a48ff973b881", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243958, "uuid": "70a79e34-37ab-4c41-a777-05c245106a67", "comment": "Malware payload (Gafgyt)", "value": "4d38d567c1782a3e5a88f57cd2f192052ba8be3b0fd9d399375573f5f28fb7f2fab3cdb6a0fab10d361b3f7229922274", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243958, "uuid": "9da1c3bd-db40-4b24-9ec1-3c0762835377", "value": "T1AB933923ED125F0AD20BA4F061F59F351F22B8FA89975AD9E065DAE06543CCAB015FF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243958, "uuid": "b3a5c6b9-9ecc-4e41-a3e9-ed955136f804", "value": "1536:ZhZLXqLF0XxrwKYdo6nZz2ak0+Cvuy0/+ym5hV1qqpMm:1LqZ0XxrXYdz2ak0+/yIm5hjqqpM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243958, "uuid": "f8c82c60-8d24-420b-956c-3d09744cd546", "value": 92164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243958, "uuid": "461ccf32-c6cf-4cec-a2c4-8576ee51ce07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243958, "uuid": "9937e858-5fd1-4735-803d-f42b03751346", "value": "95911cd032b8f571fe52901be20d4cd0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fe66d94-e062-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710242307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242307, "uuid": "fc29469c-47df-4037-ae11-fba9d8576b27", "comment": "Malware payload (GuLoader)", "value": "7dd4d098facd0a2c510d8c099ef596ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242307, "uuid": "065d5f69-137e-4b18-9fda-963395e85910", "comment": "Malware payload (GuLoader)", "value": "9e736e95b0696a3778c29920955f40926072b4fa5aaba6fd8171153afd04fab5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242307, "uuid": "08474c1b-e5d6-490d-b14c-0a491fc047f0", "comment": "Malware payload (GuLoader)", "value": "18b31645430ef82819c02f0f0c5d4a8ec4328429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242307, "uuid": "5c1c7371-de4c-46c0-9002-29965fd12fb6", "comment": "Malware payload (GuLoader)", "value": "b552c11600d19bf110222f4b81833a520858d72c9a8b8b45438ceda5c09739844e7375b86f8944d7d7a13ceb4667d453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242307, "uuid": "0f0a8827-a43b-4eb8-b7f0-eb3567c77aa8", "value": "T11305127EFB5995D6ECA90270187BDF6725393E289873010EB257731A6972E93002F90F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242307, "uuid": "dc262a7d-78a4-46f3-ad02-692d23298ccb", "value": "003a54a0fe3c2a4dbf64143004ff22d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242307, "uuid": "b11ec779-3ce6-4f59-b28e-9c1cf137124e", "value": "12288:X1nnU0REibppIB75yoDK3z08f1AI1tuNW03+LskpuUQL0GGnNIlXKNeCPyxwUIjh:hnfrb3IBd7DKj3d5cW0+tpeGnN2K9MY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710242307, "uuid": "1f660979-fca0-49d2-a10f-b6214a0609a8", "value": 872368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710242307, "uuid": "8aebec50-0c66-45cb-a7d4-55ab07ac1c82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242307, "uuid": "5651aa18-8f2d-46f2-9726-ad913b08e034", "value": "rcuentaparapago.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f44ac66-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235783, "uuid": "6a28b4d3-51ca-40bc-9c74-a7a98c63202d", "comment": "Malware payload (Gafgyt)", "value": "937c121d0861f0169a369731877a87ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235783, "uuid": "2911d80d-cc5d-44af-a6d4-fd3d52d405c0", "comment": "Malware payload (Gafgyt)", "value": "9ea2ba3ba1bc6ae5fc4e9c2b1860711da12c7898b074b83656dc6992d279f9b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235783, "uuid": "c121e8ff-cd89-46ab-bcb1-50350bde7ab0", "comment": "Malware payload (Gafgyt)", "value": "c181efe3b8e12eca583f373a51416aa5bec054dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235783, "uuid": "db7420eb-3f19-4d5e-b154-03e56d5d97cc", "comment": "Malware payload (Gafgyt)", "value": "055cbc25dfee1a01558939ac191a6223aa8e33186e4c23bcc23172886816b8aa63182e13aad7945d8c1fa8c079c09b85", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235783, "uuid": "41762283-45cb-45d6-9dfc-e74e8d092b79", "value": "T18F24B83721232B51C4D5DFBB42A24338B4BED9AD345A0BD3A98D6DD93D30DE135922E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235783, "uuid": "d810da45-75d7-4f22-b555-aeba180b5b37", "value": "3072:X8VcYOZNP/em17BmzPGdc5X/HEEaq8UtEiX:X8VD6lvKzedsX/HEEaq8UtEiX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235783, "uuid": "b1cb4926-e869-4e07-8ece-91ea94954629", "value": 211785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235783, "uuid": "17244943-99f1-4fae-9bb8-f0c59459529c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235783, "uuid": "b519def0-8ba2-4869-9bf9-d8be6d31854a", "value": "937c121d0861f0169a369731877a87ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91700375-e063-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1710242874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242874, "uuid": "cb83773c-fe8f-4196-9db3-b3d1bc6cce97", "comment": "Malware payload (AveMariaRAT)", "value": "3a3752bfa76ae16628e03d4a00b3e1c9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242874, "uuid": "2048d1ee-5faf-4f18-94eb-25f121d446f0", "comment": "Malware payload (AveMariaRAT)", "value": "9eaab6282fb6588621de05823543a2077277b7ac9404193bfc77819083ad58e6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242874, "uuid": "63921733-9ee2-42c5-acec-216bcafbe426", "comment": "Malware payload (AveMariaRAT)", "value": "d5194572e7781aa893f84e59046bcc286d76ee62", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242874, "uuid": "169f42f6-5c32-4569-9497-0d327d62afc5", "comment": "Malware payload (AveMariaRAT)", "value": "4df0411a675a02895d53453cd85c8896deec2fc13a7f64f53bf12b8f914c378a1f42f55c82e68214f7ef5727079a7952", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242874, "uuid": "42a6c065-280c-4e94-9b0a-d4d75d0a6546", "value": "T124036E1173AC8A3BCFEE47F56821624007B593627A43CF9D5DD865DE589BBC403123A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242874, "uuid": "27f9eca7-c551-44ee-82e6-9ce1e1ead1ab", "value": "768:Qnbsx4iDVJLU0DA6Xlnw0ei1s8jdj6yV5SNUI:sbsx4oVjXC0ei1s8j6yaNJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710242874, "uuid": "777e15ef-ae18-43a6-90c1-c3ea3660b3cd", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710242874, "uuid": "76eeb182-0735-492b-bb97-391a1253247d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242874, "uuid": "19fbaa9d-66ed-49ca-a703-b975d5b2deed", "value": "SecuriteInfo.com.Trojan.DownLoaderNET.943.16578.26938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57eeaba4-e07e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1710254374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254374, "uuid": "c813894c-8135-4391-b548-40e7988593a3", "comment": "Malware payload (LummaStealer)", "value": "fc7f877c4eb2f5268558814955a216e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254374, "uuid": "18687617-fad6-4997-9922-1300c22c6f1d", "comment": "Malware payload (LummaStealer)", "value": "9f6da57add2cf297276ee2d6828cedaff3c689503f9a0492d8d720b0a86be300", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254374, "uuid": "23f20901-f952-4f50-817d-d803fd6f55e4", "comment": "Malware payload (LummaStealer)", "value": "cd7851a00da69afc38319210d39f9863ae292b3f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254374, "uuid": "bd0b6a0c-7f5c-4933-a580-7f9b6b0cffc8", "comment": "Malware payload (LummaStealer)", "value": "2746147b06ebc5b4b0a613172122f73d90569b630c584759f88f56107a1116003f780be41558039db76aff7f31d0659e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254374, "uuid": "21012d23-72e9-4c41-b05d-669b933bca39", "value": "T1FEC49D0AB25FC921D2981B36C4CB922553B19983B6A3F34E76C913D61D123FA990F7C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254374, "uuid": "aa76ef50-cfa5-4543-8a02-3e9b9e73ce30", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254374, "uuid": "f68e0b73-f402-49f2-98b8-7763f64f7c22", "value": "6144:IJAGr+6EyqOCv6IU/U6Vjx5Ov+ISBuJMu8lAJFWjIa1h7XOU53WHhGaBCEY:IvLCve/p2ZD8mJVafOUYhGBEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710254374, "uuid": "2e9a077c-70bf-49ea-a449-b0dd3bd642ec", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710254374, "uuid": "3a5c8638-c4de-435b-8cf1-4f552556536c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254374, "uuid": "c1877b41-8923-4f5b-b18f-ca70294bbaa5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5953b8af-e04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232472, "uuid": "3582b76b-942f-43e1-8d29-77cecdcff106", "comment": "Malware payload (Mirai)", "value": "f34d30171d7e030a0f368be1f398f42f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232472, "uuid": "672a5ae0-fcb3-4de2-98a8-2123314d1e0c", "comment": "Malware payload (Mirai)", "value": "9faea09cbca1c82bcbacf6d9a60baac8c493b51ac8cb29d7859e998a1f3c2ce6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232472, "uuid": "82c34ec6-730f-4587-a83f-883f57006c4a", "comment": "Malware payload (Mirai)", "value": "030f228186a7446eb14ce988c8f61d34ed3904bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232472, "uuid": "52d8eead-ffac-4015-89ba-c156142dcc89", "comment": "Malware payload (Mirai)", "value": "909fd84604871ae543f2b6c31f93d461afbbc10dfdc5674a5ef28d5f1637d39b0ca45b47f6934810ae064d77c3efe730", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232472, "uuid": "119fc645-2a42-4e56-9f00-e77fa6053655", "value": "T122639209BF611FF7EC6FDC374AE91B4525DD641A21A83B397930E818F24A24B19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232472, "uuid": "4bf13fd6-2b02-45ef-8853-63bc4b3e57a2", "value": "768:CDScD5GY2naf8i2Sxt9yYExR15I3I5vTemle5Re5brvuX5XiANe1j9zE:CDSC5G9afb249FKeI5fl8RWb7Sq1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232472, "uuid": "6a1ec49f-e3dc-49ef-8f69-200db36d866c", "value": 71568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232472, "uuid": "4984e817-d778-45a6-a322-41765a47ce35", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232472, "uuid": "81767b20-c4b7-4675-b59c-086f5b42d77b", "value": "f34d30171d7e030a0f368be1f398f42f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5ef9de-e066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710243969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243969, "uuid": "9e1aa7e8-88ac-4209-b7a3-573b150b23c3", "comment": "Malware payload (Gafgyt)", "value": "87afc02def8c009557ce4b5e7474d9b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243969, "uuid": "24a56578-018d-416f-8659-cbd7efccb098", "comment": "Malware payload (Gafgyt)", "value": "a13a89105fc6f3ff2679c29d0a462ea8bfc65ef0b429cfc5de1995c5ceba9448", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243969, "uuid": "418ce1e7-4294-49a1-9dd2-710c70127dfc", "comment": "Malware payload (Gafgyt)", "value": "ed46f071aa19c0916f95f2d004d3a1885d683b89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243969, "uuid": "82341edf-6708-47ac-8405-e1f8bc7f4dc6", "comment": "Malware payload (Gafgyt)", "value": "35875e50ce292cfb2038dfaecfa2000824dff56fcafb0f1cbf400c4155c805a4f2a74d1206327906343738ab1d57375a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243969, "uuid": "23cb982b-a418-4f65-a7ec-0e0923aa1586", "value": "T11A933BDAFA42CEB3D06310F116EA6B218971F9FB1C23D682D7647DB09D111C19A16FAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243969, "uuid": "b96b09b9-5aa6-4f56-9dcc-8c6441c3ce8f", "value": "1536:1DGHrBPQsMebMarLyEeHu7OUvsEyabYB5b2LV2xOqnJ33xZuEgk:ZkzFMarLYu7EEY/2JOJ3BZun", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243969, "uuid": "636c8a88-4725-4d4a-8197-e4644d789ad1", "value": 91212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243969, "uuid": "fa912537-9353-4d19-8e5c-f58362a5384f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243969, "uuid": "689a9820-709e-4a79-9017-2191f8baeec8", "value": "87afc02def8c009557ce4b5e7474d9b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f1e54a-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238504, "uuid": "500f992b-2a2a-4651-846e-ecfacb9202b6", "comment": "Malware payload (Mirai)", "value": "784c284ef60f2ec0a8599e24ae935ec9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238504, "uuid": "ec7f06cc-d5fc-4989-83ec-e63df9b7eef3", "comment": "Malware payload (Mirai)", "value": "a280a0c16294446e32b4ac747793e80bbca0673f024b1fc408536195363dbea6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238504, "uuid": "13a71d98-9bf7-4869-808e-64eaec6176c1", "comment": "Malware payload (Mirai)", "value": "e1cec322cc32c9c65e14778c1eb9c5d021287709", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238504, "uuid": "1b68157c-af11-4cd1-b3e1-73ff3a9dac5c", "comment": "Malware payload (Mirai)", "value": "219fe34ceacefbf4542c53a7270143501374fa2170aeda72cf2a3a3a11b5da65f05dcffb0b6eff2e8f0f956ce5e053b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238504, "uuid": "dcd71f5a-444b-448c-9383-e13f4844dcb6", "value": "T1190302F4132B8B6E423C6E3D57BCE40283F259FAE5DA39601120129CBB45B1D02F197E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238504, "uuid": "12cefde3-b2de-439f-9532-f1d58175de19", "value": "768:IxR0aNZwSsLCa0kUheEZgPuj0kj9AtY6GzLOR0MSQiJtsAs3Uoz9:Ij/NZKLckUkPuj7qqL2LSRs1z9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238504, "uuid": "d95a37b5-1f48-42f6-94ab-e103a71f4a88", "value": 39832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238504, "uuid": "f205da6b-1d1a-4308-8c3d-1019575ec4ba", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238504, "uuid": "72eb4496-5b86-4084-868f-b0ec74d02318", "value": "784c284ef60f2ec0a8599e24ae935ec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ea23578-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235836, "uuid": "9606b638-52ce-4522-aa5d-a18ed5a5de73", "comment": "Malware payload (Mirai)", "value": "214840f3adf031a7e658b4d887a32a7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235836, "uuid": "737d9f7c-2f48-4a1c-bee8-c8ef5dcdcbb4", "comment": "Malware payload (Mirai)", "value": "a29950c80e70b0833aaa61d4b41aec411b9e57ff943d5445daf5416dcc7d0abf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235836, "uuid": "d3156522-ae4c-4a76-8e7a-5e1a096347d7", "comment": "Malware payload (Mirai)", "value": "ba47d6330e54c2854c05ee983b3ed964deceec75", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235836, "uuid": "ed8d7422-e5f1-4596-ba36-6429d7bad7b2", "comment": "Malware payload (Mirai)", "value": "1a859820fc00b24f500b04e43233e765cda49faac067f2cae84159df827a7f5409b54c998e3d48364f0337891819d6d8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235836, "uuid": "f2c93253-24be-49b3-9855-2486a3a0bc00", "value": "T1BB03E161476D0DB3813890B4BA395B876EEA067C52FB737E10798FB5B41DB072533281", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235836, "uuid": "2c7c838f-6b70-4776-ac13-95051a3b33c4", "value": "768:tlqYgcPpTz4IJRHJFO/XMyOjpQlt6F9tPTqIEFq4ns3Uozc:tDbPpfZvXYMj26FLGITLzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235836, "uuid": "7df05b8a-6a62-4ccf-a9a6-68f0b7743c5c", "value": 38348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235836, "uuid": "27781bd7-fed9-4817-9534-96cfeb362813", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235836, "uuid": "150589e7-be6b-4691-9d5a-b2bdd72ba2bf", "value": "214840f3adf031a7e658b4d887a32a7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb04c99b-e031-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710221469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221469, "uuid": "020e2cca-5183-4db8-baed-568951bcab45", "comment": "Malware payload", "value": "19184fb9e210485f5465dd58bea65104", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221469, "uuid": "e36de2ec-5243-46cb-ad6f-5593469beefc", "comment": "Malware payload", "value": "a2c949f2d56901109c99c0ad31f6b759cbd5db93b5af9b812cf63140bdf9686a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221469, "uuid": "408ef65e-7646-4f44-94bf-59de4ec7d40d", "comment": "Malware payload", "value": "c6913c44282e6704df7f47375a1b83a1d486e0ef", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221469, "uuid": "cd8b55a5-1f0d-47a0-8948-a60219c43a01", "comment": "Malware payload", "value": "83ba9ca50ac21e04dfc472c391c4d38b2d340c50b78c4251a3cd669a6bdf06f2a66ffda3e4d27236aaa6c4bcd3fc6dae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221469, "uuid": "cf3df053-7141-4f2f-8028-3289884b8d69", "value": "T1EC762324E6928E7DDE175AFDA04E45EBAA6F9DE313C5003327F095D1CAA42D0841FE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221469, "uuid": "bb11f302-e988-444f-99b9-da350023acdc", "value": "a0722f4d4407b49f848f72fd4df721d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221469, "uuid": "70c57124-14d3-4ceb-a7de-896597e9d6b0", "value": "98304:DwIm3vc0p5at/7rTM9n8fl/tIi5A/K83k3fYChTkxAPljwl5ShlnAb3u7lu1:DxWvtC9TM90tFYk3XPljwlIhmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710221469, "uuid": "cbe66191-4c1f-49eb-99b3-545666f9a92c", "value": 7260624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710221469, "uuid": "a8b480bb-df35-463c-a2c7-bad1ffc62010", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221469, "uuid": "00c6517b-0cb9-486d-9dde-aa165e8186a5", "value": "SecuriteInfo.com.Trojan.Siggen21.29401.1678.25545", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6294445a-e0be-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IcedID)", "timestamp": 1710281879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710281879, "uuid": "91a08869-e763-4d64-9837-799700bcd7aa", "comment": "Malware payload (IcedID)", "value": "06cc2fdfd408c15a1e16adfb46e8bb38", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "injected", "colour": "#AEF41B", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710281879, "uuid": "2e2ac370-d442-4540-9832-f72ca59521fd", "comment": "Malware payload (IcedID)", "value": "a3fa68045d0106d6db3d43df6b5997d9034f9f7d2a34148187498e4b504ebf58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "injected", "colour": "#AEF41B", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710281879, "uuid": "16e02b34-ef44-4f71-b0d2-dfba46f2a7a6", "comment": "Malware payload (IcedID)", "value": "585cfc19bdb8dfb92407e917615be1ab9dd523e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "injected", "colour": "#AEF41B", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710281879, "uuid": "d33ce534-6f25-4d73-a394-ba1b6ab3200c", "comment": "Malware payload (IcedID)", "value": "efa33eb3c36a3010eea63317453545e5cb18e61090686f101a346b0d8d473cb0a2e8ef489b532ab48d4ea6ec5ccf7b88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "injected", "colour": "#AEF41B", "exportable": true, "hide_tag": false }, { "name": "PE", "colour": "#88D5A2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710281879, "uuid": "84b7ea49-4bb7-4c26-8d62-13c43f9ce252", "value": "T15172399E232105CCD0BBC679C5951A27E2F278684623861F10E4CEAF5F277226E6EF15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710281879, "uuid": "8780295c-d4d3-43a1-92ad-805225ef60e0", "value": "c8c62b0edf4a5f76dfd31e8262b5adbe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710281879, "uuid": "a02ec9c6-e467-4609-b909-fcc301b5b400", "value": "192:6P+nM5KC/zxayGc3gzq7YjDaqzJCueT+RfbZne9s6PLRP0tkYGijY5:s5Jxayczq7Yjt9lfle9s6PL16kYGi85", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710281879, "uuid": "5050ee46-b2ea-4892-95bb-b691fa055908", "value": 16320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710281879, "uuid": "2f7fbf4c-d7bd-4ffb-9896-4f5e8296cf35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710281879, "uuid": "e243d91a-34ed-4269-995f-d7d650e398bd", "value": "svchost_icedid_unpacked.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "256f6616-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235391, "uuid": "cfbbdb27-5b15-49a4-99a8-59a71689ef48", "comment": "Malware payload (Mirai)", "value": "bc070f29a0296f3b698b6eba0b1b0bcd", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235391, "uuid": "e9020e13-6d43-4681-9083-2bff896eb702", "comment": "Malware payload (Mirai)", "value": "a5e27776f019bd4ae9be203a4316f4df769fbcf194b3bf32e0965c5064282f91", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235391, "uuid": "e5c1381b-c8ef-43c6-ab89-bea66f9c441b", "comment": "Malware payload (Mirai)", "value": "236ed0bc9d6a3999919cb8889ad0ff16b834d4bb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235391, "uuid": "736f883b-b01f-44a4-8a4e-d55ae56b6c88", "comment": "Malware payload (Mirai)", "value": "9967ed373c1edb75daf3c3d2e58a33821241399619c80a79816c57187a6914fac27e6a4a4d19804f6a78591b46322b7e", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235391, "uuid": "07d0db29-df10-4755-a2c2-aecb4d5c964c", "value": "T11FB35B86BA8540FDC145D0781AFFB53AD821B1FD12BC769737D0BF122C59EA00A39E96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235391, "uuid": "0b16fa83-68a7-4715-ab3e-7f9a507c8056", "value": "1536:gt5BUQhvYyf+QQJJtrKbpF+ZyrBMPnoYhlc0eotdAwvDJLgUg/q/:gt5ary23JJVKL0yrgoYhlQotzDJLgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235391, "uuid": "51b4e9b0-72b4-4cca-9466-5782e385d37a", "value": 108512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235391, "uuid": "6035dfb5-604a-4a72-82f4-644e44987c9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235391, "uuid": "3347f7cf-2fad-4478-8bc8-646c3febcf83", "value": "bc070f29a0296f3b698b6eba0b1b0bcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77984f4b-e076-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1710250991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250991, "uuid": "28b90c44-5d9b-469f-a6e7-8dc8ea9d5bc1", "comment": "Malware payload (Adware.Generic)", "value": "58f524ff8caa2de50763e5dceaed8d90", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250991, "uuid": "fc1f378c-6225-4a39-80f9-cbc12db2ddcb", "comment": "Malware payload (Adware.Generic)", "value": "a605b2ad567ceab740ec847beefec7140a65e91651d739940c0ca51c02430174", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250991, "uuid": "5961b362-d96c-405f-95dd-b1397d7dd7e5", "comment": "Malware payload (Adware.Generic)", "value": "8df8b968d05b24ac9d51e3ca1c2c11ea74fc0232", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250991, "uuid": "8c9bce96-c7db-4f93-9c81-c20bb0e4f3da", "comment": "Malware payload (Adware.Generic)", "value": "7cd95020b32448629f30731fd26aaca181409f25acf3d877aea46f7a3b395c5a2433b8e8686d21ef1731e5615b2148f4", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250991, "uuid": "2e3dbd0b-fc70-4de3-bd0f-2a76826d98ea", "value": "T18F16013FB268A53EC56A0B3245B2D230A9777E61A81A8C1E47F01D0FFF764601E3B655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250991, "uuid": "47a3ca01-3718-4b18-93a1-7f6412869c72", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250991, "uuid": "535a1368-077a-4d86-b70a-2e45363606ef", "value": "98304:AkLMTLxD2lpwZ720yT5T2AcguiJi4GTCCTzj5uS4MBV:fMTL1SeXId82GTCej5uKV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710250991, "uuid": "09c3ea17-c55d-47ba-a542-b778d22a7d0d", "value": 4097508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710250991, "uuid": "18d153c6-e9cd-4895-b09c-5b8c61cf15bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250991, "uuid": "ce7ad67e-47be-4638-a56e-281e0082ff0b", "value": "SecuriteInfo.com.Trojan.MulDrop26.33761.26609.8917", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3853721a-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710227692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227692, "uuid": "49c2c62a-675e-4ee1-877f-759093576a8d", "comment": "Malware payload (AgentTesla)", "value": "128e223aa9db4e192ad1489b8f5b560b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227692, "uuid": "dafe204f-164a-4b1b-8f78-50e712b0e9b6", "comment": "Malware payload (AgentTesla)", "value": "a62335d4771982af2a0b257505a0a3040e108be7ab2f7b5fb5d85d5029685a91", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227692, "uuid": "8f43cd75-ddea-420c-8137-e30076e5ecbe", "comment": "Malware payload (AgentTesla)", "value": "62244be6ba8056a99127f00452b3faa9e56cb4a2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227692, "uuid": "c0f9af6f-a810-4902-8430-8070be2b8204", "comment": "Malware payload (AgentTesla)", "value": "b14309171a3c3b75065a43304ee73af79ae1b8dcc7175b1b39648043c826beb4f0f7e04274bcbb7016dc5f580885fab3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227692, "uuid": "5ee97ea0-901c-4cb9-b6a5-ba01bab3cbab", "value": "T16915124A6A20CA9DD0659B379D43A2659666CFA03F37C51EE81F333ECB35BC87D06121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227692, "uuid": "09c463ae-d07b-4031-a452-74c44660d24a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227692, "uuid": "52230bb3-e4cf-4ee1-9d8b-1755f4d2fb84", "value": "12288:s/Sr+pAQ3inVFaMdklcgKOQw54HoXPxyTaGWkquemE8KMvnsZUn3/JPS8z:X+AQ32HBdklcHSU+0NWkquemE8hs4PV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227692, "uuid": "010ea372-1303-4867-94cd-7005035a2d7c", "value": 901120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227692, "uuid": "177e4de7-1471-4c76-9ee8-ea49d638823e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227692, "uuid": "365b9cd3-390f-4d11-9676-871cd9517c0e", "value": "DHLdelivery#20240311.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "945389f8-e058-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238154, "uuid": "5de4f143-9843-4714-b604-6f7eeb944429", "comment": "Malware payload (Mirai)", "value": "82a35244dc3178836c71206d38577022", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238154, "uuid": "a0f486d2-36eb-48af-8979-d659beb71c53", "comment": "Malware payload (Mirai)", "value": "a9080a9b45f11e30b49ad898d4b2e9c617ff3091d6b1762063e969db095aadf3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238154, "uuid": "1b966c6c-3079-43cb-b7ca-def9a687021e", "comment": "Malware payload (Mirai)", "value": "2939e0317ba9fdd22d8b1a2a20e823c17d8ad7bc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238154, "uuid": "e799af60-9262-4833-bfd4-96c15cc6860b", "comment": "Malware payload (Mirai)", "value": "08768aa855e13ffd19ae35365cd8a12187b5fe73e95644cb51b8d68302f87bee71be186b90cc4d91ea56d338abdd4b38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238154, "uuid": "eef867ee-571c-494e-bb06-385996fb77c1", "value": "T1E8F2E576560BF2FCE8A4127CE80325B92993442938DDE7D3B047563AFAE6B4C2D31D19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238154, "uuid": "1b9f37d9-2f54-4305-8525-0667feffe9ae", "value": "384:VjF+62nnK69+Tsemdsz7z0WjpZ7JWxcjPbYyh4V7hEVzLdXEz8BXio6IYKjftNde:rgnKI0L7/rZbTh4mvREqlZj+Ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238154, "uuid": "28bfc612-1637-45b6-a1c8-a384446cb495", "value": 34484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238154, "uuid": "afbb00a1-140b-48bb-be66-5ff468ad6fc4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238154, "uuid": "e2e743c3-f3fd-4f89-8d65-87c1874b4772", "value": "82a35244dc3178836c71206d38577022", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c4d32e1-e05e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710240691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240691, "uuid": "d7519fc3-a867-402f-8fab-29f85cadd49a", "comment": "Malware payload (AgentTesla)", "value": "8368369f13b5e6cb966b05059a52c735", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240691, "uuid": "75838e41-e0d9-4449-b6aa-d9c1a5a1239e", "comment": "Malware payload (AgentTesla)", "value": "a92953d67221c08b9f84d9f4abe80183fe921c4a2d44cd22b0aaa9a7832e2def", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240691, "uuid": "6ce89b20-4a11-4e8c-8bc6-c46bf058be0a", "comment": "Malware payload (AgentTesla)", "value": "82f2e4db4ee70c73b3a7a98aea67e20bb977135c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240691, "uuid": "f9a9f8bc-ac2b-4e8f-b9aa-ff3bf9c06dfd", "comment": "Malware payload (AgentTesla)", "value": "66c851dc66c2129d58c3a742bcbe1358303f12277bd47c32f21404a250423fe7599f7da3c4507ff802a184c2db3dfe94", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710240691, "uuid": "fcfd207b-6def-4ba6-8d0f-bf05c43c0cf5", "value": "T1F964E061FE85820AE845473188F79FAA6325FC415F534A0F321CF72D3DB43A56E27A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710240691, "uuid": "89272d70-e58e-45bf-9312-8c814a59af0d", "value": "6144:vWunJBwY35qAOJl/YrLYz+WrNhZF+E+fgL+0dD8ivSbVNrMIc8xt7tq6OL/q88E3:vHJBt3bVNrMIcKlOLiP+rIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710240691, "uuid": "6ba7fa28-af13-47cd-be63-31da8cc8eab4", "value": 325120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710240691, "uuid": "43a08769-9799-4f3a-94c0-277cc2f55524", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710240691, "uuid": "1ee59c48-f295-497c-b372-6e43bf3a818f", "value": "DHLXInvoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63ef6f2d-e018-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710210585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210585, "uuid": "8acc3c4f-2e00-4bd8-91d3-e3d25c928923", "comment": "Malware payload", "value": "1734d7740bebc0e31be053c6ef5c4d71", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210585, "uuid": "cf95698c-dd08-4e07-8c61-bd4f53d32610", "comment": "Malware payload", "value": "a98114ce152b1667d743eec79114e365f43e2d30c1e05d19cb8020122ec4267f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210585, "uuid": "bf246cd9-9b3c-4c84-9f4e-92a1ef5ac16b", "comment": "Malware payload", "value": "a1834a36d97da79a7d638ea843e7eb65a85554de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710210585, "uuid": "f0e752a1-32b2-4b0f-a24f-ade6f5017d49", "comment": "Malware payload", "value": "f0b25400a1dd699d31fd75a7a2381b5dfd8c0def47f566a3be4d5de0a95eeb9580ed53e1c021efa5e8e2f52b223717d6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210585, "uuid": "c6eb0900-cd5d-47b5-8bc6-4ca545821065", "value": "T10A646C73F7E04837D1232A389D1B5F75DC2EBE202A2C55861BE92D4C8F396927964393", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210585, "uuid": "1ff48b5f-1056-4712-8e65-d3f64d8ce01d", "value": "83e717e63653dda778ad8e62dea34917", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210585, "uuid": "ccdb60f9-bcb0-438c-b490-1b01072f747d", "value": "6144:08X9oK3Lpp1N5d52h42JGxZZxZZpNp3HyOyBFbra4:08XS8n1Xd5Q4jNNp/W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710210585, "uuid": "e15a4eb3-736f-409e-bd89-1178d26b3f37", "value": 321536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710210585, "uuid": "3d6e515b-ad1c-4421-a18c-ef375bdb8196", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710210585, "uuid": "1f736f76-8419-4ab8-982c-e60e66ecc401", "value": "SecuriteInfo.com.Trojan-Dropper.Win32.Agent.tevctc.24718.21603", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3420f4f4-e06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710247442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247442, "uuid": "48bbf233-e235-479e-a275-50ab78ce57c0", "comment": "Malware payload", "value": "96b5933e584b4a63a85368ff0c6df0c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247442, "uuid": "eae28a94-47d6-4afa-839d-06c474186823", "comment": "Malware payload", "value": "aa0e0aaf520bc8ea029de264ca2c2ff54f8c076fcd96c14285c66f19a3374a95", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247442, "uuid": "c089b6d3-745b-4b72-b761-a4ff16f35fef", "comment": "Malware payload", "value": "4bf5175ce08660774ef52787ef61030c770851c9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247442, "uuid": "dacb6733-93e5-479e-8f72-b309afdf9e87", "comment": "Malware payload", "value": "dd79ea20425a96fe2975331c555b2e2ecdc4b34ba6b90e95e9e5d963eac48b79fa590dd3b20dcfea7ef57b7d23c3ef18", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247442, "uuid": "80e0fdb6-358c-45fa-a871-dba44bec2172", "value": "T1CBE65E8733D79DBBC8D16776AEDB23384713FC325E1B4A97768A832884476885E06F50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247442, "uuid": "e4ed4b41-ccc3-43b2-b1ff-f654496cc5e7", "value": "28376f6f8770cc85c98e916001d5f0fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247442, "uuid": "b1054dd4-477c-4ec9-bb70-a50aff7e7d23", "value": "98304:ILNhc1cojhK1CcE89CnbI6DdD5DiPNjeD1952JYol+VH6guVuABhN/aUAtywU5Fp:NjhK1C2CnviPNjeZ95SYol+VH639wK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710247442, "uuid": "52253e1a-8897-4ff5-bf0c-956da5d7b710", "value": 15101853, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710247442, "uuid": "fe14ef5d-c494-4287-9c6d-5c260cd5f17a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247442, "uuid": "2a6d1c2a-d314-4d3d-b664-4563ac4a9fb8", "value": "SecuriteInfo.com.Win64.Evo-gen.10233.31562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6cc6f0-e00d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710205932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710205932, "uuid": "352c7edd-1e9e-4c64-9ec9-ca072d0dad15", "comment": "Malware payload (AgentTesla)", "value": "ccd3e02044cbb142d3f74151c017b7fa", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710205932, "uuid": "ba4b19e4-5022-4429-93cb-cdfcd74a3fcf", "comment": "Malware payload (AgentTesla)", "value": "aa92559b13cde3bae21652f0dcdcf35ba0294baebba0db971af36127c8d6cd4d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710205932, "uuid": "25fb6362-4b18-4569-bb97-c019e2606ea7", "comment": "Malware payload (AgentTesla)", "value": "bdedb46f8d0ed904982103c37de98a572187feec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710205932, "uuid": "a3772a47-0164-4c6c-af90-a38c3d7e5298", "comment": "Malware payload (AgentTesla)", "value": "13421b1f1728396895b67d7acc55a3176b1eee19912fc856ab01636bd01c0949d280172024b50ba805a64bee7224f56e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710205932, "uuid": "545a3b5c-5e94-4320-9417-6465875620bd", "value": "T19F268E0ABBD801E6E527C730C62ACB32D6B1FC651636C34B1A52F74B1E736914F6B225", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710205932, "uuid": "2abaec7a-b046-4b6d-8858-50ca8d237e2a", "value": "119c731b693ee255eea5e117a5cb386f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710205932, "uuid": "824b9f13-93bf-4f86-8f66-ce0af8eff6f7", "value": "49152:ThmBvgm276ZLLoF1ZghS8drWXFkK1PosuFMaFPj3mX202dmY7S31KmHH:TCyUWVkYALmd2dS3xHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710205932, "uuid": "a5643273-2b43-45e1-94d6-0fcd82b18fbd", "value": 4472832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710205932, "uuid": "1d50318e-919f-411a-bb0f-a6532ec91d93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710205932, "uuid": "11449ef1-439c-499d-9dbd-b4a95be8bbcb", "value": "FinalDraft1010CLEARDETAILSBL00398893PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e8603bf-e037-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1710223890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710223890, "uuid": "dac33f69-9e43-4ed0-9109-f363147d28fb", "comment": "Malware payload (Stealc)", "value": "89eb5ec9d21a58c86167b8508b57b52a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710223890, "uuid": "dea90d1b-4964-42ce-8bd9-dc8133ec5c65", "comment": "Malware payload (Stealc)", "value": "aaaeb2a1139927065c2a27e7f200820745928177937758eb71c3fc0764a94337", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710223890, "uuid": "cb14c466-884c-46aa-b7e1-ce6946b2aa16", "comment": "Malware payload (Stealc)", "value": "cf2db1140263fee267f6e22479b80ce11d406e2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710223890, "uuid": "7342fe45-1cb8-4e19-b54e-e2af66745c6f", "comment": "Malware payload (Stealc)", "value": "c74bd01d5c8ff6a102336a83c0a2403e030f48d4c91b3de648a3c2916014ade9ea00ea9f368d102ce4b43f97b9ceabd3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710223890, "uuid": "860ff4ff-d42f-48cb-839f-96d2e63438c9", "value": "T17664015032E0907EE0A7463045B1ABA6896FBC427B7814BF3A7B332F5F712D44A7031A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710223890, "uuid": "0107ca99-2164-4900-a529-185e40fc1b68", "value": "1bb1293e85bd1bd33a1b6174e328565d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710223890, "uuid": "7daaefc8-d0ab-4b78-9787-dccd29f7a015", "value": "6144:no8a50R7m1VxQ2/EexEiyRRseqU3Q2jqpnN80ZrmM3UbI:o8a50Jm1XQIxEiMRrqU3Q2CVlmM3kI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710223890, "uuid": "41c9893f-c0e8-463c-a2fc-5c4c51520dcd", "value": 335872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710223890, "uuid": "1a7e97c4-d678-4421-963a-e2f20c760471", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710223890, "uuid": "b692d597-6579-4a2d-a3e8-d6fb0d4a1446", "value": "89eb5ec9d21a58c86167b8508b57b52a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1576f2-e07b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710253258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253258, "uuid": "566ac635-b718-40cf-afae-5bd9c20b635a", "comment": "Malware payload", "value": "033a6d118ad0fdde8cb21911195b6bfc", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253258, "uuid": "d2306628-b819-4b03-a143-d31693b5eb61", "comment": "Malware payload", "value": "aafe428418783ba9ddcde2504977866f8792aaa5fb55f2b49030340915680f9c", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253258, "uuid": "2699f887-8652-4791-9559-1425e0336fe6", "comment": "Malware payload", "value": "494802a7ad130def88892b6e841540db819b9a5b", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253258, "uuid": "93f11bfb-7618-4436-8999-2d17a31fce37", "comment": "Malware payload", "value": "3dbd5d1295188d08148a952ae99f77eeaad9d4f72d92aa14f94b3ab423d2b723c2dc705fd4a1c682efafe3e03899f377", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253258, "uuid": "34beffb7-ef74-4d91-80c5-c3aad90623f9", "value": "T1B4948BA2858AEEF0335C7E3EE65A571FE54CD4024712A46DF202D5C2F7D8B8207961EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253258, "uuid": "44ced1c9-214c-41cb-92ae-e456b1a29e04", "value": "6144:gb+PmNmTB/Gu/QScs8q986lQAO7WhKdHXZSLQfBnFTm4AHOein:gb+9DjP8MC7p/fpFS4Win", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710253258, "uuid": "f35cfa0f-1815-458e-9862-440434534445", "value": 434324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710253258, "uuid": "612c8815-4698-40ab-8bbd-48adbdf235b2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253258, "uuid": "93e0b216-7c0e-41b5-8be4-53c1ed00a5ed", "value": "Victualless14.pfb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a4212b6-e060-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1710241358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241358, "uuid": "53344d01-2240-4291-8d8e-546b0bd29639", "comment": "Malware payload (Stealc)", "value": "27b3e45a81641d0e7d0dea29938774ae", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241358, "uuid": "747a6c06-4855-4f3e-9020-a00e443fef25", "comment": "Malware payload (Stealc)", "value": "ab7237aba6c89c09aeaf5111575614041aafc280f2461f3e669195ce6943e4e1", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241358, "uuid": "b72e1b07-940e-488f-afb9-fee40b00f55a", "comment": "Malware payload (Stealc)", "value": "b169677b0772e523a49aee97a0d5aca89ade3068", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241358, "uuid": "b4e5bd31-8360-42c9-9e54-5355cc466c5a", "comment": "Malware payload (Stealc)", "value": "f58ed177b6d716d56bce36e2da89517972e22023e21aac66b884716b0420de11bfbf6787a7c1586b8eecfa38c2133c7d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241358, "uuid": "710852bb-e140-4221-bc39-0da91e448a41", "value": "T12F238E7177BC823BCEAF0AB4646152000374D362AE42CFBD2DD9A1DE58977C503623AB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241358, "uuid": "5a0cf9fe-0681-41a5-a08e-fe8f5a4887c1", "value": "768:l9KG4oE3utrXgye+k9l2eeicYSFQLq34pUr2SIO8BC45SNUgRaCEFiRvk:7KG4p3utzgH195eicDFSqopUiJArNNRG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710241358, "uuid": "a0450081-6d38-4789-9475-5f0bbf9ea2cf", "value": 46816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710241358, "uuid": "98914546-12a9-4205-a2fd-aeb909618cdd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241358, "uuid": "41e71cad-4e1e-468a-ad2d-628f0103bcf2", "value": "27b3e45a81641d0e7d0dea29938774ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "033c6148-e023-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710215147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215147, "uuid": "6e37baa9-ab76-430c-a521-b459d9b522f6", "comment": "Malware payload", "value": "cc2cff560f0d56ab2a59cb95ceb0d3b9", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215147, "uuid": "e0b5e0af-aa4c-4a8e-bab3-5189c67e82de", "comment": "Malware payload", "value": "ac28693e8d336d0ef4a117c9fdccb0c2a62450b65f578838859b7e0a67ed5876", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215147, "uuid": "866116d4-2c53-4c57-8880-f09da38e4191", "comment": "Malware payload", "value": "a80f36aa7ee61fe48ac1e59111dc9c734b2fa885", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215147, "uuid": "02707562-6f93-4e47-9ef9-63617a46d501", "comment": "Malware payload", "value": "6ac58acbf5361abaac0da6d20c918aa5c82762727ec513c3c3180a7f9e7ca1829854a6be7a5e6eab4df957d901422496", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215147, "uuid": "cd4809d1-8914-446f-a4d3-2fde8c3d354c", "value": "T1AB63156EE30F0954DF55E67B434A4B4A09FCB33EB28540A179BC973437AD81E4A6287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215147, "uuid": "8d59aeac-46d2-4a04-baa0-5167cddd8aba", "value": "1536:GDgwSg4/cxfWjWzM9lgG0b/fMFgxQo7ZFxePlt:GDglyMZ0bM/o7ZFMPlt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710215147, "uuid": "625848ff-7a4f-4629-9ee6-bc48ec5b5e9f", "value": 68546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710215147, "uuid": "73575fd2-64f1-4101-b9c8-9c88c915e564", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215147, "uuid": "e972f664-5f39-4296-baa8-ad0d55185c67", "value": "cc2cff560f0d56ab2a59cb95ceb0d3b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa69689-e0a2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710269813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710269813, "uuid": "4c6f5051-a9d7-45dc-b34f-d35b6ac651fb", "comment": "Malware payload", "value": "a2aa40e193b9096136067812cd4e0af0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710269813, "uuid": "ec89f9ec-f3d2-4d53-9da7-6c7cb6b7e89f", "comment": "Malware payload", "value": "adb00e2afda4a4ea16c42852fb2dbfa8dead7bc6da2f2f72f5d35561bde5b7fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710269813, "uuid": "ebe14dbb-43a3-47ad-8905-46c8717990df", "comment": "Malware payload", "value": "17e9250c7edbd8eb153f496908ae37d36258d5b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710269813, "uuid": "826fa2a8-531e-4eb3-9b03-ab6c7eb34aa5", "comment": "Malware payload", "value": "c3ef7c11a9efa98a67a4a0b3acd537f7099d859b6790e272abe96dee82cd5cf26b826b8cb7f18a690215670f8f8acea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710269813, "uuid": "3af7d89f-6d38-400e-96e1-1d3b0a6b7fcc", "value": "T1B865C507D2A64B75D4A20A34593B9CBE1923FF684DE8D15D3EEDFA3EA434E422434B41", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710269813, "uuid": "878fbcb4-5a04-4ea2-a070-4b8a28ebca6f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710269813, "uuid": "88534023-fa78-4b33-9b50-0528eb79e06e", "value": "24576:c3cfVi3KD+zlfCNZKqxy4V73P2EMZbG0JEt1i3KD+zlfCNZKqx9yc:FNZnV3PYdStRNZnh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710269813, "uuid": "2042bdc7-6fac-4a51-ac9f-246406e867bd", "value": 1508545, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710269813, "uuid": "8a2f48e6-9889-4ce7-8100-e5b4e86e2488", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710269813, "uuid": "a674abdd-bc15-45a8-a826-a2c64bf66133", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1c8b4dd-e074-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710250310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250310, "uuid": "b76ff72d-a0cb-49f1-aa85-439147ab3ce9", "comment": "Malware payload (RemcosRAT)", "value": "9046e68022d4bf996dde93052d67a9b5", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250310, "uuid": "82fda9c4-ca05-4991-a3a8-5e886a259937", "comment": "Malware payload (RemcosRAT)", "value": "ade4c81173fbb4420f1bce21ecfafe78757238840af567dde7a3421059631014", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250310, "uuid": "8e4c72d2-6f43-4765-86aa-3d83c06cb309", "comment": "Malware payload (RemcosRAT)", "value": "502662322e0a225d7dffc841c2a24c5c82582f07", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250310, "uuid": "d44eae02-4b46-4553-af80-d6b9ebfdb1b8", "comment": "Malware payload (RemcosRAT)", "value": "ea37ae3cdf49662533f4cb1fb12de627526d4d0b96f91a35c954a43d02347d88a9e522ab660bdd8ff984ed89235efe7e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250310, "uuid": "dccb0390-7e1f-47a7-900f-b8447df93d1e", "value": "T1D416E99369AD1ACDA7057B7B774FB7340B1BDC110BC26EC840D626E8800B64FD798DA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250310, "uuid": "fa5fee99-dc89-4b3d-a33f-beaa32b4574c", "value": "49152:OBHEIE8fhpytc5M7ZvRd5A81rmvyuZZGqdZWG4s3pU6C:9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710250310, "uuid": "f1dd394b-71f6-4ee8-9526-34f88c65421b", "value": 4081145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710250310, "uuid": "562a07b5-4269-435b-bd55-79cf31689cd2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250310, "uuid": "75f0fb12-e515-41c7-99e0-8f95f5a8b4ae", "value": "PROFORMA INVOICE AGAINST PO PO05823-24.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "728a40dc-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238527, "uuid": "1a6a8262-7d60-4636-a5d4-19ce9b044c00", "comment": "Malware payload (Mirai)", "value": "edab879cc8742a2ed9dbafd92d7395ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238527, "uuid": "0960dbe5-c5fa-43b3-8711-f0fea97d77be", "comment": "Malware payload (Mirai)", "value": "aea37d903a33eadc25e8f5be9ed91a4f10d5e2a6d4a8b719b9b86d04176280a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238527, "uuid": "c1be46fe-60cf-4ac6-9a07-9a61e481e821", "comment": "Malware payload (Mirai)", "value": "44d2b4092e9ec2c9675219b473da92d32016ee86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238527, "uuid": "d407e463-bcb4-444b-8d25-0b0deffffa4e", "comment": "Malware payload (Mirai)", "value": "65c7b7cc349edd27b485c89adfe77c3e33c40a13f4b85c7511590d14a46da338019e0566de89b64ed563e331e18c4ffb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238527, "uuid": "64df754d-7592-492c-940e-64a8dbefd0af", "value": "T1D913F28FE4A215CFCA64BC3BD09813655E55FA76E1C6439C4B92CC98E22509E36CB0FC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238527, "uuid": "c2ff723c-0766-4585-b344-6f3847255354", "value": "768:qtnTUyqtkjp4Hr1DsVA2n43kw5799ryu+vymacU/JhnoAbsGW0:qEBJkiLHryuitCloAbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238527, "uuid": "94b45407-a427-4cb0-a122-c6fa878489f8", "value": 42636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238527, "uuid": "fe4d559f-eb51-486a-bc06-1503faed881d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238527, "uuid": "710c4f90-73b9-4052-95b3-a8058097f415", "value": "edab879cc8742a2ed9dbafd92d7395ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37929468-e05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafygt)", "timestamp": 1710238857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238857, "uuid": "51b7e6b6-7490-415b-828a-8f7568533441", "comment": "Malware payload (Gafygt)", "value": "bd80e71f47a58a4c630ed9d32304f71f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafygt", "colour": "#B29474", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238857, "uuid": "80f1044d-877d-445b-8899-7559ff06b282", "comment": "Malware payload (Gafygt)", "value": "aea80f0e4edb081e6818a446ed0714c059102fd1270958787bf33028a6f67fee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafygt", "colour": "#B29474", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238857, "uuid": "ba39eb85-3a65-4f38-bf77-865852aa32de", "comment": "Malware payload (Gafygt)", "value": "dd22b0ecfd74278bc868b990627460ad52b5e023", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafygt", "colour": "#B29474", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238857, "uuid": "c5260b44-d690-4fdf-8dc7-d7346de74a41", "comment": "Malware payload (Gafygt)", "value": "c8b620b7d37f60e578e20db5bd9d50578d1f27996cc40294eb8cdeec17951bfd426ed7cb715ceb36eac1898a8b3adc61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "Gafygt", "colour": "#B29474", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238857, "uuid": "5c3fa491-484a-4c7a-86be-0d9b49b6a617", "value": "T1D6831799FCC18B2AC6D023BAB67E668D3320A3F892DB3117CD154B6476D950F4C72E94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238857, "uuid": "36bfe2e9-70de-4a44-9be0-42b113825014", "value": "1536:tQ/1fjgZgajZH5c7NYwwNABreO7DKExGoIeyi/5XQNQg/a+:tI1fkZ3jScpi/5X0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238857, "uuid": "a2ebabe8-87e8-43fa-8af2-d3a7d9fe9b30", "value": 84884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238857, "uuid": "d2ebe8e2-cc42-4c69-ba8f-20252c696a3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238857, "uuid": "199e953b-8f16-410e-9864-066908b5d0d8", "value": "bd80e71f47a58a4c630ed9d32304f71f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760e782f-e076-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710250988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250988, "uuid": "6c3e46e4-1a79-4cd7-aff5-7c883fb39945", "comment": "Malware payload", "value": "738137fd53c872c0cda2b9a2e79bd2bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250988, "uuid": "254898fe-b770-401f-93fa-d2dcc658e03f", "comment": "Malware payload", "value": "af53122bb5fafb0ee22aed249987995daec68907e710e83c8c52ef81d07f7f37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250988, "uuid": "69c57e91-3d26-4482-8a09-47291bd1d151", "comment": "Malware payload", "value": "844473fbe8461f73e3b4ac81af633ead75033d9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250988, "uuid": "5e9676fb-018a-414c-bd7c-c418978db64d", "comment": "Malware payload", "value": "ba27904cd5325c66b809b43c924720065698f62ac4156391cb573be7ff63fed4d3e6b94bc6270e08fc9b0b90c812fee9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250988, "uuid": "96b212d9-10bb-42e9-a722-09462f181a0f", "value": "T10A121C03FE940AE2CB588BFC35738AFDC9BEB1621B41B25267B7D459472A640E0124CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250988, "uuid": "e4b39d6e-9141-4c1a-a677-1ce511aff807", "value": "bc50f401bb0a1eef6d874ee90d266572", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250988, "uuid": "67dd8848-cd3a-4713-b017-3542d83f09a7", "value": "192:yQZkqL9QZb0CgCZdWJagjOWz5f9u5pz6jbTS:yeEb09vJnjT9o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710250988, "uuid": "adecd2f2-dabd-41a5-9375-3ddec6625b01", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710250988, "uuid": "fb24ca16-0538-427b-a088-eaf607f7e0fc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250988, "uuid": "6ab1ab4f-7de1-4bfc-9bfe-ad917b319d7c", "value": "SecuriteInfo.com.Trojan.Win32.Malgent.13597.1028", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27be86bc-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232818, "uuid": "4f28390c-102f-4328-94ac-22fcfb7a3107", "comment": "Malware payload (Mirai)", "value": "355acbb5b262a4f94b55e0794603e8a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232818, "uuid": "d3ee0aed-cfc4-42e5-80c1-c990b411d2b1", "comment": "Malware payload (Mirai)", "value": "b0cbb55a96d2dba6e0b1b2f1e3510996c268b0db31343df501dca76ffd5feca6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232818, "uuid": "b36737e9-f2b4-43b0-a04b-56c8cf1aa890", "comment": "Malware payload (Mirai)", "value": "cd0dda614d652752bee63a7481c09b2339ad66c6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232818, "uuid": "e5562f91-0cc4-4f37-b5c3-388cfe9f2192", "comment": "Malware payload (Mirai)", "value": "b47e834b610daca12d7e1d1f70f7f1018b193ed3e49419aea85638b9de4eab450fca6c70394e70d2960a40b66283ee4f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232818, "uuid": "759f3843-636f-4f6d-a3f9-53ac931c4273", "value": "T1A2338DB3C42E7D94F14A8278B9204B385B63D40696933EF5968AC6974047EECF6193F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232818, "uuid": "aec73023-5a15-4336-8180-b7692bc1791f", "value": "1536:D3/vpY6Oka8wtAVSovU5T9qgGDS6owCc:D33nzXzSPF6ow", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232818, "uuid": "a0531e3c-2fda-4fae-9222-fc5db921522a", "value": 54684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232818, "uuid": "c98783b6-bf9d-43b6-934c-128b2b5c8f91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232818, "uuid": "c47de18e-6b42-4baa-a3b7-46ecb0b1b55e", "value": "355acbb5b262a4f94b55e0794603e8a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b0617ff-e08c-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710260365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710260365, "uuid": "3c02f2a3-3fcc-410c-be81-e2be4a90e2fd", "comment": "Malware payload", "value": "5a97f5e907d0d08e660191e5b340ea4a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710260365, "uuid": "2fda53c9-332f-444e-809d-c6844478833c", "comment": "Malware payload", "value": "b20682412165f6a01fc877eeedce94553542d45c8fd952c5198a95984b17f92f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710260365, "uuid": "1daae57a-3870-48a0-b607-97e783ad4142", "comment": "Malware payload", "value": "4ff5d824392c7b3fd7b2d13d657cb20020934532", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710260365, "uuid": "83b1306a-faff-4d5c-8aa4-bf160eaaa725", "comment": "Malware payload", "value": "db6cde296748a5c60c17b8da26a03c515a6f8734ccb509c942c453a181d57fa2d418b15afb5b31fe0627aa9866bf12f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710260365, "uuid": "bcd460ba-509c-4d0e-bd7b-b924e16e3588", "value": "T19405668DA146DEE5CC6363BE8C14387EEB146D2D0D45896EE6863D78F835BC196CCA02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710260365, "uuid": "ff0ab9a1-6040-417b-96cc-d1f72abc820e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710260365, "uuid": "13b352ab-e4fa-498d-80b0-86251c24a71d", "value": "6144:W9/XXL5hWSEfh8uveT25mbkYjF/mbkYjFJRHpV3x:W9/XXL5xs62QwYjFuwYjFJ/Vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710260365, "uuid": "bb45630a-a7c2-4eac-bfc9-9383e6d80a48", "value": 831880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710260365, "uuid": "f09101ab-2454-4928-8320-3007fe98861c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710260365, "uuid": "47d1dc33-ed29-4d05-8759-07ee92de9e54", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10359a55-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710227624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227624, "uuid": "3fc5a99a-e354-4d2d-8e27-c5f2c32df623", "comment": "Malware payload (GuLoader)", "value": "19866c22bce836af59c74b3543489451", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227624, "uuid": "5d2542eb-06d4-4615-9e34-34142dc21e46", "comment": "Malware payload (GuLoader)", "value": "b43c121cd0744ea3c6bafaaaab195375fc4bc9476c56af164593955460b9c91a", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227624, "uuid": "c01558db-523c-44c9-9705-35522b868c5a", "comment": "Malware payload (GuLoader)", "value": "1d7983a995a3e0c5d314112f605c183bd052dd95", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227624, "uuid": "f783736c-8be6-43d4-9cae-87eaf82b707b", "comment": "Malware payload (GuLoader)", "value": "bafa2ebe84d8746af9635051bc5424b1167cc54ec70edef316ffb10751b3008170a90e6fdf86634803408deadb6e6c1b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227624, "uuid": "4f2e1f3f-94b2-46f2-bead-44f2731afe9c", "value": "T19FC249A99E462046452706F7F41E84B6D61814FB9C2105B23E8CFA3D6C1B348BF2ED8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227624, "uuid": "6890f4c6-335c-4907-9979-6a9cf693cab3", "value": "768:4MpdL/jIc5uzwV4UwJq6Os8pycCPjHHDfR3N:4eHIc5uzw0qh74fR9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227624, "uuid": "9a0f3310-57c1-4554-868b-0cec4c28c1e0", "value": 27433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227624, "uuid": "08cd1bee-f68e-4af2-8ea2-7853f259c86d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227624, "uuid": "abf23924-5531-4ddb-86ed-cb50d92e480e", "value": "Ethmofrontal.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48929b8e-e054-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710236309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710236309, "uuid": "ce49dd59-ba92-47f8-88cf-bfbe60884f21", "comment": "Malware payload", "value": "42f5383d9a63b479f13ee3642d53c0fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710236309, "uuid": "3d10841c-dc46-4222-a250-e9c4ac218c1c", "comment": "Malware payload", "value": "b643742928fc2a2eb5dabf5f58202938f24a0f322503e74ede27ed1457068bb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710236309, "uuid": "827e413b-c22c-49d1-8da5-bfccf703d6ef", "comment": "Malware payload", "value": "39483ac92992493a4f9364033ca6f84f27152fec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710236309, "uuid": "e80a5785-0ef7-4b0c-b347-00115599baa8", "comment": "Malware payload", "value": "8d4234de79b379182380d94fe825a955387d82d0aeaea37cbdd5cd566437cb10bd13fd2b85f13888d45de3aad8798d0b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710236309, "uuid": "cd17d58c-7458-4404-9a37-2fdfb6b4d49b", "value": "T188A4CF217EDDC171E8AB023144A987AA677ABD073B2185D7B7903F5DE8313C1CA353A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710236309, "uuid": "d411d71f-64e5-42db-accb-6a475cf228b4", "value": "824d439308b33d2d874a8ca459662306", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710236309, "uuid": "da343274-102b-476c-a4d9-fb68e4308e5f", "value": "12288:J8gSZp5aBhxeH3Z5bbGv5a5Kw13ikTNLIKD:8ZpcBhxeH3Z5vj5Kw13BxTD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710236309, "uuid": "c0ddf186-e47b-47d2-a8f6-7fb7c6ba0415", "value": 483779, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710236309, "uuid": "8b61601a-c282-4481-929d-cdd828cb4752", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710236309, "uuid": "32a84608-d686-42b7-9ecf-6fbe8c994f5d", "value": "SecuriteInfo.com.Trojan.Msil.15445.11687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f8e5e6a-e00f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1710206712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206712, "uuid": "ec2b7b0d-2e36-48ac-82a6-e2618a2bb414", "comment": "Malware payload (Adware.Generic)", "value": "4bffb6018d3170b4550beefbf6393f06", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206712, "uuid": "3eb579a0-b800-48a5-b455-fdf15dec6e72", "comment": "Malware payload (Adware.Generic)", "value": "b9246c09f9cc9b119b7f6825f2b02119412843fe66bbacef7317d041ebdd8468", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206712, "uuid": "ac5ff725-ecd7-4b1b-b6b8-4d04f2c64633", "comment": "Malware payload (Adware.Generic)", "value": "4d2516837cc13234bcaf2fccb38432ef1b9c6a05", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206712, "uuid": "1983183b-d381-4ae4-9594-9d35c064899d", "comment": "Malware payload (Adware.Generic)", "value": "d5010449cb654bd51bfa89eea21963bf8dd8d492f66a1bf1bc1f086ebe2089aa23958ac2ca4cc88ef7db9a2caded2609", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206712, "uuid": "38f16862-80bd-4a92-b710-fe8d38f2e171", "value": "T1A8962327B295753EC46A2F320673A15058FBBA69E4377D6623E1C48CCF350E08E3A765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206712, "uuid": "4610a495-46ac-4a0d-b0c4-bb9088d03730", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206712, "uuid": "72834280-0f63-4279-8819-a10e26b294f3", "value": "196608:iUqOKXbco3xPgn/9fExOcTsp5BczDBipDBiy+lxe9djB:zmzPgnVfEUcTspWUxUy+l0jB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710206712, "uuid": "827d31b4-df7e-4b13-95f0-f2de3f827f56", "value": 8763000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710206712, "uuid": "b98080b9-8702-43db-957b-450dce3a89c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206712, "uuid": "68ce936f-2340-43ad-a8e5-5fd957972795", "value": "SecuriteInfo.com.Backdoor.Win32.Agent.myuezi.14817.722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c4106a-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Smoke Loader)", "timestamp": 1710229800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229800, "uuid": "107ad461-dd49-4ae4-8b6a-615fb7751ed5", "comment": "Malware payload (Smoke Loader)", "value": "699e79d0f4a7586ffe53d0dabc5c0a5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229800, "uuid": "f262f900-5162-4a98-862b-83e86eb3ec8f", "comment": "Malware payload (Smoke Loader)", "value": "b930e1b461a4c64396b0c52f17d7c504a5e8dc24114ff186eb129e8a548143ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229800, "uuid": "d8bb2d78-f635-4960-8e04-093142c68478", "comment": "Malware payload (Smoke Loader)", "value": "7178ab85fe6190259b64846c76af01b8da5b0cd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229800, "uuid": "505a6542-fbf9-420d-ac1c-6596f65a36c8", "comment": "Malware payload (Smoke Loader)", "value": "f6411f03b67972f6683c75d1e007161bf0a364133eaa07c9fdd52dde9c2b08c4c60b52a091b95041b8870f34854deb58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229800, "uuid": "a70cab01-2f71-4b5f-a3d5-3f8c22ade265", "value": "T157036D21B3AC873BCEEE07B9AC61614013749362B982CF9D5CD865AF44AB7C503163A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229800, "uuid": "f22e396f-1203-4e54-bf38-389454c4926c", "value": "768:sRyIN4srhwS4CGlB7+zM2WiWYiP8gzBggIfiN5SNUJ:2yIN42h6n2rWiKPPzBm9Ns", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229800, "uuid": "678e4e89-8bfc-463f-b6a7-6b54818bbd32", "value": 40448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229800, "uuid": "724299ed-4ba1-4b57-a3df-eddce6495532", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229800, "uuid": "78ccf21d-072e-49f3-8a3b-57ad815b011f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3503da86-e06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710247443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247443, "uuid": "3a98d8b6-0a8a-43b0-831c-8a74e54b6e5b", "comment": "Malware payload (AgentTesla)", "value": "6093f7cbf28690c42bb0810afc2a3634", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247443, "uuid": "a75541fc-92eb-426c-a0b6-a1a10650b17f", "comment": "Malware payload (AgentTesla)", "value": "ba6a4a13f3440a34d805ece176aafeb3fde6e421845e8947e7123c0b6e5fbd07", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247443, "uuid": "d015a0c4-5aa6-408d-9cf7-6ac6f39551d5", "comment": "Malware payload (AgentTesla)", "value": "6723c764fff893abaf8a3a72ced5f3c11c60c667", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247443, "uuid": "042a4f17-3b4a-466e-9b49-a36e99270284", "comment": "Malware payload (AgentTesla)", "value": "405c97537888f4f33801e038a2978427cafd174bd6fdc10b9ea9b6b7467fcc7234b1817ca15ca1bfe7f7c2f9beece054", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247443, "uuid": "6f2ca738-a02b-4676-89e3-31619cde5add", "value": "T12CF412447FB7FA96C0996A3B4962D324051A2C53694B636B32EDFF4CBA327D02B03594", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247443, "uuid": "caeec0eb-4feb-42a3-bda1-4008857cbd03", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247443, "uuid": "4de9e16d-62c2-4a3e-95ee-86892fb58093", "value": "12288:rYV6MorX7qzuC3QHO9FQVHPF51jgcJcCjq4ODjylSKIx/fw+ApeNX1:IBXu9HGaVHRDODjyDIx/fjApQ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710247443, "uuid": "6f5a2099-c584-4580-bf89-de6d4ec92d8c", "value": 766976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710247443, "uuid": "e99fac85-490e-42c1-9432-f8f83f09b5e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247443, "uuid": "9d648c9f-6781-4d96-bc97-28ef9a3613e5", "value": "\u0395\u03a0\u0399\u0392\u0395\u0392\u0391\u0399\u03a9\u03a3\u0397 \u03a4\u0399\u039c\u039f\u039b\u039f\u0393\u0399\u039f\u03a5 PROFORMA 6534.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3062d48f-e04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710232403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232403, "uuid": "61ffbae7-6796-4dc3-b9ba-8560965eb632", "comment": "Malware payload", "value": "ef65a9957ae22ca7904ee6378668ee14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232403, "uuid": "1e1630e4-f2bb-4ccd-a332-887026a78eb5", "comment": "Malware payload", "value": "bab6118674a01ebbd84e013b7845b83b0653e2a17467517322dc887eb20bf151", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232403, "uuid": "74934214-17a6-48e6-a1e9-1ad92fe57028", "comment": "Malware payload", "value": "57733f20beac72ed7303e2acc87f71ce2001c35a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232403, "uuid": "23dca1b9-9c10-49f3-86f0-e11210963113", "comment": "Malware payload", "value": "9a89d194513673949bd02071e2afed36c95275b43b1f13cfcc8069c66cfc1a0365e124871d172670c332febcb3379a43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232403, "uuid": "190a33ed-78ac-42ab-9077-f575376ec5d3", "value": "T1F1252343814006B6E892673872D12E3AEC9C74625A7980DF9B70DE477DFBB92DE1431E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232403, "uuid": "6cb13d73-1fec-4333-b83f-fa5b929f77fa", "value": "8ff7b4dd014c787f07d06d1e482da69e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232403, "uuid": "937a8728-ca1b-4d5f-b33b-9e2eb39b056e", "value": "24576:dQsTO29HmQebZpyBZONEGanG4MIzF3xGHYZMw8daZw62:dQidlnBQNEZK162", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232403, "uuid": "a8b2e0b2-f715-4bc6-8afb-af023e028425", "value": 1039776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232403, "uuid": "f7079dec-44f6-49ba-9645-90b8e472a3c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232403, "uuid": "a551fca3-ec63-4089-9a28-7a57602dd2fb", "value": "SecuriteInfo.com.BScope.Trojan.Ditertag.22982.20577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8199bae4-e076-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710251008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251008, "uuid": "4b4be164-1c0f-4667-ba46-c1d58f4bc35b", "comment": "Malware payload", "value": "adae6e0d37353b076afa854dcb67d79b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251008, "uuid": "b18178b4-ba20-41a9-a63d-7181222e11d4", "comment": "Malware payload", "value": "bca1d1464e28b9593a344ba2159f989502af59c4dc70eb7ea08df80edd4bbdab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251008, "uuid": "733fd9cc-ef1b-4ba0-9189-dfa19554ba19", "comment": "Malware payload", "value": "c5a0cbc24b136b4f3c471d559baee7cc5371e14a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251008, "uuid": "b81ef67f-811a-420d-8645-5fbf556ec84c", "comment": "Malware payload", "value": "733a5dad51fdb1fb3bc06576f34748289f3a1954806fbd99fcb0033ebcd49f862c9672140d278e01ab5410e4c545e6bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251008, "uuid": "86e3c8f5-c715-4f3f-8270-80ae73973004", "value": "T19CB7333BB758A63FC4990A716533E130997B9EA124678C0E1BF04C5FFF6A8211E3B615", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251008, "uuid": "a2928f01-f1d9-409c-a74e-f331130abec0", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251008, "uuid": "46db77c6-09ce-41c8-b12f-ddeafd1d282e", "value": "786432:cEHTfGgrv5aIMbA2R1LwPj0voJbZqknIjZ1zq3CEz91737YSLjbgOamgP:cSzrMIsAYFwLFJd03mhzH7379jbrkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710251008, "uuid": "c1fd4a30-5598-484a-9743-2db9e98d7aac", "value": 48754928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710251008, "uuid": "abbe1c3f-5942-42be-a1b0-f6d1f4e96df0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251008, "uuid": "27b3a6e9-c746-434e-a337-ff52cf22fa84", "value": "SecuriteInfo.com.Adware.Downware.20545.13521.18526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6deab0cf-e05e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710240667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240667, "uuid": "d906c530-47db-4eb1-ae28-a9d5280a470a", "comment": "Malware payload (AgentTesla)", "value": "b2c3a82acf4112b2489cb9bdca04b8ef", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240667, "uuid": "0468857d-3609-4a50-b900-01c4f0d6a73e", "comment": "Malware payload (AgentTesla)", "value": "bd58817c34b74ed5c65897f4551dc9bf417376b07c90c5db4ee07e01abea9be9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240667, "uuid": "c1daa6e5-153b-4527-ac6f-b483e8ca4a74", "comment": "Malware payload (AgentTesla)", "value": "362ce94f21182850ccaa5b6504d8c1e78ffd06a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710240667, "uuid": "872c3bf2-32db-40e3-95e5-b404fcb42990", "comment": "Malware payload (AgentTesla)", "value": "0866846ae87968cb99663f57af9c7027778f9dc13bbde2595a542b10b761fd61e4f492b1bfbe1e53284b69c8e4771096", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710240667, "uuid": "9e1e9b8e-c33c-4d75-b097-8f5656086ad4", "value": "T10AE423074EA49250F73E6B71C05F223C163624D3BA98E21E59E0DAD58FABF23C4C55E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710240667, "uuid": "d79071b5-76f7-474f-9175-162383f6ba52", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710240667, "uuid": "a2408318-b792-44ca-a296-b8a96d30627c", "value": "12288:hsJTENl3x812TTCdlkOIGDycal0aER6jUZMcP2AvbjzGm:axENlh4MCnsGalEkjMHy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710240667, "uuid": "7e722b4b-89f8-44d5-ab43-9b17511db994", "value": 668160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710240667, "uuid": "0bd2f547-638f-4b7d-918d-5660d197430b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710240667, "uuid": "13813402-5bd9-4d88-831f-6b8ba835d383", "value": "02_94_OR.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be31186-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (STRRAT)", "timestamp": 1710227644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227644, "uuid": "2c6eb54d-59c1-46d8-b784-013256fc57a8", "comment": "Malware payload (STRRAT)", "value": "6e2c2d71a015ad6d5993026d24062e9f", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227644, "uuid": "7fbe3b31-1118-4392-89e8-923244dfd419", "comment": "Malware payload (STRRAT)", "value": "bd8b78b9bb8eddc7c4ffac6fe3a594a0abffddc7b41925d7130be3f931c23c99", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227644, "uuid": "54bcbc21-c672-4efe-ac34-c03a7f404446", "comment": "Malware payload (STRRAT)", "value": "8df1692a8ad300e312b2ed886765c1aecf75b335", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227644, "uuid": "0059dd4c-95e8-420c-b778-11e3033a2041", "comment": "Malware payload (STRRAT)", "value": "6809d6934cfe6d53a3b4dbc01a24848e269ebd7268432f16c70f2392a7d11fd8b0e38dd1ea560318c6834a29ce18acba", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227644, "uuid": "669ea01e-1c0c-460c-bce8-918bd01d9d0b", "value": "T17924016A2F82D4BBC10750F645048277771843CCE684DA1FAAEC6A466D39DBE1705ECE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227644, "uuid": "8f5a1cf1-3f69-437e-b70b-7a9cdd1209f2", "value": "6144:s8q8FJ+HP/djZ5yQzyTRpUVjNq9ruFPwVmyK/:s8jFAnzkQEKjNq9OgK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227644, "uuid": "32249690-cd32-45a6-8cf2-aa55e9b158fe", "value": 214447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227644, "uuid": "2aa630d2-3d2c-422d-8af8-2972aa584686", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227644, "uuid": "d9ef2d4f-89e1-42e6-81db-53f2fb14aab8", "value": "NEW ORDER.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4baacae4-e0c8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1710286136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286136, "uuid": "2c4ade0b-55cc-484b-ac2f-a23f2af0d82d", "comment": "Malware payload (BlankGrabber)", "value": "1b5a8b5e7419b19f21264edac7bf3560", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286136, "uuid": "04616f2b-774f-4eb8-a9be-2c46f78bad09", "comment": "Malware payload (BlankGrabber)", "value": "bda4594163061b9d8d37f32d32af59aec3d127cec598abad6533077494156d13", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286136, "uuid": "a0da6118-89d6-4a23-ae02-342bcf8e98bc", "comment": "Malware payload (BlankGrabber)", "value": "5a14c88053229f5cca802f2de2c77932a59628ab", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710286136, "uuid": "7ba26873-de74-47e7-b01a-f59bd8e2c3ae", "comment": "Malware payload (BlankGrabber)", "value": "8412f2d398a7b7fc3e16b64670c76806a74425facf00901279d25e2748953569a465607db6d3a7040136b0a8df8d4120", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286136, "uuid": "47cc47ae-a012-43a4-b376-3fbaa2570668", "value": "T16D5633B0236444F1EDBB863E8846C85ED9B4F8051364EEDB426092BA1F537594E3FF92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286136, "uuid": "1e67d7ed-ca5a-4eeb-bde1-77065096f26e", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286136, "uuid": "e0d6ae74-7369-407c-80cf-eac4c30136fe", "value": "98304:SeEtdFBy20amaHl3Ne4i3gmtfXJOLhx9fZAzDJ4wzQgsRuGK4RzBMxC3JDsgTR:S9FMceN/FJMIDJf0gsAGK4Rzux7gTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710286136, "uuid": "d18974fa-320d-4350-acb8-7cdc2921a23f", "value": 6248857, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710286136, "uuid": "cf5f91a0-7238-4170-a187-d2597d193dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710286136, "uuid": "cffe550e-be23-4813-a939-3f974ee6537b", "value": "SecuriteInfo.com.Python.Muldrop.25.18892.4622", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c754f7d-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710227699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227699, "uuid": "b296c8be-e588-4f04-8d55-7e53854ae060", "comment": "Malware payload (AgentTesla)", "value": "951577b697a1caf07eea6946c91fcd44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227699, "uuid": "78171095-37de-4eed-9c26-70e7004f0006", "comment": "Malware payload (AgentTesla)", "value": "be1cb45fa4e0e79812640a2b9631da54a8780e0a8e2730baaae76944712f4fd2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227699, "uuid": "f27276d3-9938-4c4e-84e4-3ef47a0458db", "comment": "Malware payload (AgentTesla)", "value": "83f57b94040ec26c3841c23d9fa2e3f90a742197", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227699, "uuid": "18fa751b-6a2f-489d-87ad-7a01054d1d77", "comment": "Malware payload (AgentTesla)", "value": "2e01d47adae85234c5cc3e2e61205dc12f131894d04fd7b4921742958858fe1816a4e9007c9909ad3258607556ce3556", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227699, "uuid": "fe9cdbed-4325-4c7e-a381-d4123c237eb2", "value": "T1D9036B2173A8473BCBEE07F9AC6012001375D6666A43DBEDADC990EE449BBC507523B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227699, "uuid": "57d05cf0-7102-41db-a70e-f68fbadc7ca8", "value": "768:2Q+04PbQgCw8e49uEKllB/bio/0sMZP9fKWn45SNUS:v+04jQ90d3bio/bgP9TrNX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227699, "uuid": "aac5f56b-e84c-4851-a016-005554ab7e42", "value": 39936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227699, "uuid": "b8dfdc2f-a5e5-4ebb-9833-80fe3fd43d7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227699, "uuid": "7d7c41d4-ec69-4b20-871e-02861f2f6901", "value": "DHL- Shipping invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86cdea55-e0ba-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1710280222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710280222, "uuid": "043a9ac4-8b56-4adf-8e94-fbf6e4e070f9", "comment": "Malware payload (Gh0stRAT)", "value": "6a7dbf9cf7f21fd9e36a8f946a9ba32b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710280222, "uuid": "6c2ab4cc-d133-4f1a-9032-47bd00abfc06", "comment": "Malware payload (Gh0stRAT)", "value": "be5e172e023a252269fcfff738377c0ee3de397bee7d44c21d002457ad2ce510", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710280222, "uuid": "ca703e91-9776-4bf2-93fc-a3dcb6ea0596", "comment": "Malware payload (Gh0stRAT)", "value": "08b2d505241bffdf824a9058806ad207cebd6b08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710280222, "uuid": "7670d1fb-43f0-4788-9777-053c74d88b0f", "comment": "Malware payload (Gh0stRAT)", "value": "86dea444e4851a6151bc0bce6ea7e7591b3a34695759cb1049bdd25626c269872672b22f628fb93f876f81d8fabf641e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710280222, "uuid": "75a77b61-3d9a-4dc7-a5d3-39cdf0971b38", "value": "T1F3C4D011FBC1402AE09C01B180D39B79A67CAEB6571311CFE7E0F95E1E751D26A32A6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710280222, "uuid": "4e1ac5a4-3dbd-4a23-bc07-9f2c90f2a3b6", "value": "a0158c18d7c57554131cbbf4101b1cab", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710280222, "uuid": "71e5f7a2-5b23-452d-9a92-03a42ced6059", "value": "12288:nruM9FNatyT3gNCpOdn/uVcZNJ7QD7HZ5rbx:q+atynpOd/HzJO7HX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710280222, "uuid": "e60e3f51-0d10-419d-8266-c6ee44caac5f", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710280222, "uuid": "a439fcd7-32e6-45bf-9401-8125eef644b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710280222, "uuid": "7e1f9bd9-7281-4032-8723-48ce5f05060f", "value": "6A7DBF9CF7F21FD9E36A8F946A9BA32B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a20d10f-e066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710243962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243962, "uuid": "126671ce-0d2a-41e6-9933-5d91649fffcb", "comment": "Malware payload (Formbook)", "value": "a489d067c653448afb284ea4d4bd47f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243962, "uuid": "1bf4d7b0-9a0f-4c24-b5cd-cab0b93cb070", "comment": "Malware payload (Formbook)", "value": "bea8c25e6a554a2a50ff7bd41b1f93c977e129d668ea8452863a332b8813a948", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243962, "uuid": "4374b705-0bee-4969-b5a9-437faa931dbd", "comment": "Malware payload (Formbook)", "value": "edabdd36b71071ef7f04fcc617cd17b11a9d23b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243962, "uuid": "f53a0893-8875-4b8b-8e8a-96e68f6eb725", "comment": "Malware payload (Formbook)", "value": "edd21071d9a170a3b5465a8539c28d738ec7252ce317e9f776fbfe9a665d7c85d067aa5007f3ccba5763beada0fc45a8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243962, "uuid": "e93d0bb0-f36e-495d-8922-2f484937f2ed", "value": "T13E35AD0273D2C036FFAB92739B6AF20556BD79254123852F13981DB9BD701B2237E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243962, "uuid": "273b7835-b2f4-42f9-be64-2af14a8766e7", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243962, "uuid": "b68583ee-90ae-4072-992d-16f8fd56b1d7", "value": "24576:bAHnh+eWsN3skA4RV1Hom2KXMmHafWh09iNAjBfWf5:2h+ZkldoPK8YafmNaZW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243962, "uuid": "c7d996c6-5d9a-41b8-b0a6-96c902f5d21c", "value": 1156096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243962, "uuid": "919e0503-5da2-4579-9514-854da287278f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243962, "uuid": "1136cfb8-a2f6-4052-a966-78b80a6d7c64", "value": "z20Quotation10032024pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ddcdd1e-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232774, "uuid": "e8df48fb-4680-435f-bffe-f03f05db0486", "comment": "Malware payload (Mirai)", "value": "d5775f43ef3c9a8a32643c378f66b96f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232774, "uuid": "fd875f78-9966-4d44-8a96-d5dab0d6f7df", "comment": "Malware payload (Mirai)", "value": "bffa3dccc49320a692ac045163bfcd9217869601d9d41bf41541536b16fbdd53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232774, "uuid": "2f51e706-0ac6-432a-b19c-a0863380debd", "comment": "Malware payload (Mirai)", "value": "08ad583312ca325c6459b957146679e683ed264d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232774, "uuid": "64345db8-cc09-4dd4-8380-39ba831a99e9", "comment": "Malware payload (Mirai)", "value": "b63a7afa5fce75a7ace61277684f16948536e257feb753e345d3a52b55f6a2a12ad36a980015924267e39189e16244d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232774, "uuid": "2c1aef13-ebd7-4cbf-9e26-056fc6f3721c", "value": "T12E63954E6E719FBCFBAC863447B75F209248339626E1C684E15CEA011E7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232774, "uuid": "2c203e2a-fcc0-4959-beb5-86285ec1a651", "value": "1536:u8aCKglaDrIjtb3stmjpYpt13vQCbaOF81UQ+eG:9H+0Jb3vyptJQcaOF81RHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232774, "uuid": "949005a3-69cd-41e8-8017-7327d5bdc3be", "value": 68256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232774, "uuid": "522a55b2-26df-4f1c-a262-e391c105be88", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232774, "uuid": "eda68bb1-25a7-41a6-9344-a411cc439a15", "value": "d5775f43ef3c9a8a32643c378f66b96f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bff67e0-e075-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1710250622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250622, "uuid": "38409085-2f41-4be9-85bb-558f3dc93abb", "comment": "Malware payload (PureLogStealer)", "value": "f01bb0eae2c545db34c5eec3c4e5864d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250622, "uuid": "22f04b0c-49ca-4454-88df-1bd597e15c13", "comment": "Malware payload (PureLogStealer)", "value": "c201449a0845d659c32cc48f998b8cc95c20153bb1974e3a1ba80c53a90f1b27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250622, "uuid": "ca89c2d5-974d-4729-aecf-0ded9c72fc97", "comment": "Malware payload (PureLogStealer)", "value": "8584ccd15c2c2460db2a9e095505c42a2f21ea34", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250622, "uuid": "a053a4f8-cc08-4134-b317-addaaac3e8e1", "comment": "Malware payload (PureLogStealer)", "value": "a04aa464157fee9c449ed01f0443aef06f4fbf7faa9e3bcaf52583c5a129201ab5749d63a56c1a75ae1c1ee98842b6ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250622, "uuid": "86eac966-32c8-42b3-be92-a9267732e47f", "value": "T10DF5AD13768E8A61C56967FBF8B7B21C8731A8432217DF1D25792EC95883B73F920607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250622, "uuid": "793b52ea-89cf-42fb-a9ff-7e84940c5d3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250622, "uuid": "9ae01203-2c02-4e78-a3f2-6f2052cd88ac", "value": "49152:aUy+u3Ao1hWrxVf9jvEAj9ytp0dhBG5VbbYYK31sEyh93HcoIdmHcf6M:aUfGhWVVf9YAB/hBGfYYK3iEyD3ydmD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710250622, "uuid": "de1071f1-60dd-4ac4-8772-cbf08e97f485", "value": 3549696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710250622, "uuid": "a6136e8e-6f64-49dd-91e7-19dd9333f180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250622, "uuid": "1ca2dd92-d4dd-45fb-8c20-b1a0f2ef0cc1", "value": "Mpyiuepnw.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8372aae-e043-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1710229195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229195, "uuid": "853c2c0d-71cc-44bb-8ea5-536b75b73df0", "comment": "Malware payload (XWorm)", "value": "1622d7172710da3fc829cbcea0e4a76c", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229195, "uuid": "01e9010a-a764-4450-9663-ddfed5df117d", "comment": "Malware payload (XWorm)", "value": "c247a4fc59f2eedeeed01e057dd248edefbc544ff794581e423eec824ae3d620", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229195, "uuid": "82007ff0-79eb-4e63-af0f-8700f140fece", "comment": "Malware payload (XWorm)", "value": "0d0a6a18727b000fdcd87a4dfe5184af869e23c2", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229195, "uuid": "a6c74f63-179d-460c-a38c-cd5d360e095f", "comment": "Malware payload (XWorm)", "value": "522ebbbcfe9358ef9847ffbfca9165a68c5b54f5b487302afcc89fea68009edb2ebc3a88df891c2f76f053a9ff87bf92", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229195, "uuid": "b4b749bf-fdeb-42fe-8524-1264b9dd6dd8", "value": "T1A9453A269B0B19B2DB2827B08EA72714E7387462B2314546BD6CE32C0F17BC01EF659D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229195, "uuid": "50724094-2b82-460a-9526-43ee3a6025af", "value": "192:a3Qzq/hFFLCiRs0mclFuUTMhOQdmy+vEqVyASWcDa46YToYxlBW4CR8X8ytlFys:vqpFBCiRs0T3KOyXqVFhce7nA8yN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229195, "uuid": "95d34580-704b-48f9-aa1e-b4257dac5cd9", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229195, "uuid": "beb1ea44-e4d9-4364-b8a9-c80b9bfc54f6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229195, "uuid": "72900634-612c-4fed-a228-7c756d11e9c8", "value": "Flotative.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eee752c5-e029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1710218120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218120, "uuid": "47078c6a-3f07-4f8e-85f7-859945f65e18", "comment": "Malware payload (Gh0stRAT)", "value": "4eab58d7ce2b17c62d2d5d5c67f43cdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218120, "uuid": "2c3983d5-36d1-4483-a1fd-e5512b2381d0", "comment": "Malware payload (Gh0stRAT)", "value": "c3144b575417849e4c50313ba6652434ecf195b8df12574f23ae09addb428c02", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218120, "uuid": "d077202f-f797-44b1-a989-34ffc8dfb771", "comment": "Malware payload (Gh0stRAT)", "value": "0dd0b84ac096c076a28b6edf01a2539228b62b9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218120, "uuid": "770592ba-87b5-4bb4-9a35-5d3c4657f53d", "comment": "Malware payload (Gh0stRAT)", "value": "25235d127ce451fb73fc546fa2d21f9ed344b3a44ebb09a1a134ccc778509973a6ca7919cad5ea8496fb8bf310c33b33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218120, "uuid": "026d7576-629d-447c-a501-377dc69cc84c", "value": "T15234E04C6F82501FD4BC467084A14AC737BCAC573992256FEB737847E9B0047A9A98FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218120, "uuid": "64dcaf49-634e-4485-ba00-7a528733e0c6", "value": "ef39d474ee88b9215814d74ee695b02b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218120, "uuid": "289a9b51-21bc-4d6a-8cdb-b96f6f15be3a", "value": "6144:66M96wgvRHCzOYtqlGyzcsX3KA0LQIQRFBQ:vi3gNCpOdn/un", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710218120, "uuid": "9307de59-e84d-45ad-b7f1-f11c7d41a73d", "value": 233472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710218120, "uuid": "b038f319-5253-4189-9644-dfafd1eae7dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218120, "uuid": "7d08e70c-3f09-4aa1-a324-e3fcf482979c", "value": "4eab58d7ce2b17c62d2d5d5c67f43cdb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a48b23e-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232768, "uuid": "7fad0e34-b175-47fe-9c40-7e56c43b7cd1", "comment": "Malware payload (Mirai)", "value": "389c6e5994d46d2ff46d3788326f196b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232768, "uuid": "b5a457d2-bc25-4973-b6e9-3cb32f4c9cc3", "comment": "Malware payload (Mirai)", "value": "c32757937663c23c961091ff6d997c2e583b6dbdaf6ce3968cb47b3a4216c102", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232768, "uuid": "1bda6095-00dd-4c38-aa77-1ed28b863cca", "comment": "Malware payload (Mirai)", "value": "eaadb160da3c88b92d3c9870f2f4fc3c584604ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232768, "uuid": "119a4849-7d6e-46ab-a9cd-abb18ca7841c", "comment": "Malware payload (Mirai)", "value": "746fed22c0451868bf6681e8effaf4650ae2c316962add92e530504726d39230703c7d99e3d248b54dbcbada344e14c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232768, "uuid": "7a424f08-f8a2-4e2d-afe6-aaa275addc31", "value": "T18073840E2E619FBCFBAD863587B35F209248339226E1D545D19CFA011E7034E746FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232768, "uuid": "472133f7-9c27-43c1-af08-66b92f9d0f62", "value": "1536:G4Z8LUay6+vl/R1KIdysUmR9EiYHXwoRyNMnTwZjDETc:B6ry6+vdGIdysUKsyNMTwRDIc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232768, "uuid": "27d13a6f-c1e6-430b-91e7-7e91ff3cbd1b", "value": 79804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232768, "uuid": "545b5bff-5d7d-423c-81ad-c1248aacd0fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232768, "uuid": "07616490-e9fa-4e71-aeaa-6152aed39b68", "value": "389c6e5994d46d2ff46d3788326f196b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "706ccf2f-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710229933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229933, "uuid": "c1fbb821-9c72-42a2-af98-a1e9d52b3dc7", "comment": "Malware payload (RemcosRAT)", "value": "e6f76b89356f767c1e4579b115621d8a", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229933, "uuid": "cb907698-493a-436a-a74f-719d1b603f24", "comment": "Malware payload (RemcosRAT)", "value": "c39e6397fdcff66da2ebb9fc2a8c54671a3706e9e15cdd5e50c5009b205469bc", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229933, "uuid": "2a636b02-9ded-4b98-938c-c94da15d3b33", "comment": "Malware payload (RemcosRAT)", "value": "d316f5418950945761c24fb92a6b8e017c53010c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229933, "uuid": "f3131a1e-0d75-4333-afee-327b8963ec9e", "comment": "Malware payload (RemcosRAT)", "value": "7dd905521e4877d532b1a8d52554ab5fba4559dc1c33261447d78d1e0f3b6f77aa12facad57bf5d65ab13774d4797917", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229933, "uuid": "64dd7c94-7260-401c-be56-611739149323", "value": "T1BA63142EE74F0915EF55E63B035A4B4A09FCB33E728500A179BC973437AD81E4A6297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229933, "uuid": "b2c17648-0ce4-4585-bdc3-96fede8d9146", "value": "1536:5Zc7TZKzE+tweAPbLCHuANoR45eS1ycLDC//n9dX:MHZK/rYbLuuw51ycLDC/1dX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229933, "uuid": "0c570b0a-5d9a-4346-bcc2-6a9d47dc7ce9", "value": 68382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229933, "uuid": "41c6b365-c109-4c33-a0a1-b3f94378b8cc", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229933, "uuid": "7d3154bf-f521-4e8e-b9ee-fb5b027952b5", "value": "e6f76b89356f767c1e4579b115621d8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e7c560-e04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232466, "uuid": "758805aa-eda2-42b9-a9c4-75379981aaf1", "comment": "Malware payload (Mirai)", "value": "3fd9e1193b2a6ec00826ace257df93de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232466, "uuid": "e9374940-66c1-49a8-9a56-392294be2459", "comment": "Malware payload (Mirai)", "value": "c61fe6031f74ce3343c023fd37167e13f52f59873a8e0c3fbe886814f27760ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232466, "uuid": "7fd23dc7-1a32-486a-b85a-c65c12822754", "comment": "Malware payload (Mirai)", "value": "68bd9bb22c9fdb622555375790d7dbd39238d8ed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232466, "uuid": "ec540473-da7c-4ea6-b153-9395e3ea84e3", "comment": "Malware payload (Mirai)", "value": "107841514124cfb08c4d367a3da90299d15fa691ece4ef3b40c67982eb82e503551d17b03e5687e8475ce4d63cc5002e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232466, "uuid": "7226312b-8205-4d37-a8c9-c4f19d0470d0", "value": "T18B237DA7C43C6DD4D14982B8BD244A3C5B13D016A6933EF5B64785638047EECFA193F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232466, "uuid": "3cb73753-2903-413f-90aa-54c68f4ab11f", "value": "768:f/eptstaT85n1Oya5wtg10sKmqRrKBXXG0QJqF5Uu7narcIC+oCZ21CuFE:f/6s+Yha5wtg5WKWq5UQaXCG21Cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232466, "uuid": "dbd9f877-be30-45b1-862e-8f92cdd10471", "value": 47560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232466, "uuid": "fd2f7604-7cf0-44d9-9475-63dd7ea48f16", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232466, "uuid": "3cb5d7f0-203a-4692-aa89-73e7eaeaef27", "value": "3fd9e1193b2a6ec00826ace257df93de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8280494f-e076-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1710251009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251009, "uuid": "6f323701-23bd-4990-83d5-d3e9b23ce8f7", "comment": "Malware payload (Adware.Generic)", "value": "d21a82cfd2d06b71eb670492ef9e605b", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251009, "uuid": "f25e76ef-f487-48da-804e-c46b9b5eebe1", "comment": "Malware payload (Adware.Generic)", "value": "c7d2d0456615ececdce0df4cd92e08234c7dc080edd9eb6bbcffe3e07d27935a", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251009, "uuid": "04514f7d-ac71-40f9-bb06-53d868304405", "comment": "Malware payload (Adware.Generic)", "value": "f03bdbe1db312f56d9ecd04cb4e12b077daa5838", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710251009, "uuid": "000f4d3f-7519-4cff-b7b2-94c1c5e1dc2e", "comment": "Malware payload (Adware.Generic)", "value": "92c6a2023677fa03006e651e31c301850a587af8785338ae5f4b2b3aebf44fde841e90ada5dd6c9e44439856b261fdf7", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251009, "uuid": "8b236dec-836f-49b1-813d-ecbebd3ad954", "value": "T15216013BB268653ED56A0B320573D3709A7BBE61A41A8C1E47F05C0FFF364A01E3A655", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251009, "uuid": "4c34ee96-bc32-4eb9-9cf9-221382c193cf", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251009, "uuid": "ea828c37-3f54-417f-bc1f-12b382e863d5", "value": "98304:dkL3Zx79o76YD/g1RpJdyJ7FX750LklEpRtrcm9kSkr9h:u3P9oxg1RHdux2klErtom9kZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710251009, "uuid": "5fe9394e-219e-46d5-ac2a-fc8d5f59a47f", "value": 4291934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710251009, "uuid": "9a9cad28-ba6e-4c98-b3f6-651cf4bd1bd3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710251009, "uuid": "7d4ecb68-75cc-4923-8611-49e7dd164553", "value": "SecuriteInfo.com.Trojan.MulDrop26.28513.9302.959", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ee6b6ce-e06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710247433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247433, "uuid": "44238aa5-8020-4388-a5b0-7d19ee0e4194", "comment": "Malware payload", "value": "8d181dc42c8d9d100e3bd60d203b4fae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247433, "uuid": "935d1933-64cc-4506-862e-5671f45284b9", "comment": "Malware payload", "value": "c7db773bfddce3eb1de1794b71d51c6220156a2ccfd50144aab2a775f077f614", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247433, "uuid": "913bf68a-3e8d-4a39-bc54-94614cf3122d", "comment": "Malware payload", "value": "5064e3a6347a62fd8f046babc4afdaed844d204e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247433, "uuid": "0d6f27f5-f8de-453e-8ca0-b668a15e739a", "comment": "Malware payload", "value": "e3f29aff9dba00dae3a5e249feea9b65cc698a402654682e66982718a337fc3d92291791552198e8bc99193717f66015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247433, "uuid": "75890e08-2b36-4166-9080-55a62fc072c0", "value": "T1EAE64D8733D79DBBC8D16776AEDB63384713FC325E1B4A97768A832884476885E06F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247433, "uuid": "c6a2a67b-7201-497d-9b44-27e9d6fa2836", "value": "3537c89d55c506d38f53242893ffde34", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247433, "uuid": "2e965b60-7f28-4c5a-bd49-00c66a3d2d89", "value": "196608:64mzKjTD+/YT4KTndlJ3GHSf3WO4ANV1Ni:6fKjTy/YFHhf3WO4Mpi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710247433, "uuid": "a39f70d3-1736-47e0-8fd5-190bb66bbe08", "value": 15249368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710247433, "uuid": "c30e67a9-02c2-4214-80ef-5e94f3e2bee4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247433, "uuid": "6489b03c-22c7-493a-9e2e-41c6b3c4ac69", "value": "SecuriteInfo.com.Win64.MalwareX-gen.4530.18605", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "863d16ce-e044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229540, "uuid": "29575cd0-db12-4de3-b344-fffa8b6990c2", "comment": "Malware payload (Gafgyt)", "value": "a87be036a01251340b159c5e380c2109", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229540, "uuid": "ce0d96a2-21b7-46b6-b0e2-4c01905d6edb", "comment": "Malware payload (Gafgyt)", "value": "c84f36d5ffb48d3243417cc673b2ccaf707b370bd29ef688791d32172ccd7e59", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229540, "uuid": "658290a8-fcb5-4f3b-a316-b1a8d8200bde", "comment": "Malware payload (Gafgyt)", "value": "edf8a4aa79476180e75541a19897e7cddd968779", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229540, "uuid": "a5846aad-c2ab-4e78-bccf-870857c4d0e3", "comment": "Malware payload (Gafgyt)", "value": "2daa6b09041fbb4aba0d6e5b3bb1ab22bee2a84fde82d707050b5154d9e3f290446ae6874bd1a7d68bf0a597963afbc8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229540, "uuid": "eafb90ca-379d-4942-9f17-6813a0aa8122", "value": "T125D3E701F9104B6BC7D2ABBEF745A2CE77719D982F873306D71979B027D06A96E39200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229540, "uuid": "2d2ac596-4ddf-4615-b57d-e1fd2c6acd75", "value": "3072:EVbZgGtcG7jLq+rO6I3mG3ci0QWBapy0y0zz7QYGBN9L0uQdFuo/zheWXVHDLd/3:EVbZC7QYw7DaFusXVHDLd/kQcHs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229540, "uuid": "f0ad213b-b77e-43b8-9da1-60e0ad761dc6", "value": 141625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229540, "uuid": "e1acec88-71e4-46be-b69e-11666e3cf25f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229540, "uuid": "1df466e8-367d-4c04-af14-8d9fdf3fffe9", "value": "a87be036a01251340b159c5e380c2109", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307c8b01-e08f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710261609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710261609, "uuid": "f0fb1c75-c4a1-43c1-a751-cb8bcbeed045", "comment": "Malware payload", "value": "bd4cf51ae64a7745458aee7dbfd88250", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710261609, "uuid": "2f7c2001-4220-498d-92f2-e5cb442e8eec", "comment": "Malware payload", "value": "c91ed144c74a64fda1022ba4dc4ea3a2e87818bd733b65f419d2e08c516558a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710261609, "uuid": "6580ef78-7239-4914-bbaa-c479133cb5ff", "comment": "Malware payload", "value": "6656b349d9ef4492eeadcab83253e44531e8fa19", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710261609, "uuid": "cd674185-49e2-4043-9da9-210ae0365d0c", "comment": "Malware payload", "value": "73ae67e61503943bcb5d2a577ec5753324a0b8ac5a342abf22ad29b1a7b505e9f04b7915b5dc9e608ffe8b6aac345c00", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710261609, "uuid": "027b5800-19f0-4b89-9e5c-eed8f7c831ad", "value": "T1BF67331E385E047AE26F2AF614697F276E22DC01333E6F069C4DE115D8273BD1968C9E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710261609, "uuid": "0b6765eb-6447-4104-bc17-c9fee6cbbf1d", "value": "b0d556e6fced10073d36709d8fe6ba14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710261609, "uuid": "b896bffa-3863-4540-a0d7-2bc09f0075ed", "value": "786432:PTgWCsoSGpTykrMQBYfUkmPTMqPVqQxGr2lGkufBTJR4Q3y:7LoSWTFMiYMX3KlU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710261609, "uuid": "33376835-a99c-4619-8c93-ce25baae0267", "value": 30374430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710261609, "uuid": "0c91ee76-85f3-463c-b1a4-ca162cb8ea34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710261609, "uuid": "e5b072a4-d551-46c1-9edd-67a3157984b0", "value": "SecuriteInfo.com.BScope.Trojan.Occamy.25705.18688", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "180f5aca-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232792, "uuid": "839a3e73-e1bd-4320-891c-dc1b72ccb3b4", "comment": "Malware payload (Mirai)", "value": "8b94791d8cf65198924e83aa893d60e5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232792, "uuid": "ba8ac55b-7983-4513-8f54-d24a927df563", "comment": "Malware payload (Mirai)", "value": "c99668104c50ac6d785a48978e08f2692bf07d37f606d984f1e32c2a9761e73a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232792, "uuid": "6ae96d30-a9b3-4521-a251-6ec85573c6b6", "comment": "Malware payload (Mirai)", "value": "e8b9711734744003ca94bcd6eb51be4f8b24d80f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232792, "uuid": "70b47bda-30b1-4043-991c-43cbff4a16a2", "comment": "Malware payload (Mirai)", "value": "dc4af617f52de39dce73c4db52420d0d38c27bc52265a7434f3958944258e4ee833c054f4e40a4693946cce4e740af55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232792, "uuid": "4837d533-907b-4efd-8ee3-3bb80083d798", "value": "T165435CC59563E9FCDC1019353077FF7656B6E93F1028EBC7D7A8A932A981A02D80728D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232792, "uuid": "da650bd3-3a4d-44fa-88f2-d4bc74baa3eb", "value": "1536:36Ew7hWCbZ6OzptrGP85wXyHWTF+7t+Rc:C1W4Z6OzP4NXyHWp+7QK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232792, "uuid": "92674a2b-e3bc-44ad-8b45-9f00c270c68c", "value": 55872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232792, "uuid": "1e770efc-f56b-4af1-8f9e-5d21d0648ff6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232792, "uuid": "b0af1214-3c00-4ae1-800a-4c75ab4b9116", "value": "8b94791d8cf65198924e83aa893d60e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa7a707-e09e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1710268015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710268015, "uuid": "dda8ce6b-399a-4d62-848e-f76a9b1b44bb", "comment": "Malware payload (Adware.Generic)", "value": "07c561e438e2db1c5905a4e00ca34ae8", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710268015, "uuid": "7a721a73-0e4b-4360-bf7a-fe1c1253b7be", "comment": "Malware payload (Adware.Generic)", "value": "ca15124661be40b1b562c8641bbb1ddfdb4a76d8ac88aa90d530ae2328829b58", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710268015, "uuid": "00108140-5d2c-4591-9c30-a8f47d7e8876", "comment": "Malware payload (Adware.Generic)", "value": "613d27f67ab755f6ca38b7ee67cb67cf01a5210f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710268015, "uuid": "50511e10-538f-4408-b00b-4016828b48da", "comment": "Malware payload (Adware.Generic)", "value": "23157dff5beb3b71ef79383257da9848efa8073456bdf70031d6e64a9a049bb92bd2da405e6604a8c9768f1700a21b0a", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710268015, "uuid": "b13dc52d-f636-4807-9322-8fc8d5a0e29c", "value": "T104554933BE18532ECD9A0A3D5E729010947BAEF17416CCCE17E039FE5B255A01E3AE56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710268015, "uuid": "a3c19c89-c4a0-480b-9c3a-a56d0d28fb41", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710268015, "uuid": "f9e42b00-194e-4f8e-8e49-61e7675f6386", "value": "24576:su53fFewAyrTVE3U5F5u+N+rc47FnIJgRNlTs7B1:suNfF3rEUpN+rconF7lTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710268015, "uuid": "85571881-0411-491f-8b89-d52bbc9e4737", "value": 1293088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710268015, "uuid": "ba002156-bb00-46d3-a616-8fb153db496f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710268015, "uuid": "6d95e013-5cef-4f22-a1e0-a509881903eb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ac0bc2-e044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710229546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229546, "uuid": "0d4e004b-e6bd-4dbf-b793-955132ae89d7", "comment": "Malware payload (Mirai)", "value": "13da2d4169e4951a4da6e9964a41818e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229546, "uuid": "feadaf69-90d5-4584-9e2a-86440fc67a34", "comment": "Malware payload (Mirai)", "value": "ca849e3223a82ecfe41e03d907508f7f7a74f939534181cb6c6370fe2a74437a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229546, "uuid": "0878e0c1-245e-4581-a407-2105aae29a4f", "comment": "Malware payload (Mirai)", "value": "598ee3b13c6e437f3df845af131e257816726af3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229546, "uuid": "e5ec8cbd-4bda-483a-802b-0d6d84ff1d75", "comment": "Malware payload (Mirai)", "value": "cd312cd01c060624f08b2fd5431148a01d7a1d7a001e658fbfe740e0633851b87b21279ee966a37b58849541968d05f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229546, "uuid": "935a108f-5e73-4ddd-b812-4c77e957fa11", "value": "T1F0F30A56F8819B11D5C112BAFE0E128E37131B7CE2DE72129D246F707B8A87B0E3B915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229546, "uuid": "919655ad-6830-4ddd-8bcc-83a775885220", "value": "3072:yK0USIUjoQ8BXtktwrDlaUUpP5qLAI0qeCCryRnj:B0KI2BX6tSxaJxgAIw7ryRj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229546, "uuid": "359d3211-a632-450a-82ed-462755b338c9", "value": 159484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229546, "uuid": "8f98a49c-0206-4c68-ad58-5b2f469ea7b3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229546, "uuid": "bd10a0c8-fd18-4ace-82cf-4618f20f3bf3", "value": "13da2d4169e4951a4da6e9964a41818e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "183f53a3-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235369, "uuid": "660cafee-a4fc-4849-8294-5cd3dcc120c9", "comment": "Malware payload (Mirai)", "value": "000b14344f463e92221e0feffd73ab28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235369, "uuid": "117c6e4b-9ebd-435c-a0a2-239601230e6b", "comment": "Malware payload (Mirai)", "value": "cb008f24884f0453d040a8db8a6983c775272b00d3bacc9c6654d7e89a694764", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235369, "uuid": "911ca7c6-91ad-4f84-880d-ef7d4089fae6", "comment": "Malware payload (Mirai)", "value": "efdc2ec71e5b7702b35fb4e87b0d4f9852a49398", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235369, "uuid": "278cf331-41ee-4d46-9fa3-03f523f3dd0f", "comment": "Malware payload (Mirai)", "value": "e746dd50a1443e5dbec1c0bd307bb8b9f641fc804a9b26c324d208f8efe962b2c3adb79ab708a2f9d22f06d7d58a0f84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235369, "uuid": "a8015e7f-e204-4e18-bb76-b30d9629def6", "value": "T175E3E80EAE215F7DF7AE823543B78E25B25833C533D1C4C5E16DE6022F60349642BBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235369, "uuid": "d3e5fd24-7dbe-4eaf-9504-c8636cd1eb05", "value": "1536:d5R469ccNgs8NSxF7KFJ/z4DWGDswxb2VCiYbcFhOPmG6UiVsezTQRg/ags:dckqm1AyrsMgCiYbcFkPmG6UiVTQSs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235369, "uuid": "2514c06a-c7e1-49b5-b30b-a7e35b5f7aee", "value": 146564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235369, "uuid": "9e9deabe-6187-463e-983e-2a3fca8bea5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235369, "uuid": "300725da-326b-49ff-a891-fa0370915e30", "value": "000b14344f463e92221e0feffd73ab28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "839dfd91-e09d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710267761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710267761, "uuid": "88546ddf-da69-4f4c-bfb5-93baf791a397", "comment": "Malware payload (RiseProStealer)", "value": "d21ebfa5e971bb5293c9de7a404792a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710267761, "uuid": "f6d756d3-5897-47b2-9a7e-b44c327f5de3", "comment": "Malware payload (RiseProStealer)", "value": "cb49adf3033abe1d446541a2b216b7cc9f50cd74494ec7d78dd365c952d3487b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710267761, "uuid": "6ade8fb6-5f86-4a33-81c0-3769ac863a55", "comment": "Malware payload (RiseProStealer)", "value": "850cae6b28d100738547f8a86889d71ff5289073", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710267761, "uuid": "e2b36257-88a9-4eea-9e8d-ddb243e71f15", "comment": "Malware payload (RiseProStealer)", "value": "81ddcb66274d932a2ecbe55d49799ca68c7a8f4fc1dc4d611eae429da135a72cc065e64325761c5020f4eb530b1b2b57", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710267761, "uuid": "5d339823-08f8-43d8-b356-eb73e79e7369", "value": "T16B565D47B59EC900C11C2F33D6C92A2493AB67829505EA2F37A1FB96CE533BF434E495", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710267761, "uuid": "c40e7e7b-b0eb-485e-a4af-7233deb91dd0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710267761, "uuid": "46d27223-0c61-4f0a-98c5-012d05f3d49a", "value": "49152:VdFCDWU2GG8XKQ3/cdt4osAZo5+cSAsAUSNlLOg/L1Jf2jTiQ/VoJu4E9/+j9Z29:VnCDL2uKecbO4ihsAUoDjj233NmmcPK7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710267761, "uuid": "b5e5c65d-1ce4-40e4-bc2d-1ba42736946c", "value": 6205240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710267761, "uuid": "8c714093-2f48-4bc2-bbf8-b4894c50fb6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710267761, "uuid": "c8c97a70-f5df-4dd6-a69d-1e5089567d0e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0dadbb16-e066-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710243941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243941, "uuid": "937a3fa4-f976-45a8-a221-7667453093f8", "comment": "Malware payload (Gafgyt)", "value": "d32b5bc3b873d48e42976b7c0597b87a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243941, "uuid": "c8b644de-6153-48c3-8c5f-ebf2bbe806e8", "comment": "Malware payload (Gafgyt)", "value": "cc958add2658b9dc08fb7dca5a69522ba08284d5493267b854ddccff67eda3e6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243941, "uuid": "2a148b8a-8753-411e-9d73-b79904eb63d1", "comment": "Malware payload (Gafgyt)", "value": "812b1e057aa08ef1bf90a1edd8632df09edc9841", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243941, "uuid": "2c248d28-1033-4a99-9ee4-e2a8c4228b94", "comment": "Malware payload (Gafgyt)", "value": "df99f89640b70ff5892db57b450c00ba24d3c0ca6c86d432d7b21370fbd645b661662d39b9a380dcd55e65bb3fd2f250", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243941, "uuid": "444f0933-47ec-409e-8109-2a84232386d5", "value": "T14BE3D606BF109EB7C81FDD3301F98B0124CCB49725A53B6B3674DA69BA5A58B05E3CE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243941, "uuid": "e7847e59-d138-4923-af2c-403136848ea3", "value": "1536:lgMxbKBo+0NFgNZhEyv2zJuoaZ8jCSRCt6+5Jx0/Jwq75hsp8nKxD:tYhEVzPasCB/e575hsp8nK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243941, "uuid": "ed733677-c1f3-47d6-a194-c4a53b072cb9", "value": 150112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243941, "uuid": "3ccebba5-c947-4c65-a1f9-bc637403821d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243941, "uuid": "07f13b78-7143-43a4-b420-a4c8beee6bf8", "value": "d32b5bc3b873d48e42976b7c0597b87a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adad400f-e023-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710215433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215433, "uuid": "620e500a-46f1-4faa-b307-77f5a77a5a41", "comment": "Malware payload (AgentTesla)", "value": "2b2ca14e71fcbbb6a94c3cdaa34491cd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215433, "uuid": "c4db2b44-3e6e-4b80-9cea-648f00f03bf8", "comment": "Malware payload (AgentTesla)", "value": "cd539c77b2566c536981bf3013f0832450a369442338f4caa6bc170a3602fc29", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215433, "uuid": "659c557a-19f9-4f81-859f-30a0642b93dd", "comment": "Malware payload (AgentTesla)", "value": "f689d7c2f24fea9c08ff669dc751f5c142b839f1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710215433, "uuid": "89294e8a-7201-448d-86fe-70b6233c02d2", "comment": "Malware payload (AgentTesla)", "value": "433a9634c94ee30c8a624d25113eeeba67ed1fc87054f9d73ba4d8cc56066b1bf7bcff18bd455bff284e603cefa2904e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215433, "uuid": "be0ed6ad-49fc-404f-9b6c-5a57d41312cb", "value": "T1E463037AE70F0915EF55E6BB434A5B490AFCB33E728540A139BC9734376D81E4A2287C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215433, "uuid": "ce9d2b95-713e-4a3a-8b86-a0bbb72e74a7", "value": "1536:WtAo8RuqfaRRAm8NvT7bpF7kKohATB3HPmAgCakIdG:WttNP295TBfmAonG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710215433, "uuid": "60f170fd-a296-4329-b4e7-570a3250ff3d", "value": 68565, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710215433, "uuid": "3e5bf631-de71-4e2d-9d88-ba47f7d4090b", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710215433, "uuid": "9871c448-e199-4a91-bb20-66caa3de0a6b", "value": "2b2ca14e71fcbbb6a94c3cdaa34491cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c8c89a-e0b1-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1710276321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710276321, "uuid": "84145403-8540-4bd1-8876-49724c53ad81", "comment": "Malware payload (Gh0stRAT)", "value": "4b9be72261c785dd268d40b47dd72f51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710276321, "uuid": "89293f6a-3796-40ab-bae3-86e497258c83", "comment": "Malware payload (Gh0stRAT)", "value": "cf9d732b0e10005f69e216698d575b86beb198f7a93866b5efa9218bd96d89ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710276321, "uuid": "b8955ab4-1e53-402e-b64e-e60ed221b680", "comment": "Malware payload (Gh0stRAT)", "value": "53d632fbddf14739238412c21dde9f7c3d178161", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710276321, "uuid": "1baa25cb-eafb-46be-94b0-4ddfab9f6845", "comment": "Malware payload (Gh0stRAT)", "value": "f468955e0572882f5c794b1bf233daecf747c0982737f8de9f3580ccaa33091b0781f8cb130fe0b43411aa83b0c58299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710276321, "uuid": "4a783204-abb2-4ca5-8ff7-03f27358c7af", "value": "T19EC3126F0B391423D9850F396189D963BA396380BFFD2484D028586B743C726FFCB669", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710276321, "uuid": "7e8f885b-0c1f-4506-a566-3e3d889d3374", "value": "b0d2dae2d78d58a4fb9684e85ffb160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710276321, "uuid": "7ff2127b-dab2-4854-b39d-5ca4d86e433b", "value": "3072:i6jsb9exS8NWZOVxVdqvm4drMN4sBjXa996yz/XLnD9UndB5O6TP0u:PA5DlZkN5Bo96yz/XTDkYfu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710276321, "uuid": "e62523c7-db46-48d0-9266-6ea573b6a629", "value": 127568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710276321, "uuid": "0a4f6716-4616-4603-a288-d182063a2082", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710276321, "uuid": "26b5b8bd-25f5-4e49-899e-08bb3f62797a", "value": "4B9BE72261C785DD268D40B47DD72F51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5f026c-e075-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710250512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250512, "uuid": "ceadccad-b727-4726-888e-0d55c3dbcc46", "comment": "Malware payload (AgentTesla)", "value": "876db5122f5ecb90acc915cec4c89810", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250512, "uuid": "4d8438b7-687c-4fca-9826-28943c34d7c0", "comment": "Malware payload (AgentTesla)", "value": "d04380b79524da697074a01b0af3809f881d0fb09a68364083aeb7a1be021249", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250512, "uuid": "38526689-02ff-4ace-bb4f-2bc12ae532ce", "comment": "Malware payload (AgentTesla)", "value": "4dcedd113292812c0ef832640f3e964eec73c289", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250512, "uuid": "4e9d0356-2c28-484f-a51f-134f8cceec5c", "comment": "Malware payload (AgentTesla)", "value": "2f035824256e390d4b85500e98d2f444c236ee607b1989a8130e94ea4003c79d784525a5e8b10c9cccf73f4ec71a9ce9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250512, "uuid": "ac1bff99-7537-40d8-a4ca-912edb58f2c6", "value": "T12BE423C2E6ACB361CB7D77790406823403F244523551E6AAEC0319F89B3DB8595FB6DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250512, "uuid": "a875aa99-e087-431e-a017-b225fdd06d19", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250512, "uuid": "a29640b2-91d6-44ae-862b-86de924edf42", "value": "12288:9sJTENl3zT882MF7D9mDSwXhblVpFSgW/MiMJRmDch58dbP1PIPcZpCDzep:+xENlDoMF7DUVRlVfSgEr3DE5eZAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710250512, "uuid": "9a8e938e-4097-4c97-8ac4-229df431f3b7", "value": 657408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710250512, "uuid": "d46d698c-b044-454b-aa7d-b5bb5c775ced", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250512, "uuid": "5541b4c6-4ba1-408f-82d2-97fc8c12d6a5", "value": "NSS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f6f0f2-e029-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710218078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218078, "uuid": "afd37378-6516-4c8b-81b7-e59666e2b67f", "comment": "Malware payload (Mirai)", "value": "c72cb0b088d209c61004413099256074", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218078, "uuid": "5cbd2935-5906-4966-bfcd-727bb2c38024", "comment": "Malware payload (Mirai)", "value": "d0b34eaccb1a89a0d9ba2210a211817790f58859fc85ad315abc00c76a25bfa2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218078, "uuid": "f670f241-f6b4-468c-b306-0a1d970e1bc9", "comment": "Malware payload (Mirai)", "value": "1f92d6f8660a0d65ef2aa02ce47366f704c6b499", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218078, "uuid": "92c913f0-900a-4984-89f3-e106be0e7852", "comment": "Malware payload (Mirai)", "value": "5a1eaf0257b425bf1e08bf1112194d2ed3a0d375fc0f4f05e985ab40a64913d15e918e8c5d84c01265da83561c305acb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218078, "uuid": "4f456849-c8e8-45ac-8664-f03f4f563e8c", "value": "T1B7F310A97A317B6EE5AC83300FF75FB4D70511C232A1D292E27CE6188EB035C599E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218078, "uuid": "dcb46cdc-a13d-47ba-8e38-9251455e60f5", "value": "3072:gCnGcLscPPHfDLc9owd+e4a/CxovAmK51hgmbG0kyBUOJAk3U/N818k6bZY:gCnG+xowBilS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710218078, "uuid": "9ddaf76f-5820-4cdf-9862-d6efb9e61b1c", "value": 160448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710218078, "uuid": "2c546e35-db5c-4804-a7cd-03ee6eadebd0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218078, "uuid": "d6c89de7-95f4-4aee-b667-105c81ce1748", "value": "c72cb0b088d209c61004413099256074", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80932c20-e044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710229531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229531, "uuid": "8e971c27-c994-4504-9337-ee2619471995", "comment": "Malware payload (Mirai)", "value": "cde00166105fa6dbbef681f3d2af6926", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229531, "uuid": "c1566d26-1ebd-4bbb-8c30-0ac823b86a74", "comment": "Malware payload (Mirai)", "value": "d1fdb7eb693c9f42f40047e83f613b82325cd7496055bb8cf8926fc54767af58", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229531, "uuid": "46fb48a9-4eef-4287-a9bd-0ac21ab630ab", "comment": "Malware payload (Mirai)", "value": "64c6a39c144b9f1f0adaec014c3307d91b805ae7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229531, "uuid": "3aa32894-185e-464b-8e6d-6cf3611438f1", "comment": "Malware payload (Mirai)", "value": "88c192f342704666c8f18419c112c1c923d92c2c400eb5998c6036ab5bcb4e3270e849bc717e3c51b0a20469aaa21ac3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229531, "uuid": "e18b29fe-c9c4-43a4-842e-89a460f84c45", "value": "T10B14A81E6E228F7DF668873047B74E25976C23D627E1D684E1ACD1101F6039E681FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229531, "uuid": "afdc04a4-76e0-4dc4-a0de-0b53c4a4e533", "value": "3072:lXu5nM714Tu06P3u2wTWt6ll8kj9iejPZFvoX1TI:lXcDTunuColPimZFgXhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229531, "uuid": "64355e6b-7f2c-4720-abad-2dc7ed36eca9", "value": 194812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229531, "uuid": "e1233590-189d-4226-afb6-7b4ae6e2a2c5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229531, "uuid": "d101dcc3-96f6-4e52-8f8e-bc536a332f69", "value": "cde00166105fa6dbbef681f3d2af6926", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44593466-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235872, "uuid": "e1840d84-4090-4e3e-afd9-a4e90ca09974", "comment": "Malware payload (Mirai)", "value": "70092f30bae30318d592e121bad98f36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235872, "uuid": "5dc20ce7-a815-456a-9d7b-19906f7ad8d3", "comment": "Malware payload (Mirai)", "value": "d21e8c18fa4d108a78ff2b1057cd72fa716cc78886b6a2f0219e02033a0626c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235872, "uuid": "2ac376fc-39db-40eb-b180-0944b67a3458", "comment": "Malware payload (Mirai)", "value": "0236188b04655ac4ca6a4675cac34cb9599ad8c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235872, "uuid": "06ec54b3-889e-4ec7-a7e9-578d3faddd8c", "comment": "Malware payload (Mirai)", "value": "bba4ebacc316200750b094f517414f59ad20457b17f1139980a17587fe8d0638fa5e90ea1258da6bcddca9df7195ed82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235872, "uuid": "c2baec12-978a-4893-ac5c-c4867b74af18", "value": "T12404FA1AAB510FBBDCAFDD3706E90B1139CCA54722A93B363678D524F50B50B49E3C68", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235872, "uuid": "a41508e8-6487-4207-93b6-7844c74e5e12", "value": "3072:uCQDElnTthX5MZ6vKOgwRl6adAbVNjuK/iy8:uCQQRBhaZ6vFg+ljmLyK/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235872, "uuid": "61b905ee-2380-4be3-aee1-317cff23fe5b", "value": 177856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235872, "uuid": "477b4cd0-a712-4200-af71-4b5a96bdebb4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235872, "uuid": "436652e9-7285-47ce-b745-9209f498e031", "value": "70092f30bae30318d592e121bad98f36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64f28379-e022-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1710214882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710214882, "uuid": "7cf825d1-b7ce-496b-a9ca-516b4a7b9181", "comment": "Malware payload (Adware.Generic)", "value": "dbeaa55abdf70e3e1aaa8259571d1bc3", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710214882, "uuid": "d6f60c07-a02f-4a55-820b-e7f1dbb2544b", "comment": "Malware payload (Adware.Generic)", "value": "d5e49c6fd7e3c58c608b7d1b2bf8c696388e65dfe85effc469bb2671af24349f", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710214882, "uuid": "4efb61bf-142a-4e3e-8783-e37d05ca82ae", "comment": "Malware payload (Adware.Generic)", "value": "52f9eed4c2537c75d9e8503c0d42f73c4c24b012", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710214882, "uuid": "7b0e0ca7-048d-4250-96eb-b044c11c6553", "comment": "Malware payload (Adware.Generic)", "value": "4e8b689578f8bd702d0f2190d07d8ba65983c8b60bff7a8d1621c842e6651cbb89025e8d78ec4d488ec3e923939ec3e7", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710214882, "uuid": "c19d6a9c-ff63-47f4-ab66-0cea1a6bce94", "value": "T11256123FF268A13EC56A1A3206B392509977BB61B81B8C0F17FC344DCF765601E3A656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710214882, "uuid": "1cff20ba-a49b-4490-9759-9a631e519f6c", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710214882, "uuid": "d291988f-534c-425e-8784-47ca84066402", "value": "196608:96I493aHggBbpbl8n7imoN6sWCy8MKsbsTC3:0n9WNbpBcpoNECvMK1TC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710214882, "uuid": "e16be7fb-a5d4-47ed-83d0-329d0bf6f96e", "value": 6366038, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710214882, "uuid": "e3579639-f1a0-4819-8fa9-352ed37a06c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710214882, "uuid": "df0fc6fe-6c49-4f8f-b342-f3683ad0a90f", "value": "SecuriteInfo.com.Program.Unwanted.4840.17727.21459", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d2ef186-e06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710247430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247430, "uuid": "ea818359-e3c0-4660-aca0-46db5674a63e", "comment": "Malware payload (Mirai)", "value": "5e1b37830d38db4c34243ab4b326def4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247430, "uuid": "77d8dc2a-5deb-46b6-a712-56be7232a5f6", "comment": "Malware payload (Mirai)", "value": "d6ee74e96a45b3d1ca787633dd6eb861daa21f4c6e35f0c00695640ac28c8b03", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247430, "uuid": "d9758052-426d-421c-861e-2dda64ad7a64", "comment": "Malware payload (Mirai)", "value": "6e94d1eaab05470c0fee0eef2363fd9ec97982f3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247430, "uuid": "041e5155-f11b-48dc-a2d6-c5f33063989e", "comment": "Malware payload (Mirai)", "value": "f64e130dc617358d8e7681241e5b57ecc2b18cf30cf8131d9ca60864b147ed3f75ce305a8836e5f798f1753b33e84261", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247430, "uuid": "b78c7262-3663-4962-b0f5-d7d7a9fbd62e", "value": "T14913F134AF200CEDE40F657614E21F945FF223F368A19A896899F95BCD9498C7853FD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247430, "uuid": "b4db8cdf-ae9e-4298-a0bb-2814e7a9350f", "value": "768:qT6rzBWuAYo4439RV8YaRFVIseAMIFw5KK0ztqrP5k4fl4RegglJgGlzDpbuR1Jw:qO3BWufo443mdRFVIsez/KWGLiVJuq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710247430, "uuid": "35c7b606-a628-4694-af8f-81e9a4c75059", "value": 42200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710247430, "uuid": "d124768a-1555-4760-91d9-e00910972e96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247430, "uuid": "c6ad1023-1f19-420b-b63c-e37a0577a5da", "value": "SecuriteInfo.com.Linux.Siggen.9999.32502.22648", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9abb5328-e08a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710259640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710259640, "uuid": "f50c6d69-aa14-4957-8e8a-345020133e82", "comment": "Malware payload (RiseProStealer)", "value": "8407c873fcadf727839152097cc54527", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710259640, "uuid": "99157b57-a4c5-4e29-90bc-8ad252763238", "comment": "Malware payload (RiseProStealer)", "value": "d73bf02e574fc907ee25a373379532da515a089511755756d4792016d4c0b0da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710259640, "uuid": "fd152bf8-4cd4-42ce-a7e8-3f5056d337d6", "comment": "Malware payload (RiseProStealer)", "value": "f099abaa9012edf444401ee6a32ca2a53c12e8b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710259640, "uuid": "fc74657f-be5f-4e9e-8274-ed009e27f403", "comment": "Malware payload (RiseProStealer)", "value": "901f15eb5dde1020213eddedd00afb1f105ee00cbd1076e38a39806ee48aa47d6e83b8b5ed8027cbe9b6fc4b6cec4b80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710259640, "uuid": "aff0a806-ab23-44d9-9b94-5cd0cd2caaa6", "value": "T15766331E69C390A4C85A5A744A83FEBD75F66FD10A328E4D7D49BDDBFCF20681932042", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710259640, "uuid": "8f8cdcf4-d22c-4316-a5e4-7690c9dacc10", "value": "23fed147ee36eec71d9dd79b6ff34036", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710259640, "uuid": "b19bb1e7-0656-48af-87c4-84c4f597c029", "value": "98304:XqPpXTGwW81gDV5JWs4ina6k0Y6wc4/Ar4ufBwzRMxs4ogNPqKvFbbDTo036EmIv:Xcq9VyQE5a4/AWzRVlkq4ZsQ6LURtCw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710259640, "uuid": "b6684fe5-928b-4987-b089-2a0e0472f2f5", "value": 7001600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710259640, "uuid": "4d8ec5c4-10b4-4af8-a070-5b0fb0666d22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710259640, "uuid": "6c1e46d1-f7a8-466a-8620-b82d9f8f665f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3caa542d-e0c3-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710283963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283963, "uuid": "527460a1-3705-482e-87c0-dae129e986be", "comment": "Malware payload", "value": "5b8a32a8aa43b0abbba8e540066a35ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283963, "uuid": "3f3c7ba4-9a9c-4f10-8cf7-2823a624d6e6", "comment": "Malware payload", "value": "d75697e57eee3f6f63114075c15995fef359eeb7a3f554e40d55dee19bead4fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283963, "uuid": "0006ed37-d2a4-465f-8a92-8d04c463300a", "comment": "Malware payload", "value": "b7dbf49dfa893e7aba4732ca3fd38452c3cd9c3e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283963, "uuid": "21ab3070-bede-4ca8-8e68-ec975caaac90", "comment": "Malware payload", "value": "d00827aeaba128068cb937b405bd87f35592f6f6bc284537e9d6419dc16544da4f91e7c2fc8fe685e2a69af8b48ea7e9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710283963, "uuid": "cdebb8a9-6ea8-4e8d-becc-bf0b528d643f", "value": "T1A9153379136CC8B7EC58E7300DBE0AA7BD2154B12098728B92505A983F43BE6DF3B745", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710283963, "uuid": "958a93ed-9cbe-4152-a7f7-8d4e304dfce5", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710283963, "uuid": "f0a03e5e-400f-4ffc-929e-4c2a1aee5b81", "value": "24576:5Njg/5WNrg4BubkHBKDrgRQDiQhceGrmhJiEFGfZmRGqEjh:n4Grg4BBHQPgRQthGChkEFAZVqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710283963, "uuid": "b6a73a64-bac7-464b-983e-286c7335f589", "value": 942311, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710283963, "uuid": "71b6f90a-b3df-4f38-82a9-49fe356aafec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710283963, "uuid": "bcb4e058-4ea1-4a46-8da4-64dac3cfbe22", "value": "5b8a32a8aa43b0abbba8e540066a35ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "272da6a5-e06e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710247420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247420, "uuid": "7f2797b4-d22a-4257-936d-108ac50b42bb", "comment": "Malware payload (AgentTesla)", "value": "fa6be6dde8f8897012af8920e2ff136c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247420, "uuid": "cc342830-273c-45f3-b748-f7b8b1db33aa", "comment": "Malware payload (AgentTesla)", "value": "d7966867119508715889e09798b581a31dd242c250b2f9318135e9eac497bb5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247420, "uuid": "6b8ed5e7-a6d8-4a7d-9a32-c1083889e199", "comment": "Malware payload (AgentTesla)", "value": "8d96fab98a8bd125c925ce05cf16fdb72ffbb32d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710247420, "uuid": "7ac5fde6-ba75-431f-9894-4dedb0b391f5", "comment": "Malware payload (AgentTesla)", "value": "a53d75a5f5d71a96bd36a289fcef30e12cbbeb33c22c8527562a5b7f1da702eb729c31e4877fd2bb316587de52a6aeb4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247420, "uuid": "6d67b1be-1a32-4af1-936c-17a3077e835d", "value": "T1C6D42355E341F93DD1F02E0D6AC2C6C2CDCE5409E2258E46A623B7B66B432F853999E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247420, "uuid": "4b20a503-ecc7-41bf-b84a-e267b5c3cab4", "value": "12288:9TF5+WuaqvAiNHRJVgapS8oujwmiFp2N68/gSaeLwLdSqoTSpKBvYld:BkaqvRZLo2wmiT2h/gFeELdSqoIld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710247420, "uuid": "90e01b9f-8e91-40e2-a082-e8dfd8ac094a", "value": 640869, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710247420, "uuid": "eabc39f9-e6e8-4790-aa31-86bb296c1bd2", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710247420, "uuid": "b91dfa4d-6d9b-4da1-a673-36c88312f89a", "value": "\u0395\u03a0\u0399\u0392\u0395\u0392\u0391\u0399\u03a9\u03a3\u0397 \u03a4\u0399\u039c\u039f\u039b\u039f\u0393\u0399\u039f\u03a5 PROFORMA 6534.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "598d6577-e02b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1710218728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218728, "uuid": "94d85a72-2da6-4179-baa2-4438d7c1a913", "comment": "Malware payload (AZORult)", "value": "51034ad4a20dec916ce9a900a667be57", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218728, "uuid": "ec11e286-793f-42e6-82b4-5c256d9ad555", "comment": "Malware payload (AZORult)", "value": "d803bbeca71dfcbc03c2e8fed4dbb5c7ccdd778c70558ca282df97dea20fc1bf", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218728, "uuid": "bfcc5c05-6c6a-44a8-a6ac-7a3d2c002b05", "comment": "Malware payload (AZORult)", "value": "74503a74d7a2b82a4390b092e6c4b66656c6f2ea", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710218728, "uuid": "61db5f9f-bf12-4627-9a3d-0d4857af6e82", "comment": "Malware payload (AZORult)", "value": "3620d3bb10c8d1d9f6f4f3bb75ffcc00128280da655efd582d6f9fa8968405500ea65cf4c5e374958bf9b6416755f54b", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218728, "uuid": "ab3e40e1-d463-4bab-85b0-bd8b5ecccbea", "value": "T135944B8BED44DBBAC26E86B6D56F075E835243326E0B3647A33D90917913B4323B634D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218728, "uuid": "15785a34-8f78-4048-b0c6-caf43cb92423", "value": "676f4bc1db7fb9f072b157186a10179e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218728, "uuid": "90a732ac-9008-4f28-a43e-fa58af7ac949", "value": "6144:KSTz3MaMNhXbyuWt2EHOO+7qeA5fphPFrKz1K59uYtuwI9JXhr5464NYCmkG0PRy:3Ty7A9ugI9fFCmAPRdhe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710218728, "uuid": "78e33b05-5a43-449f-86d7-df4fa3bc1323", "value": 430946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710218728, "uuid": "66eec95d-3924-43e3-a5bc-aa709b7730d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710218728, "uuid": "b15eca57-ccb3-4ba8-93c8-e56957d21c59", "value": "51034ad4a20dec916ce9a900a667be57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39f6634-e043-11ee-b7ea-42010a9c0006", "comment": "Malware payload (XWorm)", "timestamp": 1710229187, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229187, "uuid": "fcf214d3-ecdc-49f4-8a29-e144a09fc419", "comment": "Malware payload (XWorm)", "value": "98b02cddf010962964db312b10db0b69", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229187, "uuid": "dfc5bd34-e6af-43a9-99d3-a9f06a974ae4", "comment": "Malware payload (XWorm)", "value": "d984803170c0604ed956f02721b55050e01ff71bd1a1716dfd4959edb596d7a9", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229187, "uuid": "fbb07a57-6322-404f-92a1-53bf40c19f73", "comment": "Malware payload (XWorm)", "value": "02ce0f439734803b5026a2af680aac4c10ac606b", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229187, "uuid": "ac72e4d5-8318-454c-abd6-27dd236e2e2f", "comment": "Malware payload (XWorm)", "value": "3aef445e0d3f89d331d7c50751913a462a21ea9e060cf09fe1a2c98caf1ccce66534ce43333f40e2ab1c61c0f068e962", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "xw", "colour": "#43DCAD", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229187, "uuid": "f87956d6-8df1-4d73-a30d-1fd71983e594", "value": "T1EC029D521C0488BCEFDCF27BEAE6737A9980DD229738C1CE905D020C38986950CAA51E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229187, "uuid": "aea55c5f-e787-41c7-917e-a7cf007c29d3", "value": "192:T4jBKnp6r2BWRsRAvst6W9vlLDsrww0zqev5Im5ssco:T4jBKn7BesRV6Wlp9w0zqU2m5sno", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229187, "uuid": "62df89ef-cf54-47ef-ad9b-70bb36e18b05", "value": 8956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229187, "uuid": "993fbae4-f584-442b-a50e-cd6b02dd448e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229187, "uuid": "ae73fcdc-313f-4be1-9bf4-0c9370787585", "value": "Flotative.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edcd653e-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235727, "uuid": "aafd4ba2-c203-466e-aec5-d3b9c81c4c8e", "comment": "Malware payload (Gafgyt)", "value": "a2b43e55e68dc7e51064a9ba406fee36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235727, "uuid": "e782ef5f-b8bc-4a45-a137-c72dee79db18", "comment": "Malware payload (Gafgyt)", "value": "da608037ff80376990ea3b8925c3bcd0465a6d114c6daf69de44c9ae0a2dd4b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235727, "uuid": "ce51b541-f360-45fd-953c-d04683e5de4e", "comment": "Malware payload (Gafgyt)", "value": "0acc38ec42d4cb4ba925f02a5ef77fa55f1d2028", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235727, "uuid": "38b977ac-cc30-4d12-a400-6d3ccd8ba75b", "comment": "Malware payload (Gafgyt)", "value": "a35311a9dac1e415eddb804448a005ccb10989546ed7c9728c2ae1045c35d739a16c14f2959c47c84a013a980bb77b90", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235727, "uuid": "6ef80624-a765-410b-b7b4-e8d74f5c345c", "value": "T15D34213E3EB15BADD292C3714BF26EF086A565A62282D321D23DC7541E7438E0D7F660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235727, "uuid": "7812f188-2b15-4cb3-8ea7-4c5ea7283622", "value": "3072:R+zdQ0XLevCgBhtC++29Fri1/KzqR/49qHEkuOSX:kZQ8SvlBe+B9cWqR/49qHEkuOSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235727, "uuid": "c83d84c3-531a-40e7-99be-fe4c3c8cf4b8", "value": 240420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235727, "uuid": "2caad260-64d7-469f-99e8-ce10347a11ab", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235727, "uuid": "8417520a-a0f9-4eb0-877e-30a163dfd43a", "value": "a2b43e55e68dc7e51064a9ba406fee36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec2d0380-e03d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710226705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226705, "uuid": "0e91407e-bfa3-419d-afdd-5e691170590b", "comment": "Malware payload (Formbook)", "value": "59e1b1b47cd31df99e44c961f594e34c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226705, "uuid": "c2472e71-824d-4166-85b2-1498dc909972", "comment": "Malware payload (Formbook)", "value": "da8d21fe808c01783c737202d4c6f233d70db99b7c1180c5883963adda3e3d45", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226705, "uuid": "da26ecf4-064b-4d7f-8618-464b1f83cced", "comment": "Malware payload (Formbook)", "value": "7aa5cccd0ef833a30c1e111a44a1990e7c8f9702", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710226705, "uuid": "88cf390b-3f0a-457d-b515-c7eae8c9342d", "comment": "Malware payload (Formbook)", "value": "9c7d06d80930b70e03015b44a901feea9ebe26e9279a8accfea569d0750b766920aa0bfa5c68828783d00d25813a8b83", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226705, "uuid": "ad212798-c824-452e-bff5-4b2b8aeaac63", "value": "T12F0502F1B8A0B603C4A257B55A04C9615AB23C7E84EAC7DDEA907EDD7CB2744015FE83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226705, "uuid": "76883815-0352-41a3-99b1-6560ccb0e2de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226705, "uuid": "c1f0da26-6700-4543-8af1-f77d88cb099d", "value": "24576:EUdLPlaOOPaARuC+85fQGWK2VyRqIFUfhG:EyPladPaWuNRlK2Vy47M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710226705, "uuid": "faad0577-aed7-4fa8-a1ab-33d3e433209a", "value": 821256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710226705, "uuid": "5b6ccd84-cb02-407f-915d-bde0432917d2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710226705, "uuid": "c020cc0f-698e-44b0-b792-8ab52113b06b", "value": "fvdsoH9LQneIhQP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cdd8950-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235377, "uuid": "1a86f7a4-71c8-40a8-a442-79a4d2e40a76", "comment": "Malware payload (Mirai)", "value": "290779d560960d44faf4100f23521452", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235377, "uuid": "60160ac3-761c-416d-ad8d-b70252c971ae", "comment": "Malware payload (Mirai)", "value": "db7661da03d4146668cb91582b95330e5eb7a9c7b2a3eb8879973a197ee8390b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235377, "uuid": "4db34a4c-8a94-4a05-aea2-c694e04d1b9e", "comment": "Malware payload (Mirai)", "value": "c3491f18f50dbef3a8e731e395d4aa82d5057b09", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235377, "uuid": "a12760c1-9900-424a-a50a-de9fbcd62d72", "comment": "Malware payload (Mirai)", "value": "e3ce2371b7ee623f45519b899ff52f262567df641b7dacd50efe254ba3ea8fe892e53d3f18739b7a600cb8cd3e9dfb0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235377, "uuid": "804121e6-d029-4968-97c1-43555cad506c", "value": "T1BDB34A02773D4E53D1A21EB0262F3BE55BFED8C221A0B145399E9F2E8475D77484AF88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235377, "uuid": "ee0492fd-5475-4196-bd0d-6872174c18f8", "value": "1536:mGKosrE+ECBCz/Fc3T2XN8h+J8HIAH95vJ2FNA8i+b4KJyPRg/a9C:fXsrtKNWwji/H7MpiZKSnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235377, "uuid": "cdcd7f99-5d56-4171-be59-742722ada622", "value": 108936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235377, "uuid": "c75c05a1-b8f9-4279-a6bd-3d72022e14d8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235377, "uuid": "be87525d-d910-48f6-8a45-80d5304fab92", "value": "290779d560960d44faf4100f23521452", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e1bdf27-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232802, "uuid": "d1ce2763-ee97-4e7d-b7fe-2921c120cce4", "comment": "Malware payload (Mirai)", "value": "719d8685f3a81cff79fc9f6b66841155", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232802, "uuid": "9b557290-aae3-45ee-a3d2-1f8f19d620da", "comment": "Malware payload (Mirai)", "value": "db83dbd54c1372dc5cf987cba08904b0ec40c63ea0eebf0b1000861bb872afdc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232802, "uuid": "bdfcac67-1d2e-4d85-b0d3-a85f0be71d76", "comment": "Malware payload (Mirai)", "value": "851363de776fca5d08cb2f580f45ccfa055b701a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232802, "uuid": "e89b1a49-243f-4b7d-9718-74315c6d539e", "comment": "Malware payload (Mirai)", "value": "28021cd8c35042dafdf4e2bc45f73dba4d3e1bdc9769fab209455895dccb03e524f1b6747d7f6a98ac5980a6cc0178cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232802, "uuid": "1896997e-95a3-4922-b6b2-764620902a71", "value": "T1AF234CC5A447D9FCEC190A752177EF319AF6E93F109CD983C398AD72E942602E5072AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232802, "uuid": "19888ff3-05bf-41f8-aae2-8ca1d6844141", "value": "768:Ii+liNWE5NttVEi4Ws5BkbVTco8Um/BZWfd/046SDZkdyI:IiK25NttVEi4WszsVTcXWV/046OZk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232802, "uuid": "5056956e-a77d-4445-a2f9-ac64f22d4037", "value": 49756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232802, "uuid": "e7753b1e-fd89-4c00-a2fd-5978dddf47b0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232802, "uuid": "6a766189-7d45-4501-9998-c221a38195c0", "value": "719d8685f3a81cff79fc9f6b66841155", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93acd31b-e063-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710242877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242877, "uuid": "9432dcdd-2756-48f9-80ce-12420d380928", "comment": "Malware payload", "value": "1deaff8ccb5b9a0ce857650f9df9a0c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242877, "uuid": "3c8f23e3-cd07-4305-9ebe-7c4de1b46d38", "comment": "Malware payload", "value": "db9fc1f7419d9bfb5144d57677b5101825c97a27b04c074318cf726bfc312954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242877, "uuid": "b984ae98-f066-4a1e-aa15-1811269a8ad3", "comment": "Malware payload", "value": "0b56953509a79ea960b5a42ada3f699058030779", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710242877, "uuid": "84e7909a-4881-495a-8996-430cfd0168e7", "comment": "Malware payload", "value": "ca8bffa81e319547fba29dbdd6d90901de29e3ba6dc682468c4511651df7361fc8688c0e5f7cdca656a77591411733f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242877, "uuid": "689885a9-8236-4763-92dc-5d165b5b6161", "value": "T11C1633145E4C02A3C66B5B363433CB30D67A1EB746A55FD33A357720F12BB60763A6A8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242877, "uuid": "f1f24e06-9f54-4d3a-af15-40820f52476b", "value": "f1a8306dbe0addda8068ef3240a2d4a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242877, "uuid": "a0c8dedd-e836-42af-919f-ee63e823641c", "value": "98304:JMnzz9jK7mk9nrpao6EzIzGePewXbw5Dz99d3ZVUh2Wy:2z9UmwP6+YGePPLa99d3/UoWy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710242877, "uuid": "f2d201e9-bbe0-4391-849c-8c4622614e95", "value": 4301648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710242877, "uuid": "0cca3dc0-59e0-4dcf-ba7b-07c97d178dea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710242877, "uuid": "f697b497-9635-4b61-8e03-e37b1d15dc72", "value": "SecuriteInfo.com.Malicious_Behavior.SB.16895.17425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5368030-e03f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710227499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227499, "uuid": "21176216-36e8-4dcd-a8f0-a25fd38fe6dc", "comment": "Malware payload (AgentTesla)", "value": "c9242b8ac20befac94e276c4bc4dc4e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227499, "uuid": "f66fd296-7ded-47a8-84f6-9b4f98fe1261", "comment": "Malware payload (AgentTesla)", "value": "dc8ec5d730d569cb3e918507f166947e3c14b50408c5d32827038faa8c5a9418", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227499, "uuid": "ff9c05ce-40f4-4ba4-91f6-ea10c95e8096", "comment": "Malware payload (AgentTesla)", "value": "af2abae88173c307632d762fc0eb98c520a821e2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227499, "uuid": "cc5e48bc-63eb-478d-8760-aef883c20a95", "comment": "Malware payload (AgentTesla)", "value": "e32bd4b4b02e13face7635641eb3558da3826f4933e93990255c88f5cfbca3d8a70f13eaa03ec87802051db095262473", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227499, "uuid": "543cb82e-b1f9-456d-8e57-7fba14e67dcc", "value": "T1FB340E037E48EB15E5A87E3782EF2C2413B2B4C71633C60B6F49AFA518516426D7E72D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227499, "uuid": "9aabb2ce-da9c-4046-9460-d124eb6555f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227499, "uuid": "02c2ea0d-1068-4995-990f-5c665932508e", "value": "3072:845VNTCmyuyd0QxxTUbNeIMf/fTTEXXN2/5dhG5DcN:845V9Cmyuyd0QxxobN2bgXXgZGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227499, "uuid": "c3c7661b-da46-486c-80e4-8e3970e00f90", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227499, "uuid": "fa299593-eb34-45ea-816d-c6dfbcb5c74e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227499, "uuid": "03c43ae4-0715-40a0-9138-214be04d5629", "value": "Arrival Notice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02faecbe-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710227602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227602, "uuid": "e61a5023-5367-4e99-b825-7056de05b91e", "comment": "Malware payload (GuLoader)", "value": "2928ad86de776386b19c421d2785e4af", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227602, "uuid": "6880d2d3-ee08-4858-ab49-f3e8e2c12a05", "comment": "Malware payload (GuLoader)", "value": "dde6d0d3a5fe5d9376f7b4b2c3ed710044d5d62cbcdbde0f110cb0aef0bee279", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227602, "uuid": "23d457e7-6792-4382-900b-e0589488c921", "comment": "Malware payload (GuLoader)", "value": "2480ec610616f03ec49b83f1301429195e4a62eb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227602, "uuid": "7617e3f6-ec8f-449f-91c3-0689f6a05d3b", "comment": "Malware payload (GuLoader)", "value": "2e42f4c7a6c08a00b5dc3ab6cbffa7f3ed52484752689ef7b8c0b4de3707a78335d321e1eedda43757be0af4c25a277b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227602, "uuid": "5c3413af-fe1f-4eda-bee4-31d296920a8a", "value": "T1CBC249A5AE522152051B11FBF40E8274E51551FB8E6248397E8CF93E6C273087FAEC8F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227602, "uuid": "8ea7b7a6-0b80-412d-8723-45e21ea8b2f3", "value": "384:4gnmwSIZKd7mYfuiA10fpLPI/klIkG0BYZu1aybZMvfu14iMUP5wFlxZL206g19X:4ASIZgudeSIZbZMm4TswFlbLHrTfV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227602, "uuid": "a3b2d8bf-331b-4c15-a92f-f76c2ce1e493", "value": 27900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227602, "uuid": "287e8f29-bc42-4bf3-afbe-43edfcd24e93", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227602, "uuid": "34de1b33-b960-49d8-adf4-7aad0110e499", "value": "ETD 0303 DOCUMENT.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d16fdd36-e048-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710231385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710231385, "uuid": "7911fdc6-f2c7-44dd-bb5c-2369af2bece2", "comment": "Malware payload (AgentTesla)", "value": "37ce59f6d3b7762366fc86c790f45e43", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710231385, "uuid": "4a1caffe-4a20-4e2b-baa3-18a5bbf74c1c", "comment": "Malware payload (AgentTesla)", "value": "de471f4bbb775b482296856f55d75b6b70274981e9ce84da05137354c642d347", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710231385, "uuid": "5dd0942c-1a2f-44d1-bfac-346466de8ef2", "comment": "Malware payload (AgentTesla)", "value": "6c5918f28bacac2eddf8f7dbf56a0939add2becf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710231385, "uuid": "a10a02dc-146b-407c-977a-e78e771c51c9", "comment": "Malware payload (AgentTesla)", "value": "af22027af4c53816fee7fb12dcaa72270d859d2c6f9251fd891a41811dcccc82ce90fc7edb5622e3c932657283ebac5a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710231385, "uuid": "e5700443-1c53-48f3-9696-6daa54bdf9f8", "value": "T18FE423D337A89E53E43E6AB9DA72350123B1452A19E2F3EC9E8365EC7EC7B411444F21", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710231385, "uuid": "fc524d84-df35-4a2a-9c9e-3e5f75f30e4d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710231385, "uuid": "cd98eec7-16c2-438f-b449-4685ece19562", "value": "12288:MpFtImAFboN4EMWJVBY1pcBa+isvzKxmEVbOJ5ggDjRDjaMzL:M61F8NlMe21pcBWIMrmgW9l3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710231385, "uuid": "11f80ff9-8e11-4cb0-a074-5d0ef426206d", "value": 662016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710231385, "uuid": "0403e190-154b-42a2-87ca-d7740daf6025", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710231385, "uuid": "e50e6bea-bde5-49e2-9bdd-fa84afd50849", "value": "Total-Invoice-001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194d13c4-e080-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710255127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255127, "uuid": "b02397a3-1ef9-4673-ae64-0cdf2bbd82db", "comment": "Malware payload (Mirai)", "value": "93d0cf54d17b4a23a80fa4c7fdf8ff66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255127, "uuid": "65ce9774-5838-49db-a293-0a4f0ef2df1e", "comment": "Malware payload (Mirai)", "value": "de9e05cd0cad562bb5e68d45f640b71884a99e95c2f49bb7962bac7de3c6e6f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255127, "uuid": "8e0de80d-fd2f-4091-b093-440c37dd996c", "comment": "Malware payload (Mirai)", "value": "36938d4ce70f544793939f2ae6851b66beb603bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255127, "uuid": "ad6124b6-8a28-470b-8010-bb9ff323ac81", "comment": "Malware payload (Mirai)", "value": "ce5a8fc1b3d55c48fc2bd40575f33bf03c604d747d488ed3ffab4a237d64f6a315b45174459d6de2d5f775398294f238", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710255127, "uuid": "fb4159be-eef5-4056-abd5-1288225564f8", "value": "T1DB834B22BA761D2BC5D4A8BA62F74725F1F2479A24ACCA1E3D710D4DBF6064032437F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710255127, "uuid": "a4a72ae8-3a4c-433e-a2ef-589abd1ae197", "value": "1536:0/ljSKn8VD/5Fh4Ofup9cjLz/tEv5Nk5Wt6wl6utZciWK:0tWRqON/Wv5NUNNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710255127, "uuid": "b59335fa-dcfb-4532-b76d-26900ce77871", "value": 81132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710255127, "uuid": "983e1974-beee-4c71-b9eb-6e17a45fedf7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710255127, "uuid": "872f350a-4186-4e02-9832-938a435e3014", "value": "93d0cf54d17b4a23a80fa4c7fdf8ff66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e8db655-e058-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238144, "uuid": "cc254e91-fe09-4249-8319-b04438f600bb", "comment": "Malware payload (Mirai)", "value": "61128d055b5652d2748814e93d3f2c4a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238144, "uuid": "b7c9abda-f570-4680-aac0-7642267f2748", "comment": "Malware payload (Mirai)", "value": "dea00ef5abd4cef90f14f0ea55a8c0807fb760a93e657ca5cf6aef681a474d12", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238144, "uuid": "9d56ee41-b218-41c5-b1f7-b895d650e6ed", "comment": "Malware payload (Mirai)", "value": "634df03f64b1ce190cef4f26c7ec3db20afc559b", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238144, "uuid": "d8517ff5-e386-4271-ba68-692b66df1e58", "comment": "Malware payload (Mirai)", "value": "072dcf2ab0d07ee80d20f825e512814f89e8ffb0ba47dd6c9da30f1c93716794932053ad8b370cbb2c0d78a9e2a0c0f3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238144, "uuid": "1044abd2-dc2e-457a-8690-bc7702ab4e3b", "value": "T19153182B6A92C87FC59712F51AD7EA71D423B83D1B7345437398BE296F368C82C09316", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238144, "uuid": "3f0b4551-f56e-4d37-8957-c491b227ad92", "value": "1536:v8i/06Wbi20C+7Ko5RQ3xKb4m73PBRdD24Gl:w6WN0jRQuT3g42", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238144, "uuid": "f8571a1b-83c1-47d9-b035-ed0fade93a05", "value": 63241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238144, "uuid": "ace0200f-2cb4-4629-b87e-91de58d91c06", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238144, "uuid": "7c472dd0-57cb-4404-9cd7-1f0dda40f1cb", "value": "61128d055b5652d2748814e93d3f2c4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76dfe2d7-e060-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710241541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241541, "uuid": "339de346-418a-4619-8ae4-439d62e80a44", "comment": "Malware payload (AgentTesla)", "value": "f5b194a805de8de90d8c742adad636c0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241541, "uuid": "be2f69d8-e11e-44bc-bc94-7b317539830f", "comment": "Malware payload (AgentTesla)", "value": "dec4338fc0ba9d42260c73680eccfee3a557089cf4b4d938e1455af463fdddad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241541, "uuid": "3d91e6c9-8813-44d3-a082-8ae6fa1290d4", "comment": "Malware payload (AgentTesla)", "value": "c0254d7487d4df711a84f02121ddd5fa9b1bcbf8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241541, "uuid": "ce44084a-9aaf-4b47-8e0b-9bb2992bf85b", "comment": "Malware payload (AgentTesla)", "value": "e9c986cd5f60930dac3a4ed87bcd2f736ebc709489fc047bd1d0aec36bec6453b0ea3b64f74dcbc1ae1c12253dc08e8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241541, "uuid": "9659c404-beac-4fa5-8912-665e3851db83", "value": "T1D8D423C21BD6E967D09233B9C03BCCA0682668B5CA84376D9355F51DF87A783D80B91F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241541, "uuid": "8e3b8933-be77-4784-b188-98b93d8750a8", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241541, "uuid": "973c99bd-5000-49a8-a03c-2139633c6527", "value": "12288:GYV6MorX7qzuC3QHO9FQVHPF51jgcQJ1aT+z4P5qiCDlZGTq:FBXu9HGaVHDjPzasG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710241541, "uuid": "d4583901-22ae-4d36-be6b-f7a47e42b1fd", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710241541, "uuid": "d7fd940c-8bde-4ef8-a856-65fe75bbaec2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241541, "uuid": "ca972329-d5e4-4f9a-9b7e-b91794717ef1", "value": "rOrdendecompra_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44605e2b-e01e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710213109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710213109, "uuid": "fe231a0c-375f-4b45-bc64-afb2ff78cdde", "comment": "Malware payload (Formbook)", "value": "ab74b52d1ea5ef201a973d429a1ea391", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710213109, "uuid": "93b21a4d-7d2d-431a-947f-d949e5d665fc", "comment": "Malware payload (Formbook)", "value": "dff16015060738ff6ca68093a23d4cd57e91af191a2398ac1afa00dcb4e4903f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710213109, "uuid": "c0f25e8b-99f5-45eb-817b-d2940545f010", "comment": "Malware payload (Formbook)", "value": "f49e82b818294e34759e96f673f0ccbdb7664f8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710213109, "uuid": "8f7b2443-d104-4851-9f32-5575fd0dc640", "comment": "Malware payload (Formbook)", "value": "2edab8fe7dbabd34db135315442ad9e9bd7e51b890eb61b4d1833deba84a14a5cae1ac7024ffabab8781dd32cccf4063", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710213109, "uuid": "4d799783-b2bb-47fc-b4fd-8c8a53469e82", "value": "T1A5F41299397D5B53C236F1F8497A506807F21A1A282AE2EC4CD336CF45F9F450AA0F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710213109, "uuid": "d2a63656-d486-46be-ac50-96e442c514ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710213109, "uuid": "8c21e6a5-57dd-4f31-93fb-a3f70c042881", "value": "12288:WHsJTENl3lVIEF/PWt/VEfR5IdJ84LjS57V+RWL6kg6HjagyxbDyQBU3tgp:jxENlHF/s9EXIdJ84izUkg6HjagyNUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710213109, "uuid": "2745bcab-d9ca-4376-a8de-d288217e83da", "value": 761856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710213109, "uuid": "4380ec5e-c028-4196-a991-27af5c7920bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710213109, "uuid": "ec5394e8-3a1a-4d99-84d5-389bbe336226", "value": "PI for #13288.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d8d011a-e04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VectorStealer)", "timestamp": 1710232398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232398, "uuid": "5d94f47a-2ebe-4d79-a8dd-fe00d65ee5b2", "comment": "Malware payload (VectorStealer)", "value": "d716d4f3198952e3f2432db1a8a77e7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232398, "uuid": "2bec00a5-3c3b-4069-8834-8fd59580ca17", "comment": "Malware payload (VectorStealer)", "value": "e0235979f896b679c748237077324e14c3558e7fadfa5a49c4ff3f75362125be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232398, "uuid": "06e2a4d3-4a06-4dd5-a84d-e71218cc5fd4", "comment": "Malware payload (VectorStealer)", "value": "8eab71aa1aba5f07448d71b5b711b13a85516ea8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232398, "uuid": "03caf6f6-ca6a-4285-9ba3-3e3fad2fa5b3", "comment": "Malware payload (VectorStealer)", "value": "56bd207f28a500e74d19524682813d51e0d6f53459b8387daf5a73f1c3f3113701ded16381bc603a8abd85aba37babf2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VectorStealer", "colour": "#19C14B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232398, "uuid": "b3dc247f-7fad-4230-a8e5-3b32868f158b", "value": "T1BD368E09A3D406E8D46BCA30C59AC732D6B2FC660732974F1594F34E1E77AF19E6B221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232398, "uuid": "742d23fc-afd8-485d-9bec-53bb8d7eff08", "value": "e667133631326d8d58d5c55070002d53", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232398, "uuid": "68c90529-4c23-4d1f-aaa5-967563b690b3", "value": "49152:rr2fsX15SwBK38kGtb1//n7aISSSwFx2u8gFr27RZbjXmmBJqklryA8LfIE/esM2:o6/IQpF4tmmBoNfd/ez2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232398, "uuid": "b88ad1d3-68aa-42ba-a0c9-f76008d48876", "value": 4943872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232398, "uuid": "44783c48-7d57-4d03-9c5d-220aed130ef4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232398, "uuid": "606a8640-ad2e-4e65-9bd7-d4a782f0a1ca", "value": "SecuriteInfo.com.Win64.Evo-gen.11214.17480", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c90e891-e07b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710253200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253200, "uuid": "e2f29007-29b8-463c-ac67-0192961ee8bf", "comment": "Malware payload (GuLoader)", "value": "81704fb7c22254ea691f7bcbe375e555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253200, "uuid": "918004a1-f15c-4fa0-bd44-42b97e8e0a1a", "comment": "Malware payload (GuLoader)", "value": "e05b4db1f487e0a8e0bb2e6d62713f2f1cd6d55338a4f4ac70c5fa0a6eb525b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253200, "uuid": "8490f095-0089-45c3-af08-e677225c0257", "comment": "Malware payload (GuLoader)", "value": "f21e095e2d1dd4849eac4a0579d4f1a2baa19e9a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253200, "uuid": "31f18b82-550d-4394-b931-f8d34a411041", "comment": "Malware payload (GuLoader)", "value": "cfb9a3a37a94e578539ed265b23ab9801703834070817aadeb1808b24052ce29a181edb4edd858803dc6ee97ccd541fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253200, "uuid": "7c1dfdd1-debb-4e03-b8e6-f19a40d119d2", "value": "T15DD335D3EE371589C93981BB2EE5A35616E90E8D3D0B3E3A214B70A2F530DD3DC46691", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253200, "uuid": "d7c9a1bc-645c-4b1c-a010-5a3d1f305e46", "value": "ba072a972fe6c47c8cf7a0347bb0af7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253200, "uuid": "d986f2ba-4eae-4734-b99d-3891b9700ea1", "value": "768:dV7/s1GSV7/s1GkUPUEUb0OV7/s1GXcV7/s1G:di1GSi1Gai1GMi1G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710253200, "uuid": "8aaa7582-7200-4bf4-9526-be143f1e0180", "value": 140720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710253200, "uuid": "c488b479-506a-4671-b410-97691d5ac8af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253200, "uuid": "c31d9a1b-c6db-4a19-854c-22f2fe676263", "value": "PPortnoy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13154645-e053-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235790, "uuid": "cfdf75d4-8d85-46be-86b8-7653d5770a0f", "comment": "Malware payload (Mirai)", "value": "c4996738cce49efafe3fcdbbb83df12e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235790, "uuid": "bbe05dd7-5764-4c62-bffe-9c0c2fcd6554", "comment": "Malware payload (Mirai)", "value": "e08ad495c3b35a5624884f250990bdc303f3a079623ab6fd6f985386d2cbeba5", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235790, "uuid": "596d40f8-9164-44f5-a92c-85aa5dcef882", "comment": "Malware payload (Mirai)", "value": "83b9562fc2725d3079d17c52b6b43499280c90aa", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235790, "uuid": "8f02eb2e-845a-4a17-a2ff-7a13fc15858d", "comment": "Malware payload (Mirai)", "value": "f8694a9a821eed089e2a8f4bb3a317b138cd950c99384d6b3e8441d18153193f79380cb7296c47fc03ce134d5fda08a5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235790, "uuid": "84110eee-5861-455a-b83f-da2a152a97ba", "value": "T19703F127D132A4B6D437C873BD9A61C05893921FDA22039E44EB2C7E4D2BCEF7D18A11", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235790, "uuid": "f64497fd-bfce-47b5-8be7-85ac6a4e9c8e", "value": "768:jaxibuAhmOKJ6fX1pxxe/ENzOHBRrxPpyj9QcjJKx0sh:joguCmOo6fFzQ/bht2j5j4l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235790, "uuid": "a7020f86-ffee-47ba-aa68-eba6fa6c71b4", "value": 40684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235790, "uuid": "13482260-3e58-4925-97c4-cafd07683fe9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235790, "uuid": "e58ef386-9f07-4d03-bd79-c93c2bc8b51f", "value": "c4996738cce49efafe3fcdbbb83df12e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24b0a024-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232813, "uuid": "092f22e8-a01a-408b-982a-4a7c2f3ff475", "comment": "Malware payload (Mirai)", "value": "ac4cda17af7d69c00e5e9ff3eed00839", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232813, "uuid": "1ee1186a-ee10-43b6-ad19-14b57ba83755", "comment": "Malware payload (Mirai)", "value": "e2c6f7d59e5fc04ab3b37f1b56ed4db9820a0776cacf54cc5ce3f17a85c67f18", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232813, "uuid": "24af3909-fc06-4dbd-874e-ccea55c44027", "comment": "Malware payload (Mirai)", "value": "e609a479200f2a7790e08c5696e2eea6f9114d63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232813, "uuid": "6a759272-2cc2-44df-9ac8-fe9a7913d14c", "comment": "Malware payload (Mirai)", "value": "56bd957b55311c2116b39d966b8f9fca95bec52b2662aaf14bd268d3cf5dc33df89db720891259590bda2bfb4d3882c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232813, "uuid": "6906ce4d-6571-4e24-b5fb-a6aa6f2f81ed", "value": "T1F453F946FC818A12C5C913BAFA2E118D33136378E2DF73529E106F5477CA96B0E7B952", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232813, "uuid": "9361ef3e-8795-4f59-8720-f586bc4901cb", "value": "1536:M5n9dQzsIw8K2QAwMiEhiBAapaczKxWRqV0EvmsXaLxIVi76yBZWA:sSwIiA5iwGANczKxFV/mt6yBZWA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232813, "uuid": "f44baa57-1152-4270-a864-26b8fa0d3a89", "value": 63188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232813, "uuid": "4f3a7aeb-b664-4a3a-94c5-823100f894fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232813, "uuid": "68138408-303b-4a9f-9665-106f8b2375f8", "value": "ac4cda17af7d69c00e5e9ff3eed00839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8018ff47-e045-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229960, "uuid": "019c59a5-ee10-4607-b09e-36d51b5700e1", "comment": "Malware payload (Gafgyt)", "value": "e3fd7588fcc33df3c3058c2fe9f731d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229960, "uuid": "76a12896-a03d-474b-b1ea-d8dc2b66a830", "comment": "Malware payload (Gafgyt)", "value": "e3617c0c456b646afc6ce8264a7345e572181cd720b662846e5f9f9a0d5235ed", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229960, "uuid": "a4f9c257-b21c-434f-9b8f-eb15386d0963", "comment": "Malware payload (Gafgyt)", "value": "5218c46b70db5704475784bce5c053ff1d2c8963", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229960, "uuid": "96cb724e-b989-4b31-8000-9205a0fd114f", "comment": "Malware payload (Gafgyt)", "value": "496bc964b36a8e5b184d6b52f1a4b3ef3eca16ff44ba1545c7f0a2a01156e605d60b1b17067e91ce6aa733189923f556", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229960, "uuid": "1b92e5a5-92e2-4073-a86b-4f62eee351e8", "value": "T185E3D92B22232F13C4E505BA01E28634BCFDCDAD35E64FD3AA897E691E315D436913D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229960, "uuid": "b29cc38b-ddf5-4d48-9121-1b3eab5b8409", "value": "3072:gTDdK1HtlydmQVioNPwxIiC9Zp1j/70cEIxcHgyps:gTA1HilQIxbN/70cEIxcHgyps", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229960, "uuid": "0522fc16-703a-463e-8511-ef61d6f2ca84", "value": 153676, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229960, "uuid": "cee889be-9e99-4551-82fd-7f6d73cd999b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229960, "uuid": "04e0e0d3-20aa-4339-bfed-f1c8e4de76cd", "value": "e3fd7588fcc33df3c3058c2fe9f731d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1acfa9c0-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232796, "uuid": "51174162-7a22-44e0-9718-612d19d450c9", "comment": "Malware payload (Mirai)", "value": "299cc7d7746e1cd576b14a3fbc68133f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232796, "uuid": "abd2b40d-df4a-402e-b6bf-04a74bf01b86", "comment": "Malware payload (Mirai)", "value": "e559b643ac22e5edd1b131ca12ae27f4eeb592a6967e8f19a0fd0b819e0bdf62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232796, "uuid": "93022a9d-649b-4d25-8e8c-4cd48120428b", "comment": "Malware payload (Mirai)", "value": "e84cc3e21031a854fd46f21ea4bceac40ed8bc7e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232796, "uuid": "754d10e2-378b-4913-9096-67c404c8060a", "comment": "Malware payload (Mirai)", "value": "fb3fda984a0e5a632394fb236211fd5f62d501c6a3a04246bc1e95098d06ad00383245f33287c07967c2b9d9c46a8c03", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232796, "uuid": "21dff1b5-a6d2-4285-9376-514f256126f9", "value": "T15D435DD5B400DE7CF98BEB7A80224A09FA35726154A30F27A267FD93AC720564C2FD47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232796, "uuid": "91c924d2-ee34-4a45-8862-0ff1eab154a5", "value": "1536:ntCdFUWyWse2sRP876XyaCkBnKSQDVFQFM8r:isDsR5XXLNmF2h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232796, "uuid": "ede50638-51f3-42cc-b779-ea9f5b7d9a9b", "value": 59720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232796, "uuid": "e24fe1b7-d7ea-4fc0-a15d-09807dbf9119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232796, "uuid": "ce737365-f616-4bc3-ac76-4727652ca38b", "value": "299cc7d7746e1cd576b14a3fbc68133f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6599aec-e0ae-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Heodo)", "timestamp": 1710275228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710275228, "uuid": "86c5e638-86b8-461d-b315-996b1363e2e6", "comment": "Malware payload (Heodo)", "value": "57c1c689a0d31018d7083b93a9566a37", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710275228, "uuid": "9062ddde-f1af-4991-a8e1-00962fa6f3fc", "comment": "Malware payload (Heodo)", "value": "e645efa325075253b135abee449f311dfaf47fc8ce810e4f23834fc32e343692", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710275228, "uuid": "5691624e-f0cd-4108-a86a-1f00d244c5e7", "comment": "Malware payload (Heodo)", "value": "ea0a9d5949f6c90713eff6455e9424ac6947cf5b", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710275228, "uuid": "e098b1d3-377d-4d47-8fa0-e3100a36c974", "comment": "Malware payload (Heodo)", "value": "13fa3b853cfe71132d64a9e015e782dd295911d20bbce1e9ec94dfbc6f2ba3d07b2dfdf7c07a7840fdca602895cda299", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710275228, "uuid": "be78dce1-ba29-4d9a-a438-8e0aca117c59", "value": "T1A4B6222273EA4266E2F35F38D97A91B05431BDA9DF23D46F6364741E2E71E0085A3372", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710275228, "uuid": "5b3a2b1d-4a42-4b62-a3d0-3934fdc918fb", "value": "98304:zVjPL0K+IdYdnkGzCgJU18bMSVjPL0K+IdYdnkVjPL0K+IdYdnvVjPL0K+IdYdnU:RPIzCgK16/PIWPIFPIGPIHPI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710275228, "uuid": "f21a8bb9-ee07-454a-b81c-b759f95cf2d7", "value": 10936320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710275228, "uuid": "2b6469c7-d4f4-4883-8106-32c46a5856a1", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710275228, "uuid": "e33153f3-b335-4d6d-872f-a8745654bec1", "value": "DiagnosticoSeg.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "690d0beb-e087-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710258268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258268, "uuid": "865c11b0-cab6-4890-8c5f-729e9c3ad8bd", "comment": "Malware payload (AgentTesla)", "value": "eff9ea9d90c62b834407536ec0e0ea10", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258268, "uuid": "1a2284b3-6c1c-4e7f-bfdf-7b99e768ed74", "comment": "Malware payload (AgentTesla)", "value": "e680af5aeff3790e13bcb0ccd366236ede503619cb13c8e7348107e6906a9f4a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258268, "uuid": "bbf45bbe-c80b-4efe-a57d-1b8b1debc9f1", "comment": "Malware payload (AgentTesla)", "value": "f2ec90f57945eaef5ce611859a8a4a4dbb22cacb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258268, "uuid": "c2debda7-e7ed-4ea6-ad0d-816448405762", "comment": "Malware payload (AgentTesla)", "value": "189f15e753df0880acf82e521965ede593d134d61b1757341762e7303b1d38939812c0db52c23fa755454297b2490f69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258268, "uuid": "e2cf51bb-a2db-4956-b6b5-bca2644b6989", "value": "T1B8F423019D65BCD11D04C532A86A6E862AE05FE0E0ACF1DB7EFD15B32B427184EF759C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258268, "uuid": "f55ae76d-b41b-49ff-889f-b6c2f9456a6b", "value": "12288:vKFmW7+1wWZurp4TaaK0eF0eVmkAbOvcwmD4OmcQLMX1r6WKfPf4kzym/ae:iAhd0rp4Taq6bVmNGIV52Pqm/ae", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710258268, "uuid": "90d4cb6f-4613-476c-b6c0-4c4f73f9ff85", "value": 724992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710258268, "uuid": "a67584b3-6592-4db8-b721-60b4b32cbc86", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258268, "uuid": "8af41d93-e98c-4b3f-9f42-c8a85f65ccaf", "value": "Morton Glass Works PO.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a935f28-e087-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710258136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258136, "uuid": "d85098c7-532b-433e-962a-7eaecf655357", "comment": "Malware payload", "value": "baca24aa075fa49c50d6adb1971b0b13", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258136, "uuid": "d1abef61-5cb2-4624-9978-c147e8d0ab58", "comment": "Malware payload", "value": "e7c8182dff40915a386e2c46409790d5117c1a6d374ae2e990513cae79b94fd0", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258136, "uuid": "e545b25f-440e-42df-a874-69609ae6d5fc", "comment": "Malware payload", "value": "2e97b0eaf60f528e78204281fb96c45f59035f24", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258136, "uuid": "23fc088e-3978-46db-a56a-c3fb9a2bc5aa", "comment": "Malware payload", "value": "3548319ab58f8d6ac4e9e12eda6936dc3f8a72cd5ec9f6ce383c4ab474e3602246daf7143711167c21f67bb4911ddec1", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258136, "uuid": "d29da9fa-d217-4503-b387-6e519b0c60d9", "value": "T102273327F673102180442866A17C4FF40603D4C97EBA781D73FAAB2D9EDA562DD7AF12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258136, "uuid": "71c29b49-aad8-47c7-8844-548321e8cfb9", "value": "393216:8L3bAWdXQ2+kvC4i8ezXKh6MFi0yPH7/t07H24I/:K3bAAqrIezaZFi97/2q4I/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710258136, "uuid": "71dfccfe-f079-4cb7-84ff-fcac1f570972", "value": 21452947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710258136, "uuid": "513f4d25-0e53-4d9f-919d-c0b19a964309", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258136, "uuid": "33f52b31-c1d9-454d-a7ce-c497109f1eaf", "value": "baca24aa075fa49c50d6adb1971b0b13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "babc5e3f-e072-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710249385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249385, "uuid": "2e92d055-6da5-4eea-8c32-8e0b6c6ed891", "comment": "Malware payload (AgentTesla)", "value": "d555da013d512f714926dd3213083e5d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249385, "uuid": "f59dddc1-5d7f-4069-8db6-7d10fd5b4f33", "comment": "Malware payload (AgentTesla)", "value": "e837bf6c58ee97ebdb7c3d58a733f3d527bf0150f1eb551af6707f71d54a3457", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249385, "uuid": "594ee06f-d6c8-42ac-b85c-0fae6d283fe8", "comment": "Malware payload (AgentTesla)", "value": "25ae9c59ae5b3bfe27933981b0a68a0445b22458", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710249385, "uuid": "bab1994f-f064-4bb4-a1f5-026f814c590e", "comment": "Malware payload (AgentTesla)", "value": "b64c9b8c6de0e327aead8375ee73ff6bc339f2702bc5c9757f45e8ea83c55b1e237338efc1412f8956d65f9f5a7ef0f9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249385, "uuid": "3693ba1d-cf1e-4cc4-9187-1852a9403668", "value": "T1C8A4194157508C36F1BE06F6509D0039E3B4ED9666DAAF09D98CB4A1ABB335E10FF21B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249385, "uuid": "f4ea56eb-9b42-4c1b-bbc2-a4f1d81405ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249385, "uuid": "8e20f418-1d17-43f7-9f01-af3116559dc0", "value": "6144:0stUW74e1KpFcqsIi3IDCIHA/lWGHalBNLrK2OgBBmdN3MVqRw6aPMGGmGlH:02UWwFZCTsG4BNSgB43MBm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710249385, "uuid": "97668e91-03c1-4890-a013-a1daae69cf4c", "value": 493432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710249385, "uuid": "c1d4346d-64af-4293-912d-40c42f9265c6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710249385, "uuid": "59f60578-6b89-44f7-b994-79b10cad9851", "value": "BF-TL-605877001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074f385b-e087-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710258104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258104, "uuid": "13e14532-bdcc-4d24-946f-9311272dbeea", "comment": "Malware payload (AgentTesla)", "value": "6a8dffd20be3520bcfc96925ad0d8d89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258104, "uuid": "a1b4dd24-ea77-4ad0-853c-58f899e52768", "comment": "Malware payload (AgentTesla)", "value": "e9183cdb2a87d7cdd94f78fd9d29861b13085e8e3a71e44d2e690386504a5ea3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258104, "uuid": "e78e2a60-fe88-4ad8-9676-ac42219a83b0", "comment": "Malware payload (AgentTesla)", "value": "50e5bc0d48994810b38e5f3d8d1829fc04710cfa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710258104, "uuid": "cbabe034-b897-4a28-86a2-b2785cd7b0f9", "comment": "Malware payload (AgentTesla)", "value": "4bff92e79908b721b2abee08a4b0f76750b37f0123cd4ec532ac7f6c4324050197ebd42d5fefadba27e6587b8c7ea139", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258104, "uuid": "54cf9679-d4dc-45a3-a4cf-0ed31f2f946a", "value": "T112E433A519E9ABDDC3DDA0146CBE89C448618183A74BD0DD09B8BDBEDFFD007A54360E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258104, "uuid": "8f576e60-8b87-49dd-ad2f-05c7b8f987a5", "value": "12288:8DjdMz97huEPm6+2oASnkfFcjh0CZnUVrvO00UFD6XoYAPpzzI/MkI:WjoLPmVktSvUVr200UFDa3ABPRkI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710258104, "uuid": "196da40d-43a2-409f-839f-2b5bb64521db", "value": 662181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710258104, "uuid": "51589253-f136-48e3-b6a2-8106fa0e27ed", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710258104, "uuid": "85c4e133-05b4-45c5-867b-e63061323b2d", "value": "Payment Details.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d15ba78-e05a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238894, "uuid": "1a3567bd-6e87-4f03-ac0e-67647a14ed4b", "comment": "Malware payload (Mirai)", "value": "02cc030a5edd53762cfa65c46f36129f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238894, "uuid": "01e5b825-cbdb-43e4-8126-f6d24b1502e3", "comment": "Malware payload (Mirai)", "value": "e9f4b1dc63a50b3024612df4e58d7b8fd8652a342c27164aadba964fff351bb8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238894, "uuid": "f9bd95b1-18ce-40e0-af0c-f3036ece6214", "comment": "Malware payload (Mirai)", "value": "14a8a744a760621494f6429b5c99d5372e0f7554", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238894, "uuid": "9ad492fe-66d4-4f36-90bf-92c971754c96", "comment": "Malware payload (Mirai)", "value": "45ac0205aad9c33412fb74eedd0582f98ea375691f47d68733f3027a482b5bea383c53a9c0dc3229af00a3150cc258da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238894, "uuid": "43d56cef-242a-4749-ad28-5331a6dea725", "value": "T1A3C32899E8C24F15C4CA16BAB92D618D331203B8E3DF72139E109F64B7CB51B0F76996", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238894, "uuid": "27971b94-ab2d-4030-ac9c-2cf04d3ca50f", "value": "3072:P4Jst0PAmVQBv58z8FKvyaBi7UK813xo1p:Pest0PAmVQBv58z8FKKaA7U81p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238894, "uuid": "e0f0c839-338e-4450-8c6f-f7c2c4470f6a", "value": 124344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238894, "uuid": "0714f811-03cf-4e0c-a661-d68fbb6d94f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238894, "uuid": "cecabfd6-419b-4380-baa6-009f0094dbe7", "value": "02cc030a5edd53762cfa65c46f36129f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7d620b4-e07b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710253353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253353, "uuid": "9f6d4aad-613d-4505-b2c2-d087df71403b", "comment": "Malware payload (RemcosRAT)", "value": "76164388e5338c2fe4361f143752a00b", "object_relation": "md5", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253353, "uuid": "80fd4d12-0dc1-46c8-b582-390986c70d64", "comment": "Malware payload (RemcosRAT)", "value": "ea61736956edd9730cf706ed647bd7e896f688c42b3c5f202210e2081a44b5a3", "object_relation": "sha256", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253353, "uuid": "3565fdf3-d94d-4d88-973f-ab1bdd3c2c78", "comment": "Malware payload (RemcosRAT)", "value": "4c276ea2b897389020ab690e6f1722ab24ea182c", "object_relation": "sha1", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710253353, "uuid": "66c1fc83-84f2-4f3c-b18c-cc347aede62c", "comment": "Malware payload (RemcosRAT)", "value": "305b37071b18193f828072bb02e10090b803d6923e8df90c4b7e7310e8bffa05c10a9068c09a9cd1c3e2b33eb13d72da", "object_relation": "sha3-384", "Tag": [ { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253353, "uuid": "ff3da075-53da-4fd8-b420-7056f0c60de0", "value": "T149D227DA8F5210550A0326F3DC4E1A34C96441F7A52345B57E6CF6384D02BA83D7F99F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253353, "uuid": "1be67e5a-c2ad-4056-8f6b-2997b79b08b1", "value": "384:fM2TcgurL9HQCRaqFJkpB6OByMmXFmz/GnP2zRHugpxKJL2siEvd7vaY2JRwBzSt:k2QgtWjkpFyd1mCzgi2Kl5JzSyoue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710253353, "uuid": "54cd7cb2-d012-4c92-a321-ce029ef46c75", "value": 28819, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710253353, "uuid": "93d1c865-5a30-4ae1-b523-a425f510b44d", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710253353, "uuid": "9947b060-b329-41a1-8234-8d11d6b2a2af", "value": "Foldenes.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6efd88-e0ab-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Generic)", "timestamp": 1710273573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710273573, "uuid": "7ddc9814-2cdc-41f4-aa12-ea1a0c0b51dd", "comment": "Malware payload (Adware.Generic)", "value": "64eed4fb1fe6b284deccdead2c26d2b8", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710273573, "uuid": "b3563a4f-8ad4-4eef-9200-d58925b194ed", "comment": "Malware payload (Adware.Generic)", "value": "eab3df9e504a809b5746ad04224ab5feaa47fb61d3cf14686f47d9dc32aac649", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710273573, "uuid": "7a6a35c6-9f29-4adc-ad0f-d02c79f099eb", "comment": "Malware payload (Adware.Generic)", "value": "da16c673022fe8589209e1c39a23a5b9069a5d8f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710273573, "uuid": "de99d8a7-98b7-45e4-91c3-bd6f07dad167", "comment": "Malware payload (Adware.Generic)", "value": "6c1a9bdf4a8e342014101bd34feaa82c420a5d1627ea3f79d385127557a2d4632941c0d4385675671406734a1c03f25d", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710273573, "uuid": "0349cf61-814e-4834-8821-700993a367d7", "value": "T1D6553923BE1B532ECD9A0A3D5D729050947BAF60740B8CCE1FE035FE5B254631E2AE56", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710273573, "uuid": "04f258a4-af96-4e55-85a0-e04898ff184c", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710273573, "uuid": "9e01039b-edc3-4d2d-b8cf-b631b977831b", "value": "24576:8LFskawAyrTVE3U5FUlnsG91P7Cpa4bJUt:8LFdrEUansS1P7Cpa4bJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710273573, "uuid": "38b6da87-722c-4a48-b19d-ba81713030a4", "value": 1297184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710273573, "uuid": "51bc155b-7a0b-4bf4-b0b7-d21e3b43d41d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710273573, "uuid": "cc9c81ed-0263-4799-875e-4a13bc0dad78", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e90c31b3-e0c2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1710283823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283823, "uuid": "4003d961-b8f8-4eb0-8713-54030a56b1d9", "comment": "Malware payload (Stealc)", "value": "9227369b74652fcc8327671f4313c643", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283823, "uuid": "6d78bad6-1381-4784-91af-7e2d6d53f057", "comment": "Malware payload (Stealc)", "value": "f038e263475b5724d94bd0386a6e803e64c443808ffb2cb94c16d152da3652fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283823, "uuid": "facf31a4-e466-40f4-a1f2-43fbfd354b0e", "comment": "Malware payload (Stealc)", "value": "aafa8311b2c5dfa09ba3f5b455b72e12b181e187", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710283823, "uuid": "7ed56330-498c-4931-a2fb-a97d663aef69", "comment": "Malware payload (Stealc)", "value": "fc0700767efd4a4001b3a26210d8ddbd83c129110611b63407b38c30044695d4dfaefd0ef70b03000119847092aa2738", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710283823, "uuid": "cc38462a-1800-4d14-878d-b54faa97ced5", "value": "T17BF33B10E213502EE4A204FF66AE5F76E5D869A20355C1C7E3D06BD826F01F2AD74A7F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710283823, "uuid": "9f0f6755-07fa-4ec6-ac24-9a93cd9e3b42", "value": "1ef0d6e4c3554a91026b47d9a27bf6db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710283823, "uuid": "4ebffb69-172d-4322-a602-787c3bde500d", "value": "3072:HPPSlG8SHgpJSG61doHN4NgQaUukOkzybuAjwpurH:HPQZryZoIg5vkOkOlmuj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710283823, "uuid": "12946178-2025-40df-ac20-e75b4110ccce", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710283823, "uuid": "f325eeb3-92bb-40a5-86a3-45a455c6a283", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710283823, "uuid": "19debcb1-e69c-44b2-9e13-359c4f4a2539", "value": "9227369B74652FCC8327671F4313C643.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833f194e-e044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710229535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229535, "uuid": "200c7f88-64ac-48a9-8bb3-3939a10372d2", "comment": "Malware payload (Mirai)", "value": "4250f5fe579ed8484c5100c8d7568f40", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229535, "uuid": "7994128f-ed89-4991-9d3f-316e6ba0492d", "comment": "Malware payload (Mirai)", "value": "f18c572a3fd7991610837a063fb0c9c55a8d30f9b03595817eff910d2ceaeac0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229535, "uuid": "e51b72f0-0526-4b8c-8b9d-64ab6682404c", "comment": "Malware payload (Mirai)", "value": "a8cc3fa44d016b8182f37d202bbaa1e27cead8fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229535, "uuid": "2c730780-0f5f-417c-add0-2e6bd7bcd5be", "comment": "Malware payload (Mirai)", "value": "55795a9b2566e2b889706e495db0ea505fed622774e3ca12a87b13040881b895074c2853f47a2211ce7e8904666d93b1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229535, "uuid": "8c4fee54-32ce-4fd9-9eee-7cb6ecf532fd", "value": "T161D35B73D8296F68CA54D1B0B0748F796B53968181472FBA29BBC2B48083DCDF545BF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229535, "uuid": "bcd58bc1-9106-40a0-8738-6d82206332ca", "value": "1536:NaFF9cAG3kxg/H0naDCemKcdIO7qRrGUuhJm6WLk8YWUkKM6Hhi:NkW3PHeaDvcNeGUmM6WQ8YfgChi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229535, "uuid": "10339a54-cbb6-4720-b358-d8b4703e5437", "value": 133920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229535, "uuid": "abc4ef2e-ba91-442e-9fb6-783352347c4d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229535, "uuid": "b2c0004e-f0ad-4ded-b568-c4762ce2d92a", "value": "4250f5fe579ed8484c5100c8d7568f40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454db2e8-e05f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DiscordTokenStealer)", "timestamp": 1710241028, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241028, "uuid": "52180804-d435-4dc1-ba04-05ccafff3556", "comment": "Malware payload (DiscordTokenStealer)", "value": "ec67053aaa930a0fd853a9806e7d8c59", "object_relation": "md5", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241028, "uuid": "6076c6af-77d6-43ec-aafa-3bcfa31b7b36", "comment": "Malware payload (DiscordTokenStealer)", "value": "f1af9f28af21a501140c783960a70a31a1339c9c274c7a98b8e5c5ac728dab54", "object_relation": "sha256", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241028, "uuid": "6431e89e-9e53-4b73-8e82-b0e6db986877", "comment": "Malware payload (DiscordTokenStealer)", "value": "732604d05514bbd00ba4b1fa2ef994197cc3a1b7", "object_relation": "sha1", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710241028, "uuid": "b624dcee-726d-4d39-ba8c-e47c0658d5bd", "comment": "Malware payload (DiscordTokenStealer)", "value": "f24a73a032c1d22fab2c3b313568c2be80a94924be15701600027d6bcf01cdaeb88017471a1efdf20d6a7e3c5cdf9822", "object_relation": "sha3-384", "Tag": [ { "name": "DiscordTokenStealer", "colour": "#7CDF3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241028, "uuid": "a2fe44c8-e4a7-4b0a-9e08-1e37208a1dc2", "value": "T1AC475A06FB809ADEC664823689EA43913770FC141F279BD76A44B37C6C767C96DA83C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241028, "uuid": "f80b6578-c101-4e64-a141-cc29f212fc48", "value": "f2dec354dafd3d7e669b500e1f959937", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241028, "uuid": "abefc4d2-7fbd-4b1c-b507-91f4970c6ecb", "value": "393216:KjsI2vunTpIMdL2tW35NJDKYN9EX6157eG6OCW6/LaN5PdO7YG3HQrrhUMH5:6sChUu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710241028, "uuid": "dc3b9c55-02a7-4fce-a91a-267c2bae1e75", "value": 26843286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710241028, "uuid": "1be16f99-738f-4d8b-bccc-cd5a02c755aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710241028, "uuid": "250569ad-6ef7-4c27-afd1-3de37ffddc46", "value": "main.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "291a3495-e07e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710254295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254295, "uuid": "15b63182-c73e-41e7-8096-7280a6ea541c", "comment": "Malware payload", "value": "fd3de1502c7d3d3af83c576a4f2b4741", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254295, "uuid": "2d6d9b6a-935c-494c-9a7f-4b5568386f8d", "comment": "Malware payload", "value": "f1e81d5e8c29176f72f4640804f60f926c7825138da923c151eb65428184059c", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254295, "uuid": "0f01a1a5-73ac-4ca9-84d4-9296a15514f8", "comment": "Malware payload", "value": "3b9fadc6a07e6d68d172afeabb5768ca7fc639cb", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710254295, "uuid": "651978d5-1db9-45d3-9ec0-705d6198c2b4", "comment": "Malware payload", "value": "422f7fd164401f5ecf27c982c24cbf57d3f9aec088a7ed29c5aeed07690fbe78454164a4628d64e7c9ae3e0f011535f7", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254295, "uuid": "669a8dc6-76e7-4ced-a460-e98691b185d4", "value": "T1AA662312B8468931DAAE0B315919A770AE3CAD74A720959A731C743D0F7138173B7BF7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254295, "uuid": "c3613563-b7fa-49ad-bbc3-a160d55e7f4b", "value": "196608:GLLk8CiiEk7gTr6PrU0ry9ge6qHJIMixiZJbH:aCjEWg4rDeOKKTiZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710254295, "uuid": "d997f69e-9d8b-4a99-9f36-212f7e68f931", "value": 6524928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710254295, "uuid": "e0ca90a4-f9e9-4afa-bb90-ec579687c1e5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710254295, "uuid": "2f08e68f-0615-4878-b1b0-a8d4353b2cbd", "value": "SecuriteInfo.com.Heur.4448.15264", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5239e0df-e04b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232460, "uuid": "21316423-9409-499d-ab98-029e361b7db3", "comment": "Malware payload (Mirai)", "value": "90c43b2e456a1359a340e89c07fc9b34", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232460, "uuid": "efbb1323-e649-4144-a3f3-66aa8f2ec17a", "comment": "Malware payload (Mirai)", "value": "f366176a8a34d1af45e145594472d8d4a09fc019e47ab143f311af7af0da7ccd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232460, "uuid": "843f55a2-7c3b-4226-9a3d-ae56aad4be8b", "comment": "Malware payload (Mirai)", "value": "c7a97835801063426a0f4ef29f364e07145bac12", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232460, "uuid": "befacd44-94b2-4de1-b73a-bfed1f278df6", "comment": "Malware payload (Mirai)", "value": "c34d6ddef6ae2bdde5cc18851e29652b50886d35b43f47280469ee3329993fe8bec032423445c1598672ba5c2aa5fe7f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232460, "uuid": "388ec295-5484-46d2-8ac0-762a13e4ba07", "value": "T1F2531755BCE28A12C6D462B6FA2E418D332663E8D1DF3207DD216F1137CA82F0E7B556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232460, "uuid": "57d88e03-82ba-4247-b89c-cf0811626213", "value": "1536:hQXM23x+JdY6j0pTqBSjdmVrL2yBCtt5KS2LxlR:h6f+Jdy3QlvYbKS2LxD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232460, "uuid": "347a87a3-7ca9-4a32-9f64-a1ddc7affba8", "value": 60792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232460, "uuid": "ba6f8a49-6b59-4660-b73e-5ae5ce6d76ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232460, "uuid": "207be6d4-a5d7-4fac-9301-7d21ef5135f8", "value": "90c43b2e456a1359a340e89c07fc9b34", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97bce3a3-e058-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238160, "uuid": "086238d4-7531-4964-950c-52d26d3187db", "comment": "Malware payload (Mirai)", "value": "9ac2cd4559a31ed1911422929520d4e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238160, "uuid": "409f761c-e8d6-443c-bacb-78467c6f87f4", "comment": "Malware payload (Mirai)", "value": "f3e2a3a0935161e15ad7a5be19f1fef3dd60732d9c41e904f664b76d86f467c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238160, "uuid": "8c5da559-c34b-4e94-a048-5cffbee10b35", "comment": "Malware payload (Mirai)", "value": "05d7e890eb9fb0bf435d4f2f966cfd10c3c247b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238160, "uuid": "aed85b1b-bb99-41ff-9b8e-cbb59e74da5b", "comment": "Malware payload (Mirai)", "value": "362ca4a4b327a34b0df5c549305da4db0e8504335eb42d57eb6b7cd56a28fbebb30a3d05e76a0593bd62f8d02f149578", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238160, "uuid": "89004544-0711-4c33-8e8d-98bec2760690", "value": "T112531947A8A2AEF7C015B9B139775A64035FB9112F5F0AA6793CEDB0034F1CAA01F365", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238160, "uuid": "615192f9-5fe4-406b-ba2b-6f66e39e93ac", "value": "1536:BDgYHDlRlvY7Et+50dXEtdLzTCb4Sg2F4:B/DTpY7SXEtdLzTeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238160, "uuid": "cac4efe9-5914-4435-a615-e7b08bd16c4e", "value": 62458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238160, "uuid": "acae58b1-8992-4ef3-82d0-4b53b29e2821", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238160, "uuid": "f6f2c991-d355-4b13-8f0a-15acd8388c83", "value": "9ac2cd4559a31ed1911422929520d4e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db2806e-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710227620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227620, "uuid": "56f98669-d49f-4f6f-9f8f-0828a8746591", "comment": "Malware payload (GuLoader)", "value": "a73b869bf9dc42e78a0d933e324eac7c", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227620, "uuid": "5554701d-c5be-49ba-921a-c9676286ee68", "comment": "Malware payload (GuLoader)", "value": "f40c84588a5c61195a1363f05753bb480c53ce07b0f5567257b4a3cefba4e5ba", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227620, "uuid": "b08c6e6c-5d68-4897-98bc-cbbc6b934cab", "comment": "Malware payload (GuLoader)", "value": "de52b8d48e946772f11f5ad844f7a6192f3b34a6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227620, "uuid": "8ed63849-c04e-41a0-b2fc-b2f7025f59ed", "comment": "Malware payload (GuLoader)", "value": "ed114aaed5261aa8ed2152202d6c6ab86afbc5e814017f2b975d0d3c25fe545591ec4636b7c95ba37aa41982457722bf", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227620, "uuid": "42712b75-cef0-464b-a66a-59d6e358c903", "value": "T1C8A229894FC21C05824216BB9C6D6BB1AB2644275432B0B87E9DF36E240E7477BEC5CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227620, "uuid": "bd79b31b-af75-4b70-90bd-b0ad7b6a7df6", "value": "384:ce9lTh47ToRm7YzMNqVY/pv0QBAZ/aht+w6CEDEuxk1dNfXplT/kl9CNz1:vbT67ToEUoNImBAEht+NCME0k1dNPnTL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227620, "uuid": "d42b0820-d96b-4c47-93bb-99a2eea3f662", "value": 22983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227620, "uuid": "6eb87500-2f77-4a41-85e2-a143c6598f74", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227620, "uuid": "adda4d54-675c-48a3-9606-a7ff82d63cb7", "value": "payment_Adv.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10fc1ba8-e0c7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1710285608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710285608, "uuid": "02cc3ce8-45ea-4d59-a642-7a90354da9f7", "comment": "Malware payload (RiseProStealer)", "value": "589dfdcf4a87bf28e0bd8df10df7e604", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710285608, "uuid": "ad77a15a-90f5-49b1-9eca-394d91d1e0c8", "comment": "Malware payload (RiseProStealer)", "value": "f477bfac03858a0b533faa941cd95fc762b699b59ce7496ac87a0fefe1ea8e4f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710285608, "uuid": "d8c27acc-8f02-4e33-afe6-ac58dde68e7c", "comment": "Malware payload (RiseProStealer)", "value": "6ad6822df45d23c0944b058b993c39bdf1920fb3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710285608, "uuid": "693f51ad-b10d-40a2-89b4-c113a68d1b60", "comment": "Malware payload (RiseProStealer)", "value": "fdfb7178d4621185e0294fedc645e4b406cb1de43a9eceb0c61e249095f7b50d394ce9fdbbc3c5986e667d549655adff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710285608, "uuid": "4c3395e9-6151-49dc-9bbc-ed52cc33edf3", "value": "T13DE58E62F909B2DFD48E1B788527CD525A5D07B8032909C7AC1CBEBA7EA3CC111FAD54", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710285608, "uuid": "b89f2bae-6e79-4e6a-bbf6-1f98e5acedde", "value": "baa93d47220682c04d92f7797d9224ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710285608, "uuid": "86a0f44d-34db-4d14-b45c-e77cd5f8dcb2", "value": "49152:AKH3PgaWcOmvuybV1soeznn3x/UenWY5tUhuZOmIMwrJ:AKH3PggOCuyp1soez3pUef+kZOxMwr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710285608, "uuid": "ff6a92d2-e43b-4613-bce1-0f5b63d1359f", "value": 3166208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710285608, "uuid": "cdab55b0-607d-4309-b7c7-fdfbdc7f2f0a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710285608, "uuid": "374fad27-6e1f-4706-b2ce-77e2a094f0ab", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83732d56-e041-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1710228247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228247, "uuid": "f38d930d-687f-4b38-bb2a-0ff8fb259eb3", "comment": "Malware payload (RemcosRAT)", "value": "d7adf6083cb76c5ff73c0250d874cbd9", "object_relation": "md5", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228247, "uuid": "4883b823-ca6a-440d-a69f-dfb401faeb43", "comment": "Malware payload (RemcosRAT)", "value": "f616c6ccf5d5162de99e06ad2555e9feae22f0b3f9a63753552c67ceb00124d9", "object_relation": "sha256", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228247, "uuid": "a6cb8d34-8b66-4e49-95e5-1a6eb89cc462", "comment": "Malware payload (RemcosRAT)", "value": "f1b3e245746504cdf0c3ed2a019bf300acf88613", "object_relation": "sha1", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710228247, "uuid": "c6922f19-629f-4244-8bfc-17c4dfa51f77", "comment": "Malware payload (RemcosRAT)", "value": "0e0f4e23784fa15d51c4d186f7fa39dd3e0ee0e0f7238a735b73d850b0415dc83bcd7b874d9dc9db0b070700cff615f3", "object_relation": "sha3-384", "Tag": [ { "name": "base64-decoded", "colour": "#89156F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228247, "uuid": "eb1ac10b-7356-46a8-9747-ef0d581ed116", "value": "T118B49E01BAD1C072D57524300D36F776EAB8BD2028364A7B73D61D5BFE31190B62A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228247, "uuid": "0ed01b5a-5fa9-484c-beb9-3014b797ea9a", "value": "8d5087ff5de35c3fbb9f212b47d63cad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228247, "uuid": "6c9215db-e378-4171-9c8e-72a6268ad56b", "value": "6144:aXIktXfM8Lv86r9uVWAa2je4Z5zl4hgDHQQs4NTQjoHFsAOZZDAXYcNA5Gv:aX7tPMK8ctGe4Dzl4h2QnuPs/ZDxcv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710228247, "uuid": "a68cefc5-2116-44c7-86bb-72470e9c2795", "value": 494592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710228247, "uuid": "2be13bc5-93c7-4a01-8d64-72d54bebc608", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710228247, "uuid": "2f9eefd6-35f7-4c3e-a492-3cdafa68a700", "value": "1710228246da2ebbe442542c426e28c0df992bca85d59c521a027975c70d161027e53b6d2f971.dat-decoded", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ed83301-e059-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710238547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238547, "uuid": "1befa62e-0871-47d6-809f-9d07c2431b23", "comment": "Malware payload (Mirai)", "value": "b1dd4c5707f3f18f555e025b1c6630ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238547, "uuid": "00c6ebf5-072b-4969-a37d-23b9a0ba51cb", "comment": "Malware payload (Mirai)", "value": "f6323b21102be18c80d8b4c9467639962e30b85412c00354e38364a5198e62d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238547, "uuid": "2457a6e9-ce61-458d-a306-fc7c1b59880c", "comment": "Malware payload (Mirai)", "value": "55a018305a361fbfeaaa6bbe8c72df44e1aacf8b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710238547, "uuid": "b9c212d5-82bc-4ee1-939d-8b9bc864235a", "comment": "Malware payload (Mirai)", "value": "8e5717078009d602606e29191d5f2939cac1ee7bf8e324d1a7c658c6784f8cb0d12c13fcd69d02f2caba728a2e8f8794", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238547, "uuid": "04b5000b-0235-42e6-a47f-813abaa68039", "value": "T1D663D644F954936FC2D277BBF759028D373A1A58B7DB33111A382DB43BC5BA86E29120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238547, "uuid": "9d5e18f5-da99-4bf9-a182-800b8cf4c4c7", "value": "1536:i7qwbqgeVeb/0EqY886FRIBWTVHm6tZcva:YeVK0EP886FBTVwC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710238547, "uuid": "974ca1ea-3b0d-4cd7-baec-114880c3df4a", "value": 72557, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710238547, "uuid": "cfdbc6cb-8608-47a6-a5fa-4eb896b17bdc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710238547, "uuid": "6b224ae3-f13b-4ebd-9e03-694ebaf10e25", "value": "b1dd4c5707f3f18f555e025b1c6630ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de7b1e5-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710235405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235405, "uuid": "fb3c1b92-cf77-4a64-aeac-397f5aeaf72e", "comment": "Malware payload (Mirai)", "value": "d67e390da06eee0fbeec323895f8e757", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235405, "uuid": "c845b9b2-d4f7-4187-8548-837c01d4b5ae", "comment": "Malware payload (Mirai)", "value": "f65f9c7e6e9e4c1a3269c9d2c08a9f6ec81120e157bfb8d56aea76a85de02a85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235405, "uuid": "ab31cd89-8d33-4f1a-9136-54d6e07ce626", "comment": "Malware payload (Mirai)", "value": "c4457cc5de166359a3bc77d618e20f9684a18d4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235405, "uuid": "68719a9b-c9dc-46b1-a795-31ee0f7f82ae", "comment": "Malware payload (Mirai)", "value": "f7dd56ab1c548b14ca9b04f40d4dc42b3c0f0a450368d3a8dd46698cf377e8ca3ac900dbe34399fcb7ce32cfbb7e5d8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235405, "uuid": "5bc73bfc-1a1a-4b8d-a9f0-778deb6ddb37", "value": "T1D6B34BC8F8028D6DFC5B96B9444A090EAC6563906FA34E26E7EFFDE3AC720D45D06D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235405, "uuid": "d227fa9b-6fe6-4b03-b043-dc2b1c2a9d57", "value": "3072:lm6LqlbDj8yCbizoS3AKKDgdIM0RI8LxZs54EF/:lmSmbDj8yCbizoS3AKKDgd3YLxZs5pF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235405, "uuid": "c5c25855-10fd-4dfb-9018-ade5d72ed1f0", "value": 113220, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235405, "uuid": "6ca61ba6-7750-4748-9128-fd9e77f2b65a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235405, "uuid": "1e57ee22-ae3c-4241-92b0-e2737fa52b54", "value": "d67e390da06eee0fbeec323895f8e757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22cad72b-e00f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710206610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206610, "uuid": "004b477c-d97b-461a-b647-d4b1db040c2d", "comment": "Malware payload (Formbook)", "value": "80cd28809e5c43841d168741d554fa7a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206610, "uuid": "d3af2a1b-d612-4f21-b667-6f6f5874d8fe", "comment": "Malware payload (Formbook)", "value": "f66eb52da2a7318feafecebdef7ffa9deeb07cf2f7f46cbb6319ac06bf714ef6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206610, "uuid": "cfa880b8-8474-4f7d-91ae-ca4f37237309", "comment": "Malware payload (Formbook)", "value": "2f473ec521c912e4f9d23cefb24dd70f4e03bc61", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710206610, "uuid": "eb52cfbc-552c-422d-bab3-9b824dd5a409", "comment": "Malware payload (Formbook)", "value": "3d675263e0a0a3085af85098746b2410e415b5345f3dcb13721151b82c867e220828409300e1594836f140d1144bfd84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206610, "uuid": "9cc96bef-6ad7-48b8-97fb-29f0bc91aead", "value": "T166B523066741C6A7C45D4376B0929A0DD7F0CC16B68EF36D2E99B2FCAD2336358017AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206610, "uuid": "6c8fbbe0-4fe9-4eb8-b68b-84089fd7772b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206610, "uuid": "beb3c911-e766-446a-89d0-af7f55220647", "value": "49152:G3zZTYzhfN+h29eJdu2Cjt8ysZMiKEeFJa8zQO5FJ8VBi3UY26PSveaTp:8zlqT8dTCZjs5KHa8zQs3oJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710206610, "uuid": "187a459e-6a19-4a4c-bd6c-fe34700eb2cc", "value": 2458408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710206610, "uuid": "11bc4b4f-1132-4c3d-80c5-c1ea7bf87d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710206610, "uuid": "399aa33b-0b97-45d7-8759-4d42086bfeba", "value": "80cd28809e5c43841d168741d554fa7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3f0a4d-e044-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710229556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229556, "uuid": "b4af0b1a-e194-4f24-8e38-1d332e7efb59", "comment": "Malware payload (Gafgyt)", "value": "7acfb0ff4afa7f547586cf5e94c9f361", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229556, "uuid": "619b9278-4bbf-43aa-be07-a02f98d7a153", "comment": "Malware payload (Gafgyt)", "value": "f6c573856a3cb61ce4a4f16ece34e5ca98c68c2cda7e0620f3e656aa1e66d52b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229556, "uuid": "c96d3d87-1c02-4416-978b-1a4712a93474", "comment": "Malware payload (Gafgyt)", "value": "b95c1fb4620c2d5c794d568d80cadfe78d13458a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710229556, "uuid": "bba3a181-eaf9-4ccb-853c-c6132b7ac723", "comment": "Malware payload (Gafgyt)", "value": "cfa28b1a27b26df67b5737c528e765910408bdf0d26ccfa31b9bbba1d3175b47439a16ed888e73a93b564f81047f6a2c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229556, "uuid": "a366ceba-009c-414b-945b-7638df30e9db", "value": "T16AE3F801E9504B6BD7D3ABBEF74562CE77719D982F833306C71A79B027D06A96E39200", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229556, "uuid": "252497a4-a8a4-4a11-ad74-14e793cdaecf", "value": "3072:ZfbNzGtcG7jLq+rO6I3dG3ci0QWBapW0yizOnwsK38vJJvOT+Ru53VLwXA+QXfE8:ZfbNhnwsWs5OiRuf0XA+QXfEPQA5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710229556, "uuid": "76ee0d29-7e59-4ffb-929c-78f2dcc3b54e", "value": 149171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710229556, "uuid": "d663f917-c36f-448c-88ea-4e655152e20f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710229556, "uuid": "5c83c683-76ff-44aa-bdb1-b72493cdee7b", "value": "7acfb0ff4afa7f547586cf5e94c9f361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2029a74b-e080-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710255139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255139, "uuid": "9a731662-decb-440b-8894-18be5da54b95", "comment": "Malware payload (Mirai)", "value": "864c874ebefd27bf2ab94c907e35a024", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255139, "uuid": "1d88c251-e66d-4875-8c5e-9d875ce21b60", "comment": "Malware payload (Mirai)", "value": "f76d42a6efc130712ea299bc7cd564f4168599a020d38a571195331e30b131ec", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255139, "uuid": "c4c009b0-d584-47de-8f0e-8bbbb5733c2e", "comment": "Malware payload (Mirai)", "value": "5cbd69f54eaec8f819680b922c8b17b92cccfb4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710255139, "uuid": "fd39a7ba-e9e9-410d-b2c9-aafe646e1e80", "comment": "Malware payload (Mirai)", "value": "73aae701fded638ef3eae176c9be0a3a6c90ac91d5b6c96515bcfc646323bc1196f3e92e7cfb652b8b82ecf41807e1f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710255139, "uuid": "24a1d1f0-98b7-4ec5-8d5f-e678adf01cbc", "value": "T143631981FA87C0F5D85B09304067F33FCB32E5294171DA6EEF69EF26DA63541A216398", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710255139, "uuid": "fe25db02-0e76-4afe-ac12-3f415b9c466f", "value": "1536:xeXkIsC2IGc8k1KD1GtEpvDqOBHWlsQ1NbHLZq/5v8Rkvq:xeXvsC9GyKD1GtEpvDqOU28NbHFeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710255139, "uuid": "147e03d0-5230-43ec-acd6-28f036d62208", "value": 67060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710255139, "uuid": "68713ab7-ca08-4ba7-bda5-c09782b84232", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710255139, "uuid": "dd9f1919-5e7b-4ee8-a5d6-b0280c94197c", "value": "864c874ebefd27bf2ab94c907e35a024", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39de0972-e0bb-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1710280522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710280522, "uuid": "13ea27b9-e5c8-4ace-8211-6afcacddc4b8", "comment": "Malware payload (DCRat)", "value": "737e84b68fafbb74da23bede00f82cbf", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710280522, "uuid": "0543803b-4e6f-4b64-893d-13bb5f9716d7", "comment": "Malware payload (DCRat)", "value": "f87b7a079ed5e63dff1514df17aa9f7e18ba9851fa42eff71107e17aadaa7c9e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710280522, "uuid": "34f54703-1d41-42e0-b856-6f1376de9986", "comment": "Malware payload (DCRat)", "value": "b400569536091414e8e6b6c145e25fe451d5547a", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710280522, "uuid": "9e2b81ad-412c-4319-b13e-365a3d224081", "comment": "Malware payload (DCRat)", "value": "e41b6394b169fdb3f12854df0fca12a9b70e58907965a5a0ce3e41b26de52cae606cde1020204e48a915ef23645dfe93", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710280522, "uuid": "e7bd6157-22e7-4263-9e0d-5dc4071f10a8", "value": "T1D6363367B773D4BBC9820938CA6A4D4588655C385B08F0D3B7263E2D7E363D26636387", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710280522, "uuid": "5fbdfbe1-4f2b-4736-a1a5-dbe9f529e75d", "value": "f6baa5eaa8231d4fe8e922a2e6d240ea", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710280522, "uuid": "e59b16c3-4a5c-4b78-8089-0b3f15e9047d", "value": "98304:mV5u+6dtg8JSemblgZ9E6676C8hVnlr9E6M/rgKLoFeJEirKxJNvPI:mV8+itgI0K5mkzZ5MD0oJEvJJI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710280522, "uuid": "25fbd905-cbd5-42f5-bbe1-cdad63ec1f60", "value": 4869296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710280522, "uuid": "1f91bede-9fdc-471b-b7b2-f63b47fb7af3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710280522, "uuid": "d887f68d-aa3e-4eb8-8586-a065e8562b4a", "value": "737E84B68FAFBB74DA23BEDE00F82CBF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66581d39-e065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710243660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243660, "uuid": "119755c3-bacb-4c57-a7f8-81944614f1dc", "comment": "Malware payload (GuLoader)", "value": "541c72f0c51744c0d5fdcc62ca1ee441", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243660, "uuid": "fca67d2e-f987-43aa-9c5f-49d27e0541b2", "comment": "Malware payload (GuLoader)", "value": "f89d24a55f855db76b9fda5813722f5ee2900ed6fe5a550bb96ae1aa34f71225", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243660, "uuid": "de5046dc-6ceb-4707-96f4-44ac459c152b", "comment": "Malware payload (GuLoader)", "value": "3296d693b90acf7854f1f41557db92a00a3f72fe", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243660, "uuid": "c162fc76-8a1b-4917-9b1f-d1fb96285839", "comment": "Malware payload (GuLoader)", "value": "9fea18e4ebdb24f4e2b84a1f10ec57ffc861a8a0eeaacf4c1d0faa99dd6ce6c546a7a9e7770806512d6ddc0c02a1c0dd", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243660, "uuid": "5a8de3b0-24ea-4ea9-bd2c-340a1f03912c", "value": "T12F759DE5D9C04084ED692F7864761D39502FBE7EBDB8E94E9A0DB0213B736CB6432907", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243660, "uuid": "5e6112c5-5de5-4db2-80ea-78b5d48ba0e3", "value": "24576:naU/LcNbKqeBSgS9dAEZ9AA76ZIe1wQiJh:aoLc5KqeC9A1iJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243660, "uuid": "ccf0fb1f-b347-4e1d-b546-6e40181f0564", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243660, "uuid": "2c618e95-41ee-4c56-b7cb-7621de8eba96", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243660, "uuid": "db97b5ce-02f5-4184-af57-d66baf7331c9", "value": "UPS Delivery.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad4e3b25-e030-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1710221016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221016, "uuid": "ae015793-6221-4ece-b618-3e8677015fd5", "comment": "Malware payload (Stealc)", "value": "6f329d63437d6ab286852568c3a14b26", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221016, "uuid": "b9a0b18f-ecec-4007-8555-b9803c989f2c", "comment": "Malware payload (Stealc)", "value": "f8b327bbf9e446f5a3fd3257527a35c167785419dfbee5bf7e77ddfab56fb9d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221016, "uuid": "807e0f61-c455-4043-86cf-400e2c067290", "comment": "Malware payload (Stealc)", "value": "0d2dce255fae521eacbaa9acf2ffbc7b8b6d04a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710221016, "uuid": "a0738bcc-898f-4b5a-b3e0-e04386eef4e2", "comment": "Malware payload (Stealc)", "value": "b90d3fec9aabf4b8aa61521bc888bf052aa2be69923a7a468619a092245d140cac43f7a8061c698d13cfa97986e51c97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221016, "uuid": "7604b54f-a9bf-4c25-b062-ec925102f74f", "value": "T11BA52324F252C4E9E5464032AC46D3FF0DE56E30ED546923FFC42E27BE709EA4A9A741", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221016, "uuid": "dd509599-b10e-4a58-9823-037d05080bbc", "value": "187b3ae62ff818788b8c779ef7bc3d1c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221016, "uuid": "f6b5419e-a53c-469a-a129-1e890fbfd63b", "value": "49152:L+HOMskuADCe/MHPac5y8yLJbeAVlvnOz9m/BG8uNH:quMskuECe4P7uNlvOZmJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710221016, "uuid": "ffef5f10-023b-4171-a91d-07957fc9bfd7", "value": 2160699, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710221016, "uuid": "565c669c-81eb-487a-8a74-5ae3ef7d6427", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710221016, "uuid": "04904ccd-0de8-422d-8a2a-799ff9aeadb6", "value": "6f329d63437d6ab286852568c3a14b26", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1247d98d-e040-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RevengeRAT)", "timestamp": 1710227628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227628, "uuid": "6f9cf00d-1326-44d2-9700-159d1018efa3", "comment": "Malware payload (RevengeRAT)", "value": "61d206a7e9df935a0cad8de669e85241", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227628, "uuid": "f72eadd6-5a83-4e92-b2e7-980c6e4d9af9", "comment": "Malware payload (RevengeRAT)", "value": "f8d9858e2029276c48e1e7aefc168269ba73450bfba41d49d47aa61092dd0cf9", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227628, "uuid": "6a346484-1819-4ffa-80bc-2d2ccee18878", "comment": "Malware payload (RevengeRAT)", "value": "fa687a793c6e5756d26e1d6082767c86efcb6198", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710227628, "uuid": "284c8173-eb9f-444d-b6cb-1c0cc7e3dc7b", "comment": "Malware payload (RevengeRAT)", "value": "73212d37d759adb646e13add59d7a057576a48f04bc8ffa0f9ced425b5df372b82416ac9f381c7d912e3944c1be00e06", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227628, "uuid": "8cdbe593-9819-47f9-834a-38285c436d48", "value": "T1AC62BF55C4F3504EEB2298FA75CE6C737D1291A8894BF68F3110E278264259A1347BFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227628, "uuid": "da2c3d9d-9922-4658-b162-c71e8a4149ed", "value": "192:xrXP//fWt8oxFx+Wex7wTQxM7IVHdimITS09k80JFbSvmSvjXma9kofRuGEy4TZw:dXPvW6S+WexTM74d+XSDSOoTdfw3y0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710227628, "uuid": "30a7998b-6486-4b50-a1a0-2f04c7559d60", "value": 15528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710227628, "uuid": "56585450-77eb-4bc0-8385-4e68f9c3e5c4", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710227628, "uuid": "0f9420f4-be19-419a-b661-f56e3a65ef34", "value": "Localizador RES001421-13919 1.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b276e05-e095-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1710264150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264150, "uuid": "2cd6fa0c-f619-4810-977c-d9de97fc952e", "comment": "Malware payload", "value": "426155ff2d5a20f7164da55ff23cc94b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264150, "uuid": "45e14e7d-c67e-44cb-a626-17605c56a9b4", "comment": "Malware payload", "value": "f998aeb84da8b84723ca9fdbdeb565dbc7938bd0a0ce5f0981307b3e24bdf712", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264150, "uuid": "c9bf24a8-e3a8-4b18-88ae-761ee9538629", "comment": "Malware payload", "value": "71f5f60479f21702145008bb98c108a69ba8f34c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710264150, "uuid": "152bf316-8537-4cd4-97d8-51c0dfc006aa", "comment": "Malware payload", "value": "3089af7f1113e5cace7fbbf33108b86cfd85a1e0989fcca0fa5941f8a6daa8ecf214d520473b02058de6ab57a4995e1b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710264150, "uuid": "fc8c03a2-9581-4101-83c7-b6cd2a7671b6", "value": "T10F1633EB61A16CDD861B2EF9ED57C56A8127F7105D0E3C02C09805F26BA0FECD79816B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710264150, "uuid": "6ce0785c-c6f5-4871-8dbe-f45fd6a6a90a", "value": "98304:7CuSt95TW1PvY22pKm2lGEhL4uQEMAlj664cLa1:7CuSt954A2WhcfRQrUUv1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710264150, "uuid": "0415e0d2-cb0c-4c1c-bb71-20cfbee75a0d", "value": 4075768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710264150, "uuid": "8d51335a-18db-43fd-af33-07133c13110b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710264150, "uuid": "aa09b4c2-4185-436b-b18c-bb73920dd6a3", "value": "bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "621749da-e065-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1710243653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243653, "uuid": "d0cb7ef0-0cf9-4c52-ae16-c3d3ed3acfd7", "comment": "Malware payload (GuLoader)", "value": "bb689caaca966e03d0dd6e376b2e4911", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243653, "uuid": "8ae3b9f4-4b5e-477d-a337-3bf79143a462", "comment": "Malware payload (GuLoader)", "value": "fa25c42ef060630d84ef4cdc0e243696347dce142364724290bdc050567e5cc1", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243653, "uuid": "99b1d623-b425-4ed2-b2f9-40b594112e11", "comment": "Malware payload (GuLoader)", "value": "795de1e1939b1bf3378b17d8a4cf9bc9a0948035", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710243653, "uuid": "ae2195f3-b018-4575-bb98-2cab40abcb3f", "comment": "Malware payload (GuLoader)", "value": "b597693d9530081a4d93744b593009feb65da2d1afda3b2b04b7ff0a417d3b944e7172f6999d443cd243c4591a3a1f3b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243653, "uuid": "2884d61f-6ad6-4a5a-aec9-9b9d95a38532", "value": "T11A759CE5D9C04184ED292F7854761D39502FBE7EBDB8E94E9A1DB0203BB36CB6472807", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243653, "uuid": "8d258ea9-e905-4613-a049-ac9332598548", "value": "24576:laU/LcNbKqeBSHRbrBL8GGAqf6ZIe1wQiJh:YoLc5KqeiLL8xAqeiJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710243653, "uuid": "a43043cd-c968-460c-904e-f69e453cf77d", "value": 1703936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710243653, "uuid": "78d3ce2d-249f-4ae9-858c-8dce57461c51", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710243653, "uuid": "b1fa0b8b-b909-4f9a-b701-2e88ef625fbc", "value": "Admin_review.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bc4f26-e0b2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1710276616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710276616, "uuid": "44f92b88-9a64-4975-b326-551efe892f82", "comment": "Malware payload (DCRat)", "value": "541a9d3031657ebc794dc43a70511384", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710276616, "uuid": "72974e72-8390-4d21-b710-301c2ca86134", "comment": "Malware payload (DCRat)", "value": "fb40acdca9c484f7d43b5e2c7ac8e2fcb129fd90fc5d1f549f84f3d283e43533", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710276616, "uuid": "600686d0-9a79-4823-aaa0-d42dedf46b58", "comment": "Malware payload (DCRat)", "value": "1c18826b93532c58a2a20ac1061e4309e7441867", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710276616, "uuid": "7ff94039-16a0-4cee-af8f-c0300ec9a002", "comment": "Malware payload (DCRat)", "value": "59201ebb63cef648a6b6bc3666da2d31e8939e12bda7311d7f2f9cf573cfd5556a18d48cbab74578f16807ab054f639d", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710276616, "uuid": "65e58888-2890-46e1-a92f-7d34ca8f6183", "value": "T16795AD0A55925E37C2745B714497003D92A0C77B39A2EB0B3A1F74E2A803BB5DF725BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710276616, "uuid": "3d1c9b94-50d0-4e1f-ae59-208303935e3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710276616, "uuid": "8a452ba9-6d76-4fd7-b3b2-98c866c2c464", "value": "24576:s7USn+9Co5+54pIbtNSPouMVMOU93aBOR/UCtN0FSrSOdJw1EgfqBhR5OMqj6oxq:8qIZuMCso1U6Tda1lAeMsynjCM5x6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710276616, "uuid": "6967cb08-b30d-4d27-9549-9277e9292250", "value": 1961984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710276616, "uuid": "0034d503-b6b1-4138-8228-abb6931b2c6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710276616, "uuid": "f7be67c1-7037-45ad-bcbf-d733ac739806", "value": "541A9D3031657EBC794DC43A70511384.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87fb0c91-e028-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1710217517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710217517, "uuid": "fa7d976c-54c3-47e4-844e-2eafeb824740", "comment": "Malware payload (Formbook)", "value": "b721018d25d93adaa9196639a8e1b7bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710217517, "uuid": "e2cc01c0-144e-40ad-a7c9-de5ace1a37dc", "comment": "Malware payload (Formbook)", "value": "fb7cddcabe7defcc11937a7c8d0672a6f65c3135574e1c71a0e772e9d1f19311", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710217517, "uuid": "422588dc-3332-49d6-b2a8-ad7bc115a018", "comment": "Malware payload (Formbook)", "value": "3962e269cf81eb0653e6195545e4be2992b03991", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710217517, "uuid": "2a8240ec-e63b-4b4a-9a4f-dbdcbc518467", "comment": "Malware payload (Formbook)", "value": "51f8f003e523e4f0dc63288f3affaae5c932a3432778d84f3db1c888d2778027c7737970aa8c540bd022bbba6df5d8c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710217517, "uuid": "231990dc-019e-47f7-aa90-964fa7767ff0", "value": "T122F40284353C1E23D2B9F5F84460202847F6661E24A6FBED0ED375DB5AF9F840AA0E57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710217517, "uuid": "ac1f9727-3504-4ee5-a238-9f66d92f4991", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710217517, "uuid": "aa2325d1-3096-4e30-b1dd-23f276ddcb02", "value": "12288:MobsJTENl3l7z1VYXbFYACkwY9Y5nhs3A6thjmIPHQdLa3fyA17yT+OsqpMDLLR:xYxENlR1V6EYiown2HdfyA1OT+OFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710217517, "uuid": "f3b81c5b-3101-4971-8d9e-b5a00532513c", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710217517, "uuid": "c5e4401d-eda6-4b14-a3b0-7451e0f3ca99", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710217517, "uuid": "146b6b11-c263-4899-874e-169d1829a781", "value": "SecuriteInfo.com.MSIL.Remcos.GWMJE.tr.5284.11742", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02693989-e04c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Mirai)", "timestamp": 1710232755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232755, "uuid": "82e63604-ef3e-48dc-8f39-dd05400942b4", "comment": "Malware payload (Mirai)", "value": "c0377e2dac81181351c792e9038beff7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232755, "uuid": "397c98fc-135b-4de6-aede-21816e55a815", "comment": "Malware payload (Mirai)", "value": "fbdf054e794d0df4232635114e792f2ad6e8c05f82f76e51cfcf21a720aa32c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232755, "uuid": "aff76c64-ce51-4096-8b3e-2e05abe0a120", "comment": "Malware payload (Mirai)", "value": "200a749808fc83adb9b5191abecdc9dbc12bc483", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710232755, "uuid": "4726bfb8-725c-4b5a-a199-f9b7b386460d", "comment": "Malware payload (Mirai)", "value": "90090688e82da9fbccce1ac02d88596fa018265af131b5a8cf592985b58bda45d1bf84654d137a0df120bbfe9474c2d4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232755, "uuid": "1b300903-1c29-45b2-b5bf-5a13e70c4b77", "value": "T1E3435B0273280A47E1565FF4393F27E083FEE99021F4F689260FDA468275F73158AE99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232755, "uuid": "59edfa37-7a55-4e04-8507-08d6cbbaef50", "value": "768:EsfizT3u6bC62F13cw0yNRn8py3ubepKrxjqL5eYCuoAAa/w3jv3XUtZAIs4sdJn:E0u37bUJcw0qZ3+tOeYTdbo3jMjsjJ1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710232755, "uuid": "682c09c8-5172-43d1-8679-932f1734a73d", "value": 58284, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710232755, "uuid": "2f2dc88b-b5c4-481f-9ffa-df875de20d55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710232755, "uuid": "82ebb6e4-5a56-45c8-b217-7f377c9274ca", "value": "c0377e2dac81181351c792e9038beff7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5b1ee72-e052-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Gafgyt)", "timestamp": 1710235740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235740, "uuid": "ab14a9d5-40c0-4d18-b32c-13e88de575ee", "comment": "Malware payload (Gafgyt)", "value": "63c17b2fae111f6d7d52357e402d376b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235740, "uuid": "991c14eb-357a-4623-82f4-01fbf183677d", "comment": "Malware payload (Gafgyt)", "value": "fcfff9188f59eeedcb7fc4271ba812a96df40234a4a85573995529d71c56ef13", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235740, "uuid": "f03cf826-a13a-4fa5-aebb-0b2da95521bf", "comment": "Malware payload (Gafgyt)", "value": "961c347a81363bcb2ab98c0cb67795fd0882ca37", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710235740, "uuid": "d3a46bae-486f-4050-88fb-deda1ae66af6", "comment": "Malware payload (Gafgyt)", "value": "dde550540b19f82e40459535155ef12a30ce355a838dd100a6814609776db0a7849aef0b2c1a806f886e8a83ab4a28e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235740, "uuid": "f6ba582c-98be-44f2-8283-520244ca9d80", "value": "T1DEE3F94FE17AC2F1D2470FB32257BCBB03F16126546B1E49F736ED61C9D3A9062A1298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235740, "uuid": "c4656fca-62e5-42d1-9f9b-1a0509898ead", "value": "3072:bDLYBNKtyZrVvnNYd+soZS9BFCOlt5MofR1c9OXH90PfNatph1:bvYBw+qwS9BFhlEo51ckXH90PfNatph1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710235740, "uuid": "4a804c63-a4d2-455a-8d15-a4ee9629d69f", "value": 157137, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710235740, "uuid": "b83121f3-dae0-4fff-812d-a88d5da863b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710235740, "uuid": "906d0211-718d-4afc-baf6-76b6fc33933c", "value": "63c17b2fae111f6d7d52357e402d376b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31f5e21-e075-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1710250661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250661, "uuid": "d51687bf-c874-4234-862d-b285cf1cde79", "comment": "Malware payload (AgentTesla)", "value": "93c5cde89baa52e239e680a5c47c14f1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250661, "uuid": "adb29a48-5888-4104-a27a-aa7b880faacf", "comment": "Malware payload (AgentTesla)", "value": "ff2f0f91ad490a40471063e0d41f955d29b24b9387b473e4248cced15faa4730", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250661, "uuid": "0e5e703b-7458-4e33-86bb-307dc80e6c75", "comment": "Malware payload (AgentTesla)", "value": "365cb3541bc98f0ae6fcc948120322a3ca878f22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1710250661, "uuid": "6ab996b4-daf9-467d-906e-c3734eabcc11", "comment": "Malware payload (AgentTesla)", "value": "e6cea23e40c911d38aa2ff356cd64ba888ffa3b92de33deabd33bdb505d0bf8f490c2f766b4a365899c166b6ef35faad", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250661, "uuid": "afb1d17d-b7ba-49bc-b961-44a369856755", "value": "T1FDE42380BBDCA7D9E7B97379C815213083BE715A71B4E76A8D50B6CB6A41708C510BF3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250661, "uuid": "56959c81-0449-44a7-af94-8ec291a69d3d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250661, "uuid": "524f220a-ab4b-477c-a9d2-1068f9c08537", "value": "12288:tsJTENl3SGWSMlchuDJCwjWanpowS7IwGny2CgId/YtoG/w:uxENlCLSzhuDJ3jHS7IwGdCgIdgB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1710250661, "uuid": "400ff6e8-2af5-4659-8e17-8f39f944aa1c", "value": 657920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1710250661, "uuid": "c7428cee-5b29-4be3-868d-ad6984694480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1710250661, "uuid": "3df257d2-69d6-4a35-8f51-e42ac076cd2f", "value": "Bile\u015fik Platform Yedek Parca YENI SIPARI\u015e RFQ 120120310.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }