{ "Event": { "published": true, "date": "2023-10-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-10-03", "timestamp": 1696377781, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "187bfec2-7fec-447f-87d0-78b11d0600f2", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0552d4e-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696356974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356974, "uuid": "91b95880-67fb-427b-8364-9e63711c5899", "comment": "Malware payload (AgentTesla)", "value": "a864cb603de60366655fff2a21f04c2c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356974, "uuid": "d827d83f-d82e-4b60-a56d-3812f88fe364", "comment": "Malware payload (AgentTesla)", "value": "007cfdd9d19a225b749811f15daee02016824bfd2fbb63934ff4df18ed59eeff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356974, "uuid": "da73fa8b-e369-4e37-8529-0d3235a7d0e1", "comment": "Malware payload (AgentTesla)", "value": "84f36ff00661a76c7d6eb67bec5506761dafcfbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356974, "uuid": "580b1322-b3e6-491b-91aa-994c663c003e", "comment": "Malware payload (AgentTesla)", "value": "3f9d8a8dbb85897f4e9f2b60af7b72abb9bc287d911f06f2f9d323f1732d4e4d1d6dddd43c6af014e360e2e4f33fe3e3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356974, "uuid": "e39fbf20-99e9-4227-a40a-895436e2003f", "value": "T19A353903BA478AB2E2881733D6ABDC04C361DD83FB2BD61B794E336619533A69D45D07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356974, "uuid": "1c8d03fa-5fab-4fa1-bf07-57ce512c405c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356974, "uuid": "6574aa34-5d7e-4308-8fe2-ff833dc866c1", "value": "12288:rbff8FLawuy5KQ7J0LPZwIEW6flxndJiuUnrHgkTUR/a4OPeN63yNkNBbiVgXdmE:rbnkucR0nEWcpdHUp9PeJmgSd67m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356974, "uuid": "40053e4f-e20f-40b4-ab7e-cddfcce4560b", "value": 1101824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356974, "uuid": "1d905f32-8973-4397-982e-5713759c5f32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356974, "uuid": "697ab75a-74fd-4acb-b542-42894cc50b93", "value": "DHL_AWB#175955_ TELEX - FACTURA CONOCIMIENTO DE EMBARQUE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ece58ef5-6204-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696348378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348378, "uuid": "5de8bd08-16f2-4f49-bf50-8056fba8d540", "comment": "Malware payload (Gozi)", "value": "605cc947173965ea0dd26ae942628fdd", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348378, "uuid": "52ffdb56-aad2-4b35-9586-84dc95b253ca", "comment": "Malware payload (Gozi)", "value": "00c2ef515f054de3de9a5925e8c3fc958bfa309cbc7f2cda557ed73d2b16be45", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348378, "uuid": "62110509-c9ed-43c4-a416-394a8cbe7b0c", "comment": "Malware payload (Gozi)", "value": "d40ef97f3f4985305339658c096d727c26e899a6", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348378, "uuid": "f4cff356-da21-4f73-bebe-cb5249b9fdc9", "comment": "Malware payload (Gozi)", "value": "1c036ecf3119bf7acaf5b92be64959dbf7c8692af4bb0a7b3bb126194a0c5098d23fddb310f78a8abec02e71a8bc0cb1", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348378, "uuid": "e7197978-8f5b-4c8d-855c-8060d249955f", "value": "T16AE07D19D5564D05CD6F5EB8428E7B300170B20BCCF4650718C2B82E7C96BCA6F113DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348378, "uuid": "7fa6895e-b7cf-48fa-863d-70af90ed806b", "value": "6:5jLuIB3NqFkcBGcvdjXy/yge07yHcTl6s1cwySGp4IB3ZMqHQCu+lF:5jbzqFkcEOjrgeCucYCO4IXwaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696348378, "uuid": "0e7e4eb9-1587-4366-ae23-5bc9f4637b72", "value": 337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696348378, "uuid": "5cdace72-72bc-4c01-a887-b8ed05bca35e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348378, "uuid": "27ab29eb-dffa-4426-abd0-f091b982b534", "value": "Normativa957.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a56a28a-619e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696304297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304297, "uuid": "aae55a9c-8523-4ffc-90f6-a517b9af810e", "comment": "Malware payload", "value": "6b44d25fa0c4444576a8a097b0c6a9b9", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304297, "uuid": "2474d324-70d2-48a9-95a0-32ba3fecfb22", "comment": "Malware payload", "value": "015aaa9c91d888a233b64e9a593929175a70055c8a4295d8a1d0d35aa4e94019", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304297, "uuid": "04e82d12-185e-4006-b4cd-65b0a419d90e", "comment": "Malware payload", "value": "b45e9f47c3065d005da3404366050313b99cf775", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304297, "uuid": "c0ede043-27d4-4b33-bf99-79e3af35d753", "comment": "Malware payload", "value": "0dc9ee75b992b459a25de99802776ebfb8849d87bd8a0ba35d1e3551bd6260166b9700a73eb8b7f4b0c7a084411ef8fe", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696304297, "uuid": "151db4b7-05fa-4b11-86f8-c888d2adccfd", "value": "T11DE028B00B055BD2C006CCFC64C35721A310BA6C49133137D04C60535DC438C494D4DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696304297, "uuid": "21804b11-3f10-4d09-bda8-c1563be762f6", "value": "6:5jjUwlt9r9k6sHLQU4ekKhIkA1YaSQKDTWWIuCBMviSqUwltBr9kZRAkC1qHu+lG:5jjJNr+hH/TkoIzNpAWvuCBM8JRr+ZRI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696304297, "uuid": "bcba6012-b0cd-45fd-b0dc-9e574101518c", "value": 348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696304297, "uuid": "f70d737a-7792-4a67-9a56-4547e723639a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696304297, "uuid": "59012d79-581f-4c8e-b688-090b6e4a22d0", "value": "AgenziaEntrate817.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3239a5d-61f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342698, "uuid": "b275057b-8312-4964-bbc6-e8660692d275", "comment": "Malware payload", "value": "5a78cfbc33a83bb06d6e31e5b3456e52", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-678", "colour": "#C60C37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342698, "uuid": "be0ac033-5c18-44ac-917a-ddc25be4d8be", "comment": "Malware payload", "value": "02e2f8dd9d940865098ca5baf4705d542572180177a67c33ad658133f63fb0f8", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-678", "colour": "#C60C37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342698, "uuid": "daf01a2f-8f40-472e-a96d-3388f9496124", "comment": "Malware payload", "value": "bf267f4700d133d205d049872ca0d833116c5ac7", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-678", "colour": "#C60C37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342698, "uuid": "5b06313b-1529-4ae8-b970-0890d7c23d07", "comment": "Malware payload", "value": "1fca8df52287a31640b6a6b92c5b8cf82288573beae23165deee1f4b69d6eff3be4a009fd6e642c8e0625b931294159d", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "pw-678", "colour": "#C60C37", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342698, "uuid": "8ef6adaf-9967-4578-ab8d-40200f185081", "value": "T1CB31E689C1196780C646CFB3989E23CCA5C064C7F981B575F53A52242C13EDB2F0F34A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342698, "uuid": "aa34f311-50e6-40a2-8d4c-f6b5172f174d", "value": "24:9h1NJihF2efwWiX5ouOAEhtEvX4UpB5evzyRnooeRlsR4/F1Xh1Cg:9BHeqfCyX4UpuRla6JKg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342698, "uuid": "6031d459-4f66-4d8a-9270-b19dba299c0a", "value": 1498, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342698, "uuid": "f7ca1ee2-428b-49e6-b308-2c897a58c4ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342698, "uuid": "9081e499-88a0-49e7-863b-64e040d4950b", "value": "YU.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a0f7e6-61dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696330970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330970, "uuid": "ae442842-b314-4416-b25f-37ebd34563db", "comment": "Malware payload (Mirai)", "value": "4cbc8acfdcddf7ca309e1399cb8497c5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330970, "uuid": "48690818-f670-4b61-9386-87a20f17bb9d", "comment": "Malware payload (Mirai)", "value": "02fd3bd36fdab2445b8b8f37f47892b7f0600141fdf4a769f57d79a1bb700100", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330970, "uuid": "5be56a6d-2406-47ab-a380-cd287b962436", "comment": "Malware payload (Mirai)", "value": "b7ee49f2778b8fa8f27e3b98d2e58b9b06c9df1e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330970, "uuid": "6d6a2293-48f2-427b-af2c-05fa8ec1d881", "comment": "Malware payload (Mirai)", "value": "65578e918d818f589ec3f2d2d17985859e0db388d0e76cdeb730a89996dc79086fe1a99235ca57b3d0bf601fba38c3b7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330970, "uuid": "c4956f9d-8817-4902-bf38-1d90e27c3de9", "value": "T186935D27B552C6BBC18752B42BCBE9615833F4BD0B32720B33D47DA52B259C92E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330970, "uuid": "dd37a6b4-ea93-48c6-aca2-b68710976245", "value": "1536:W7uJtxMVEOVbazlvhE1hmkJ0S36W6bWjK33EtukmA+KWOXFseaZYxe:4SMVEOVMlpmXJ0O6WpjKHEvm/KWOXF7Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696330970, "uuid": "50e1a96b-9822-424a-bcff-e3df69d538ba", "value": 94672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696330970, "uuid": "8815af1f-d81b-4d1d-acb5-d5fbdaa541c6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330970, "uuid": "5ac01847-fe9e-4c5e-87b7-6bcd30a00d02", "value": "x-8.6-.Shenron", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82b87b70-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696340899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340899, "uuid": "1efd5855-96d4-4a87-ac06-a83591d87905", "comment": "Malware payload (GuLoader)", "value": "1564e0d55798a05392c21c4e32af6c8b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340899, "uuid": "6db2a76a-9e93-452b-ba78-3da5f92f7f4b", "comment": "Malware payload (GuLoader)", "value": "030ca745bb45c5cba7e0dc933c2f36aa7c27a3716929027e1b9aa64c6ed60f81", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340899, "uuid": "46066fdc-5553-4a38-b8dc-2ff7444b9299", "comment": "Malware payload (GuLoader)", "value": "538205c2ac6d66f796a25571548c31086c2e231a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340899, "uuid": "8e397855-539c-44a6-adcb-9982dca7cb26", "comment": "Malware payload (GuLoader)", "value": "76bd6815b432160513f3a9e3eda2a1debe953368c098f6aa1fbc84a23cfb4c82e980138795e68ca173a87762a09f6811", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340899, "uuid": "c9dca87a-1138-4db0-82b1-018fc9316bdd", "value": "T12D05239071E0C5A7DB7B527880E7931EDFF9EE212197A34787017E5CAC37AC28316698", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340899, "uuid": "c6a744c0-8ef8-4392-92c3-b6b4cb8ac2d2", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340899, "uuid": "ac4aed34-6630-4d3b-aaac-e8241e387f51", "value": "24576:INPx3Tpgh9NZEak0F5SAz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTMTq2MAz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340899, "uuid": "887da5f5-a2cb-444e-ae0d-5917d5420032", "value": 856230, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340899, "uuid": "f66ee4c6-ea3f-4fd7-a79b-cf4844e92862", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340899, "uuid": "294df128-c593-4d9c-a853-0df9a8c4ce62", "value": "Thetempest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4656c69d-61f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342086, "uuid": "2a7cbff9-6d6e-4f9f-bc4f-a33e7ec15d9d", "comment": "Malware payload", "value": "f18e3f9a8ce7a889103894df47eb5f6f", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342086, "uuid": "fd7e9e94-9f73-4051-85b9-6fd78d91a999", "comment": "Malware payload", "value": "03119b57491229d85b2d0aa3a72f96b1b37f2ee8da203b0cc28d9ffc93f06431", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342086, "uuid": "171cac2d-6a56-46e3-9b7d-c0e735660668", "comment": "Malware payload", "value": "0aae261dea2874e2d269ea5261f05a007aecb7ab", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342086, "uuid": "0cc48dee-697e-43f0-9fce-eccc243abcf3", "comment": "Malware payload", "value": "c661b44cdd15203c6b68ba2ed57d7567325fcc7a06121b721d9e98e1cce0a441efb7cb2a02143d0091e53adc1d48b81f", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342086, "uuid": "bcbcb473-2d4c-4164-a113-b0a2a0be0d42", "value": "T1E3B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342086, "uuid": "0427ec6a-d024-4a02-83e8-2e0313c53f9f", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342086, "uuid": "c7e80c80-4ec2-484a-ad69-13934f6cb5aa", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342086, "uuid": "d0a8c2c2-5266-461f-830f-4c6db3ca4b38", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342086, "uuid": "1709a8e0-2fda-4fc9-a406-26471d0d9cdf", "value": "AppleApp(25).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e199d85-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696340891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340891, "uuid": "42891ef1-0dd5-4058-ae42-1c17da0f35e0", "comment": "Malware payload (Formbook)", "value": "af00aaa56da02fd2d138a7b4d3cbebdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340891, "uuid": "7c740088-17aa-403c-a036-6c4d6c148926", "comment": "Malware payload (Formbook)", "value": "0319a48c8448490e40da6237039f578e079c17495c32356e5a03123976af3486", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340891, "uuid": "303c78c3-e41f-49e1-bd54-0d81f66a2d7b", "comment": "Malware payload (Formbook)", "value": "5e1cc474775cdfa9be9d068153d79920bbcf8f9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340891, "uuid": "88fdc786-d94b-4ba4-b327-37d41650117c", "comment": "Malware payload (Formbook)", "value": "0ded0370a4111f59e1ff8addcca3b33b3f217fd07b601201329b36e77f8073dadf3375cc56d157a761c591ea6f76a6d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340891, "uuid": "aee57628-9a63-488c-bb95-e0ebce2ecaa8", "value": "T189456B24B3B10CB1F8B93975C90A97F01DFF77A9A904689992B57D5B2CB23513B2102F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340891, "uuid": "7bbca942-eb69-4a51-92cf-ed726a907ead", "value": "0d3c91eaf5fe15612d88e7ce6d9c9b4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340891, "uuid": "10decb19-9068-4641-8a35-c3ae7b82c2e5", "value": "24576:1RxK0h0gJ+HYS9XsILx0P83H5M8OG3SWYm3:1RN1Hm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340891, "uuid": "0d17be92-ddfc-40bf-8a93-824729f38887", "value": 1199616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340891, "uuid": "fffd842f-8495-41cf-b8f9-37c1827c27d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340891, "uuid": "24332860-2cba-4bba-b0e6-673736bdb5bd", "value": "PO_2654_INDUSTRIESCO., LTD.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef0578ba-61ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696316599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316599, "uuid": "febbf453-85b0-428a-9c10-773a78e5ee66", "comment": "Malware payload (Formbook)", "value": "1875a74ecee4059de5278227a9a36e75", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316599, "uuid": "abf7f33a-c0be-4bf2-a6e6-f5d094a9de36", "comment": "Malware payload (Formbook)", "value": "035339241d84eb0505b506e55aa659e4f4b272e6986c0ca99cca2ce5a4b9f6af", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316599, "uuid": "af2550f5-6eda-4d8e-9078-545fd8ee1b55", "comment": "Malware payload (Formbook)", "value": "cfcc50423f0f4bcf79f1bdcebb22c6565535b648", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316599, "uuid": "2b42337c-5cd6-4752-9c79-6350443e1fd9", "comment": "Malware payload (Formbook)", "value": "d1039c1fc1820525194ba59fb49c624daf1ec8b5d8f10e460a587c5cbfd162d54326433fdf9053ab58d98620793c1681", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316599, "uuid": "c9a7e1f7-422d-4587-88f4-22761e01190c", "value": "T17C8423D52E27BDC2C60DD0DBA7ABBC497762485802588D1A5F0666DEC0A5361FFCECC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316599, "uuid": "85245f56-f986-4f97-aa70-3f7e0a690b83", "value": "6144:CZ3rvK8/RHDdp/y+Xo9b2YbsX3WNPpTwVoMQftgzZMp0Ui0JmZqLNELq/:krvKqHLy+XmdwGNKEglI5jSLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316599, "uuid": "9dff3fa1-04c6-4cb3-b9d1-8f3bcd373be8", "value": 388233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316599, "uuid": "f5a3de58-9ea6-4dca-8461-00d2b7738e0f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316599, "uuid": "fc2f203d-ee6e-44f8-9876-7d76afcbcc16", "value": "SCAN DOCUMENTS.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c140f11-61da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696330204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330204, "uuid": "253e513a-a99a-4c1b-b72b-1d652d157af3", "comment": "Malware payload (Mirai)", "value": "3537aa56e61000f8b3bccb460772b2b5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330204, "uuid": "fe68d555-0132-4d44-89dc-367b6648a2a4", "comment": "Malware payload (Mirai)", "value": "05a3a2309edf051008feb7e1cf6bb8edfb5747bb09116567ff39f0121e980e0d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330204, "uuid": "ab05ee4a-3b8f-402a-b34a-23a6549338bf", "comment": "Malware payload (Mirai)", "value": "92d5f0fcb02b5abcef3d3c3d7ae43baadc0ef690", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330204, "uuid": "f1b2ffcd-7918-472d-968f-2d5e164bf681", "comment": "Malware payload (Mirai)", "value": "0bf38e67db14b46d6223e1e4979c01d263159b1aba26e4422ee66c7c397c3cb945d9730db632f722eccc87ffda57a205", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330204, "uuid": "3bd51476-0165-4e79-b805-3a8fa5f8111e", "value": "T19682E177D2A1C7AEC664533B9F8BF60761852334B3EFD7B19A50C9896F32221019C928", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330204, "uuid": "5bd0c3ed-ad52-4616-8e03-b54b4f411d59", "value": "384:MLQxxlbDwlxdhmyJXJaVJ75B5ksN4dgfELGKa:WkGVzJXI375B5kY4duEyKa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696330204, "uuid": "3a58f1cb-50cc-468e-90dd-cb694a3704b0", "value": 17640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696330204, "uuid": "3c41e7f6-fe76-48ca-823b-9bfab50a1e9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330204, "uuid": "e198c336-d853-43af-8811-36b2dfeac458", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feca6a42-61dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696331658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331658, "uuid": "95d63dcc-1527-449c-98bb-63acf483075d", "comment": "Malware payload (Mirai)", "value": "5fc7003a6855e06c127843a8542eb9e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331658, "uuid": "55c37cca-feed-4cb5-9e6b-16fb8d599e65", "comment": "Malware payload (Mirai)", "value": "05d128f2fb4b90607b8d5ad4874d143c3b4485d85ace0f0aa31b89b653bcbf73", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331658, "uuid": "e80b78fa-e7ac-4da9-8eef-c31c0ea7d823", "comment": "Malware payload (Mirai)", "value": "602a05cb52611333168f95349e9eb8f837f02181", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331658, "uuid": "db33e562-95c8-446b-b06d-a5cb0202cb9a", "comment": "Malware payload (Mirai)", "value": "541a82f4a7f8d66827a0800de944e411720b3b559296547bb9c043bfabbc59de5453d0e795e22f62de832ad20c13ed24", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331658, "uuid": "2c5eef99-5ac3-4d4b-aca2-b916c313e058", "value": "T12CB2E0634EC5A653DD612D3A5EBA8403BA8E5F71881F3196233403CCB09A68B49FAC75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331658, "uuid": "b219484f-3f91-433c-a69e-dcb940d2907d", "value": "384:JHRWZTTiz4+t0UlYlyPVT0Lb+uQwLkO57tNeefL8b7+gX5bqmdGU5EeCZdlkH:zWhTizLBndaBTlAefL8b7+gXZq3UIlkH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331658, "uuid": "1c682d5e-f64b-496e-95e5-0f6699dfb5b7", "value": 23556, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331658, "uuid": "b3b56169-539f-4645-aaed-9ca6271599dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331658, "uuid": "9b53b0df-0c2e-4777-8dde-73cd2c20a340", "value": "5fc7003a6855e06c127843a8542eb9e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2784216-61df-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696332362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332362, "uuid": "edb7f408-4796-4e13-8564-139a071d2549", "comment": "Malware payload", "value": "062f55483de7119a5e79891e62cd4d6f", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "AtomicSteal", "colour": "#7C29A4", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332362, "uuid": "4866f6c4-3d95-41ed-b9bb-1288bbaa4e15", "comment": "Malware payload", "value": "05ee833f167c4afa9e74679c0b64c94d57ba1f1365cb83f96f886d4b9df6018c", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "AtomicSteal", "colour": "#7C29A4", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332362, "uuid": "436e34bd-fcc3-4dcb-8cd9-7d43224c32c4", "comment": "Malware payload", "value": "cb83475c6c1dcf1fb3ef8260c5b34f4dbf405cb3", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "AtomicSteal", "colour": "#7C29A4", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332362, "uuid": "f4ab5cf0-b663-4512-9d3a-68285fd409eb", "comment": "Malware payload", "value": "ac2a5df1d422b67c836a4884420ca29cef7bf1b0bb25af0fb57748d6b67ea265f9782af5ad202afea46c9aaeb13f31da", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "AtomicSteal", "colour": "#7C29A4", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332362, "uuid": "9e9cb94b-0cf0-4481-9514-e06b658c5ee1", "value": "T104B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332362, "uuid": "17f24bbf-78bd-4f1d-80c2-4ccdf0bcf0ac", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696332362, "uuid": "cfc0556e-9211-4f3c-b44d-61da5799b88b", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696332362, "uuid": "41618b2b-26a1-476d-9052-d5f725995f05", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332362, "uuid": "42fcb607-acbc-4253-bb63-84635bad0dda", "value": "AppleApp.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dab5d58-61d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696328730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328730, "uuid": "9049506e-3a8d-4aef-978d-b82571b2340a", "comment": "Malware payload (Mirai)", "value": "7fb89e2dc7d38c598854b273282db73c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328730, "uuid": "c6fb01af-dd8e-49df-b696-368682029c64", "comment": "Malware payload (Mirai)", "value": "06c9ac8c8dd732848f3256239b2871d93a02d87332d4cb745308adc0e0ae6274", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328730, "uuid": "cd86d11e-c5f8-4707-a9c6-03c7c7bd42a6", "comment": "Malware payload (Mirai)", "value": "5a129a01afffdb80e50a7532c99ce1acb68d9fdf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328730, "uuid": "15204b52-8bae-4f6e-a170-80e6993d6479", "comment": "Malware payload (Mirai)", "value": "0b18d767dab8b44e5e1b05b4fdfdd91e53f19c267c4684a9ebe8d2a6b3610ee71678b61e21bcb3a1c5e39c55d151a880", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328730, "uuid": "434beac7-3ff2-47a9-bcda-7e99fb8ed4e4", "value": "T144D2E04972D693FA8CCAD97D321F102630BEB5B672A1A327B306C8574776280F681D4D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328730, "uuid": "4e4b416c-f952-4064-8c28-b23897f5c9a7", "value": "768:7lxKd294CxEnsU96IHE4RlY99umYnzk9+:ed29tnUFHEw0Wzk9+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328730, "uuid": "e629258d-f05c-4d46-8030-e22de39562db", "value": 29680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328730, "uuid": "993d06db-a6ed-43a2-acd6-2730284e2c68", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328730, "uuid": "d3e46617-dea8-4a2d-92ee-ab46b9405704", "value": "7fb89e2dc7d38c598854b273282db73c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e3f20bb-61c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696322235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322235, "uuid": "6757a214-fcc5-40aa-9fc7-a8fd011072e4", "comment": "Malware payload (Formbook)", "value": "aaf54260497f3e1ace9532fc4c2eee77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322235, "uuid": "28bcc204-a86e-4b43-9809-c264365a470f", "comment": "Malware payload (Formbook)", "value": "070bf05713ce42a805a08b8ffe86da07d527e179148c3e9a82b0f8ccd8e37cf7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322235, "uuid": "6982fe6d-da91-4b9c-af7a-23a076749fc4", "comment": "Malware payload (Formbook)", "value": "88dd0e135da3467f457f8726aee7f61c7278aa06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322235, "uuid": "4717bb92-c6ae-4218-bb15-b647f884f5aa", "comment": "Malware payload (Formbook)", "value": "2f980344456d40d4643c2176655550d53b94b0e99dccad6f544fc2bbeba6ef064e7479392ce47d1e092941596a9eb17f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322235, "uuid": "e1150a48-5bd2-41cb-97a8-1cd2966d5fb7", "value": "T1DF348D0171D28472D572293209F49BBA5A3EB9600B209EEFA7D40B7E8F747C19631F76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322235, "uuid": "fc42c6d7-ed59-42b6-ab50-036f801e3811", "value": "79524c377b21af0917f13201cba807d7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322235, "uuid": "965c0c20-4753-4d56-8281-44e028e9ecd7", "value": "6144:jGr95wZxg+c9g948LOX52OmUdHppAOTrkRACm:qr8Ze+kqLfUdHXlSPm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322235, "uuid": "092941de-81be-4b93-8029-e8d99dc20bd6", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322235, "uuid": "3571377e-7b2b-4d86-abb3-bd4fa974223a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322235, "uuid": "c5a4d99e-b524-4032-8357-20eb00402cf0", "value": "SecuriteInfo.com.Trojan.Loader.1550.30336.25201", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "178aa555-621f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696359617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359617, "uuid": "6ff882e2-7532-4e49-bfbe-54dbdea670a7", "comment": "Malware payload", "value": "a41be33681d2cf50abdf68dfabed1670", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359617, "uuid": "88fea612-ffc7-4575-a106-6e0b1d9a93b0", "comment": "Malware payload", "value": "079b40e6d0f86981e7b789a0e4a3e289e38c819f9174e018f1ec4c8f7ccb8679", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359617, "uuid": "6c6a5fe8-39b8-44d0-a5e9-2f057faa17f4", "comment": "Malware payload", "value": "bfd587c49e06bc23b2a02201f03b95e17eb7f3ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359617, "uuid": "b8d48423-ccec-4667-bbba-1a8838f11233", "comment": "Malware payload", "value": "d1e424c4a52581f4fbcc031b4c3b6156c375ba782e8d63ec1f76f47a7275a78ab2239acbb32c21b61ed61d41105fdba7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359617, "uuid": "077b3b8a-7d2d-4845-913a-d6e2ab66a5bd", "value": "T16F13508C7A5076DFC86BC9768DA81C60AB5074BB530BD317A45316ED9A4CA8BCF052F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359617, "uuid": "f06800cc-af94-4354-b4c7-03222c487a23", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359617, "uuid": "09e70499-b907-4978-ae8b-80d2b96904ef", "value": "768:eTZc4qco+smk6eic1RwGfOInpaGLhf9skA3XEvcVl2cxKrmQdZOYiX:Otdo+sF6eLRXOIpKxKXdZ5iX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696359617, "uuid": "91597af3-fb75-4b00-9eec-aeb06b6ab771", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696359617, "uuid": "6b2a5966-4112-46fa-bd75-38c3fa9dc14e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359617, "uuid": "2dd9a387-c8d5-4204-ac5b-bd2eebf94e70", "value": "nn2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc6fd0d1-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696341022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341022, "uuid": "3825625e-1d99-4432-80ae-cd742ea3174e", "comment": "Malware payload (Formbook)", "value": "d3080230a8fc031889ac6d348f253939", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341022, "uuid": "1e4d5352-cad9-44ab-876d-620da36b74ad", "comment": "Malware payload (Formbook)", "value": "08617ac03620863f2105bbb16f26c851a360b2c277c77b80bba81356ad5b9900", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341022, "uuid": "eba23bae-386b-4193-9332-c0d35b36b991", "comment": "Malware payload (Formbook)", "value": "598eafa6344fd82cc08639be6aee6d994ac17874", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341022, "uuid": "d1ae42fa-83ed-4f58-b72d-2a41ea4f98c6", "comment": "Malware payload (Formbook)", "value": "2b183aa15c92b98c4eaf1fb1b87305fce0aeb018e933b33cfa1876d8740975e85cc4e355d3d49364627446aae8270e90", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341022, "uuid": "8fe7bc7c-3d1d-4f8b-9f48-4d8759982e72", "value": "T1D615239166A0D4B7CB7B117455D7621EDAF4EE20A6AB830F4B113C4CFE76BC283256C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341022, "uuid": "a3b88440-c3a2-4166-b3bb-39169106cbae", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341022, "uuid": "17a4b143-9f74-4a2b-a5da-073e0428adb0", "value": "24576:INPx3TplFLuxjuUTvP8z6uc1L9J8xVCT5ATqY2BXY6+g7:mBTTFatbP8z6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341022, "uuid": "78f5eb0e-f318-4296-b26a-9db6b1c98ce3", "value": 875335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341022, "uuid": "9ea0b2c4-7018-4c10-98b9-35475cfca55a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341022, "uuid": "34f5d694-e2ad-41ec-b54d-73accfe66ddf", "value": "DOC2045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3e8ce33-61fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696345706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345706, "uuid": "03efa451-285f-4e47-83c7-b3ec3cadd892", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "cfb2734e58cb4c9158af335e08bf4911", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345706, "uuid": "06427f78-4056-487d-841b-dc3233e8a986", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "08634daf98ee88c1c6ae15f6e66b05cd0d9d4bf5fbc23bc1531866fc2a2699e5", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345706, "uuid": "d8143d3b-dcd4-483a-89f1-73f094da1bf5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "e1d8ef833202160cfa5c96647133784f6a2608f0", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345706, "uuid": "cb84f1c7-cb7a-415e-97bc-07a42d1efff1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "7c08049f4262b6b3309496721b858ac0958f3c49009409a39b1cc8b3c2fef89c94d674c66cd6d39524a9b2cf9aa5dc48", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345706, "uuid": "a599dc55-ef3b-4490-9ec6-1b0c155064b8", "value": "T1F1652363DAD859B6EEA933301DFB47434231BDA29EA4E7731784A15E087388425353BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345706, "uuid": "659a9af9-fc0b-4f41-bc1c-aeee76106d8f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345706, "uuid": "c138d0c6-6d92-4cb4-9c31-5fb95bb36969", "value": "24576:iy9mFLLUia95dTyzn+tEYVxCW9YqW02ZLIc1Il7vy+XYO2LlXF2i4H+2:J9m9UTRmztM/9Ysv1qr9tK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696345706, "uuid": "0f00b49b-07d2-43b5-806c-67d09201fcdd", "value": 1495552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696345706, "uuid": "dc39e40c-a1f6-4b40-b786-8a0229c74f74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345706, "uuid": "363fc4b5-5e8e-4ecc-ac81-2bb3d18f4432", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b33cb719-620d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696352147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352147, "uuid": "f1186bc1-ba12-4047-80a7-a67cffccb03d", "comment": "Malware payload", "value": "784f84bd5eb15d7902920753b54f1ead", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352147, "uuid": "b74d327d-7388-4e36-94db-c5667f02d9b2", "comment": "Malware payload", "value": "086495cde3e89171613dfbc1747b2ecc9d1a810a713d3c49e432ade7bbb61158", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352147, "uuid": "83911c4c-20d8-47cd-b87b-7857593b439c", "comment": "Malware payload", "value": "e71ef48ecc565045c4470149d3025d8548a89045", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352147, "uuid": "3948dca4-5672-4544-8334-c736838dfd64", "comment": "Malware payload", "value": "4ce821cabc60f2a40343ea4a8b7ab84ce6803938e2a03d0e6dd9daa6379aeb307b8074e08c2c0737a0783c22ed47e566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696352147, "uuid": "b9bad868-f228-4462-9fa3-e55f9e5a86a3", "value": "T131E423053999D423EE7518B03C7C84D4433BE60E6507FBFA2A6F19286D5FF606E05369", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696352147, "uuid": "3b5792c8-14f8-4f71-88c2-a24e1c640e3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696352147, "uuid": "9cff0bcc-cb3b-481d-8b21-b3f60a1bf087", "value": "12288:kJysnoROJppj+3K5iFwXe7kSaB18e7j+g7Vpt5L4WUSiHoQpJ:coqbiK53es18Oj+g7B5L4WaoQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696352147, "uuid": "cee9bcf5-72e4-49d5-b444-6fc02c0a4f28", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696352147, "uuid": "51be8118-2a7b-451b-b462-0b1a3975cc7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696352147, "uuid": "d7679a0d-7ec3-4f3c-aba6-6dc68a82dd6a", "value": "gdqVqzMQ5rF8UM6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39e1d8e9-61f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342065, "uuid": "1f6cdc80-0f8a-4bc5-a966-7f0c08474198", "comment": "Malware payload", "value": "f906ff200b34c6d8285c437cf88fbb71", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342065, "uuid": "7d8a195a-8077-4fdf-8f65-9ed9736a7077", "comment": "Malware payload", "value": "08e9811c2255b549ecced485178ad03d72c8483e3a0207c7c47061b2da061c64", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342065, "uuid": "95ddaee3-b7c1-43cf-a5d4-410330efb805", "comment": "Malware payload", "value": "3e9fb4f97cc8acbffefd3fdb9d70670355054c59", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342065, "uuid": "95ad8357-27ae-4ad8-9d6f-ba7702e69879", "comment": "Malware payload", "value": "72b443a03845c7fc5e51132718a6243fbc8fd7f958207b77c931587ed567504181c142f5ccbedcaf167ac74dc9baabcc", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342065, "uuid": "c4da87e5-6f66-43b5-a0d5-ade662adf6e4", "value": "T179B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B890A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342065, "uuid": "117361ac-e2e0-4c0a-a870-d175f6c06d08", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342065, "uuid": "2820d324-3884-4755-b012-0376c5ff0440", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342065, "uuid": "d0549187-7987-4534-b2d7-3b6b2ed2c691", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342065, "uuid": "6692e32e-aff4-4d62-8a37-e6f518bdb750", "value": "AppleApp(7).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2732c3d9-61c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696318841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696318841, "uuid": "cdde49ae-a577-429e-9e06-0cecb5f17b3a", "comment": "Malware payload (Amadey)", "value": "a7f3a42abc97e300c2d6a6f70f7f87f7", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696318841, "uuid": "3b527742-84bb-4626-a1da-a8d746dfdf94", "comment": "Malware payload (Amadey)", "value": "09914c56a8c886bea85b831c094f25d3fbcab32ba99721303d8e6ab59ff190f8", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696318841, "uuid": "78eb0bbf-9ffd-4314-9078-554ff8daa2b3", "comment": "Malware payload (Amadey)", "value": "05cf10aa54754cdfdb147b1fb63e93ac9a7c4fef", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696318841, "uuid": "a2576829-ecc8-4c65-bccf-39c04df88dc6", "comment": "Malware payload (Amadey)", "value": "ebf2da185116b194d19f659d66f36db8b8af590e06cfe2f743345930b16ae0e5c4bd8731192127682f970a333ec883e0", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696318841, "uuid": "84881639-0d4e-4bc8-9f97-7bc9e24fc391", "value": "T1D4152396A7F04072D8F517B45DFA03E31B36FC660A70423BB385880A5E722D16979B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696318841, "uuid": "f06a8e83-cb82-45aa-bc50-76a5c424f965", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696318841, "uuid": "d45073c2-d99f-4387-9387-5740e69a7d7e", "value": "24576:9yyI6jOaTbn3r8BoYyS5xnUKs2LrpiGRYxz:YgVzBRS5xU4nprGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696318841, "uuid": "5d05ce73-8d2a-46c4-8cfc-ca804b2a3752", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696318841, "uuid": "6fb7dfeb-ca31-4454-9131-4e583d8da030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696318841, "uuid": "4231acfc-eca9-46bb-973a-860f0d6fa142", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95dc730f-6229-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696364124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364124, "uuid": "ef5719e8-5d7e-4a84-8908-8484ab709dd8", "comment": "Malware payload", "value": "7cd4b89af3395bc2ccefcc9a98c2da13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364124, "uuid": "8908949d-febe-49b2-b96b-24206098d2d5", "comment": "Malware payload", "value": "09cab28b90799facd47c9a949855955c635efef849dd8896110e8376ff7f1458", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364124, "uuid": "6d8cb24c-85fc-41b0-8ec0-e41292bcf263", "comment": "Malware payload", "value": "84dddeffd0257eb4184b210208419eb5139a1196", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364124, "uuid": "dabff5df-2c2a-4a60-aaff-7d7842a44c86", "comment": "Malware payload", "value": "014bf2efa596a3287525fd8b185bf4c79a7dfc448f3cc76bb31622bc44fa91a2e0c1b49ffcf3411d3a80e7bdb67a8c64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364124, "uuid": "1a609518-1ef8-456a-80a6-d6a195fd9bf9", "value": "T1DFB4AD2531EF1E87F03BE7B643982845CBEAF2F16F1BF61A7D8506428422DC0DB52625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364124, "uuid": "5f3e4ae0-29ef-4bf5-b7d1-414339186a60", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364124, "uuid": "4e1adf99-ff6f-48ea-81b2-b83d05eb1f51", "value": "12288:lxF6F5RAU429QsyOyH2VR+pkgGZ/b+dFVwHfA:kV4EQkyH2VR+m/KpwH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696364124, "uuid": "1319d7c0-2234-4a3f-9942-57a79ada82fb", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696364124, "uuid": "77acf767-9ee7-4837-9b2d-c22129edf54f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364124, "uuid": "5ceaf535-e03d-4162-9e09-10dd42b73677", "value": "SHIPPING DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3bd8672-61dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696331640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331640, "uuid": "f6e238c8-958d-4aa5-b7cd-f4a1c90488cd", "comment": "Malware payload (Mirai)", "value": "932ada58267bb6bcccfd2c0ec9a9c735", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331640, "uuid": "1b3f99dc-1438-45d0-accc-2f84f0e8e873", "comment": "Malware payload (Mirai)", "value": "0a4cd3101ab81f86710a38fb42b849dfe3263da86ca61dfabbec63cd37af1aba", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331640, "uuid": "185a0da4-8552-41dc-a07e-0783bc860120", "comment": "Malware payload (Mirai)", "value": "f72477bc0ba007f6ecce4e71a69a56b145b84fec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331640, "uuid": "41d76be3-16f2-4901-a602-cd801d291324", "comment": "Malware payload (Mirai)", "value": "05907ded13e5db6cbbe5e874cca1993b8b965ecca47bc18ff06721ebdb5e890268eeaf9a58ddf1352dd27182255156b5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331640, "uuid": "064d9395-4954-4e46-ba4c-36ebb14279c4", "value": "T174735D24A97D2E26C0D4A17B61FB8361F2F6230E2570965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331640, "uuid": "b29884be-1b96-44a2-89d0-fa03f7172053", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8U:YwfdNu4cmZvFqI3w7U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331640, "uuid": "85debea1-7c75-4a8f-b02f-c871f0af4522", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331640, "uuid": "ef48a62d-a0eb-46a7-ab73-cef77748d102", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331640, "uuid": "6bc61135-8868-4afa-85fd-2e468aef33b6", "value": "932ada58267bb6bcccfd2c0ec9a9c735", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e66d4e7-61e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334691, "uuid": "a7b5cdb6-a16e-4289-94c6-13d82747e4b1", "comment": "Malware payload (Mirai)", "value": "1804eeb4055fcb41e2eb541c41b0c392", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334691, "uuid": "8ef2bb44-cdc9-42cb-8ec8-c6b8ecf66890", "comment": "Malware payload (Mirai)", "value": "0a8ba348185a87e09bc98b78080c8f4969cd899cfbfa47ee091ed4c57a72f9ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334691, "uuid": "88a02e7e-2a8b-42bc-9f4c-c2b5dadaf5f9", "comment": "Malware payload (Mirai)", "value": "c88adba703beee0a595b6a27dbe5f3e06a6f676c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334691, "uuid": "647054a0-126a-4545-ab07-6db23579848b", "comment": "Malware payload (Mirai)", "value": "cf264a1fc700d2f0f241a2f5350b86ebd1f5b6407e1dea105e2ad6ed41cf3d24e47ef3f6235903e9bd94817cbcede4da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334691, "uuid": "5a206fa4-a7e8-4707-8c6b-845c0786364d", "value": "T10D730746B9809657C6C11B3BFA0F435977368304D3EB7342AA2AAF70AF4771E0F26615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334691, "uuid": "10db8223-dcd0-41fe-b6e0-568d22e1b06a", "value": "1536:hgnBHYQcxWMvngOzh3MxnPNDOmUxa3lD1LKk4SOgl:+nh1cxJNknFLU0lDtZ4SOgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334691, "uuid": "925f0985-6e47-48c1-a564-b2ddf6ecc849", "value": 74268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334691, "uuid": "e6fcf147-c311-430b-81fd-d81cb8779d94", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334691, "uuid": "ff47ff30-7f8d-4ae7-adbf-c02197bf7d56", "value": "1804eeb4055fcb41e2eb541c41b0c392", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "070a6e98-61d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696329524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329524, "uuid": "1a776c7a-ee2f-4d15-8c6c-60aba812fd1b", "comment": "Malware payload (Mirai)", "value": "90d3a332f3ed946aafeea9cefb05923c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329524, "uuid": "9519bbcc-d4c6-45b7-80e4-af4762ffd541", "comment": "Malware payload (Mirai)", "value": "0b489e9aa030b268955c3a8a76649def4f91c6d27bc4fd540939a70c08cfce81", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329524, "uuid": "cf12bed5-ad05-4917-9d67-566eef339bd6", "comment": "Malware payload (Mirai)", "value": "0f3b564dc0eebed4c9eac5e3983b79d22c87cb0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329524, "uuid": "dbd30aeb-1d70-4e48-bcb2-1379e13bc749", "comment": "Malware payload (Mirai)", "value": "5e44a4f8d9e76ebe9a1994e7e6548f6bc0e8e915b734cf823f0d8729b58e75fb030b115861ea0f1785219db186e8a30d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329524, "uuid": "709c33a9-b6b9-4e68-968c-6d321f5b078c", "value": "T1CBD2E1983B4F97F7D8356272756DF807E404A03578957B2819126D052FAA2E8B81AECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329524, "uuid": "7ee20902-5b95-427b-9dc3-60e7edac7dab", "value": "384:MSdbl/XF4NCbPevRMrY2ShP7iQMIRpJiaX6cxku4TL4bX/M5b03y3U:7dblvF46evX2q7ikSeRaLyX/Yj3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696329524, "uuid": "fd42f00a-c96f-46b0-b602-fabb54c822c5", "value": 29576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696329524, "uuid": "ef24392d-66a4-423b-bc3e-4a5bd342aba4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329524, "uuid": "47402706-0a68-4ef9-9aa7-9f8eddbbe086", "value": "SecuriteInfo.com.Linux.Siggen.9999.29932.11184", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03ee348a-61ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696338968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338968, "uuid": "3fadc54a-7c9c-4a49-8689-d28d43c9838f", "comment": "Malware payload", "value": "b2eca909a91e1946457a0b36eaf90930", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "joke", "colour": "#72FE7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338968, "uuid": "a6615e27-980d-4e6a-b95a-b44a7e71cd08", "comment": "Malware payload", "value": "0b6c0af51cde971b3e5f8aa204f8205418ab8c180b79a5ac1c11a6e0676f0f7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "joke", "colour": "#72FE7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338968, "uuid": "16ca90fc-cc95-4a1a-89a5-024f78f33282", "comment": "Malware payload", "value": "3200c4e4d0d4ece2b2aadb6939be59b91954bcfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "joke", "colour": "#72FE7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338968, "uuid": "b8147ebe-a91a-448b-994d-6cb8c0a21d6b", "comment": "Malware payload", "value": "1b5172e7129ada8b97e7c6a65ff0966c7e5bc6fb29a70be339ef3c50fea1f5a11a76b98d5b53492de5a12f30da64bf0a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "joke", "colour": "#72FE7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338968, "uuid": "696b4831-579a-4d50-8f70-ea32f03078d6", "value": "T138139301B2A4C82AD83885BAEC95C6B303645C466B34CB5D3ED63F4B3D51ACE1B1A7B5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338968, "uuid": "c157802d-1f0c-465e-81f0-ba53a5e1015c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338968, "uuid": "c14c6c43-35c1-4a1e-947d-e753536092f9", "value": "768:1uy2FRMytCquuhuVWHzeYDroQXI2zeYDriexi:N6HeQXI1exi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338968, "uuid": "39b38086-8cec-472b-bd73-1d7c732185b4", "value": 44032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338968, "uuid": "11bd99ef-fbc0-4f1b-b8ed-5c29fde5e98c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338968, "uuid": "7641022d-d871-4d0d-870d-f26d283912a1", "value": "HYDRA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8185109b-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696336602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336602, "uuid": "b82e27ab-01c6-4c2e-bf84-b19ffdd86554", "comment": "Malware payload", "value": "250a778387422fcdc612f777cd0c0a82", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336602, "uuid": "d1b636ff-34ec-4fa4-835d-130347c5bd04", "comment": "Malware payload", "value": "0bb22a684b06857be70f1d874a1984127af30234c5c3210ee7caf26c3922da1a", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336602, "uuid": "635547c0-eb9a-4a94-9e4b-e3e141132edf", "comment": "Malware payload", "value": "465c5af8c514e2720fe17b0aaa94090f5b3bee88", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336602, "uuid": "35f95fd8-f46e-4666-93e1-1bd6bf104c54", "comment": "Malware payload", "value": "d4b4904a4f5db0043288c839d93f0e5e61b12307054d15191e2ddd38e214e553b903647178f6ec616823b9cb504ab61d", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336602, "uuid": "00ca8359-05ef-4079-953f-2c103d6d9cf9", "value": "T105B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336602, "uuid": "30e1b088-47eb-4f3d-9444-373b2a82f6ec", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336602, "uuid": "30b60d4e-7a2c-41b5-b9ee-0c1bf44b475d", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336602, "uuid": "d552fd8c-039d-4d17-af2e-17102df25890", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336602, "uuid": "18d102e4-0d88-44a4-9f12-4f0af1b306b8", "value": "AppleApp(26).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e97ee6-61d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696327207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327207, "uuid": "82ddc91f-5cda-4984-9e58-dabfef0ac530", "comment": "Malware payload (Mirai)", "value": "3cfd412a4b7fa1d10c3ebb6d5b91a8e8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327207, "uuid": "e8fdf0ab-28ca-4d9c-87ff-c327a0fecad3", "comment": "Malware payload (Mirai)", "value": "0c5723b33f25c748e9a3722f0307aefb385cac2a490f4d62e164746b4d94650d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327207, "uuid": "cb441bfb-9724-45fe-a94b-b60926842df9", "comment": "Malware payload (Mirai)", "value": "01ec6c6d390e60fdb04652f9501658a07d78b5c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327207, "uuid": "b65a3816-326e-4175-9dac-e19571ad6d95", "comment": "Malware payload (Mirai)", "value": "de1b854d71f7c7262f05b6f9701c8209806254665f3f93ec23f8c5054a843971289453ee62c7219467130b28fd16ea3b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327207, "uuid": "8e6f88da-6f7a-4941-8c2e-ad9666ddaae6", "value": "T12D3302A2279D65D192F08777FC36F819929C17E49CA7309A3CF0AA1973C18124FF3686", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327207, "uuid": "c96174d4-9569-42f6-9859-3ea87fce6549", "value": "768:AwqkrmTJaLf/ZRjOrMX9+xNy6IY3mhXJY3UQwjQEkkBF+MauMBexo46hpKUa/v7b:49O/ZMAXIxNUk0IfPqF1aBexo4opKZbb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696327207, "uuid": "009be545-1383-445a-aa49-406c941c014e", "value": 52656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696327207, "uuid": "b9841b9a-304d-4a42-8590-31c78b3742e4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327207, "uuid": "cbb9476c-c9a2-4fdd-9251-2ab30596ca00", "value": "syms.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "977c538f-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696336639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336639, "uuid": "ed202e39-dcee-4405-8f75-3a423798bf77", "comment": "Malware payload (Smoke Loader)", "value": "b9f3ee34988cad6c59125dbe0f6e6c41", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336639, "uuid": "fe66549c-5de1-4294-adc6-030f2df633cc", "comment": "Malware payload (Smoke Loader)", "value": "0d0bc2301d292058fbaa059a061b050a475f796c1856e5c1d53d179b790dabbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336639, "uuid": "c3854d16-58f0-4d30-90f7-83e7faa75ee2", "comment": "Malware payload (Smoke Loader)", "value": "a667b7b8f663d65cb018945266a5dddfd24726f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336639, "uuid": "5566fdcf-bfc8-4ad8-912c-c15d7a37896f", "comment": "Malware payload (Smoke Loader)", "value": "17b7529fa443e2556568387763cbc94c1bce605a74634e762c57ac336c3c41f2815d72e20cc64ba8c1fb1a6cba58d1b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336639, "uuid": "9d06a46f-768a-49a0-af97-dea06b3c0a60", "value": "T1B554AE1372E0BCA1D4625A319D2AC6E43B6EFC619E6917DB33583F2F49701E19636B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336639, "uuid": "fc9060ab-434f-43f4-84dc-ea73d99e744a", "value": "305de144f6fc937af53e7fb65cd3b646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336639, "uuid": "ff65b9ce-346d-4168-95d8-8eb93acc54de", "value": "3072:7W3iHpCABkQsSgCcNaLm+00fWUWVxZIU4kwZ+0Zq4V8xUKS:q3iJCAkQsSgCrm+TOrVxZIU4ToCpy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336639, "uuid": "cfddce55-7d94-4484-a4b2-bc471220fbc8", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336639, "uuid": "a6b3b77c-a962-493e-b1bd-8a2f976ea546", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336639, "uuid": "16200b76-e44d-41a7-8e2a-907c020a90da", "value": "SecuriteInfo.com.Trojan.Crypt.25134.28955", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716dc8bd-61f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696341299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341299, "uuid": "c41b2103-4f51-4214-a926-1d01b4b8a489", "comment": "Malware payload", "value": "9e227dbdab880710142c52a7e814737f", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341299, "uuid": "1223bf0c-ca49-4d2e-ab7c-203733ea0781", "comment": "Malware payload", "value": "0d20f08c9c0af164597be4aed6bf80a1b15deb5108c7bb0fb3d71be6817d18da", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341299, "uuid": "942164e5-0556-4eab-8fdd-07b6ad2738a3", "comment": "Malware payload", "value": "f14850338087b7c1fff90b81c9765807226ad3f0", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341299, "uuid": "7a3fb4a8-a9b6-4a61-b1d3-8c3a23382dba", "comment": "Malware payload", "value": "8f825983edc12abdbfe63082eb8cbaff11674dbd48a4f78543929f17019595e5ac0146e3a92c368826b1c99cfca6ab24", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341299, "uuid": "b1d84172-d225-484e-af83-b797afd8e08c", "value": "T1B4B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341299, "uuid": "7b134fd6-16ef-4f58-82bc-0f1bf0747b46", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341299, "uuid": "8959e011-51a5-4b97-b768-70a8966d6536", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341299, "uuid": "08c080c6-4363-4dde-bbdd-8134193cffef", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341299, "uuid": "b576e103-e920-4873-9781-4e9665aa5406", "value": "AppleApp(92).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3cb3be60-61f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342070, "uuid": "930770c8-b864-4f4a-be0b-a89bc27d9028", "comment": "Malware payload", "value": "f8fbc6b65fdc4ca948d34d100ce00a83", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342070, "uuid": "d324c35b-3123-4ecb-a3d5-5036332783f1", "comment": "Malware payload", "value": "0d6717f92720447e99cbca2c31c53b3dc3a385c22736948c9b435e978667b27e", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342070, "uuid": "8fb38ed6-e1e3-41a4-ae72-44a566ad3642", "comment": "Malware payload", "value": "6fe6dc506186585f7c6583c64a7d9e7bedbe308e", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342070, "uuid": "a7b88deb-8660-48a0-af9a-fc726071717e", "comment": "Malware payload", "value": "aea921dd86b8093c00357b9eb2a9d7e1936ae3870f4e04825384500464f0720c5ebc8402be5de2275dd6ce6f036f2cbf", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342070, "uuid": "7f78f771-38b5-4872-b291-bb1357755de8", "value": "T19FB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B890A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342070, "uuid": "00de5061-5d80-4229-8599-516aadcf1cab", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342070, "uuid": "eea19c1e-86c7-40f1-9f76-982ab5b8b782", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342070, "uuid": "888a1945-39b9-46dc-a02c-55a8515b21f1", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342070, "uuid": "82d3e5e8-27cc-41e6-a45c-f4caeeecb73b", "value": "AppleApp(20).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c15baa7c-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696343581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343581, "uuid": "70ea1ecd-34a4-4ebd-85f7-0006404c9f03", "comment": "Malware payload (Formbook)", "value": "356f615eb12a2da9a61483e51a42ceec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343581, "uuid": "f259fab6-d7b4-4a10-9d54-b7146e79957b", "comment": "Malware payload (Formbook)", "value": "0dbd5fe8345cdb46f5611862dc31279c99cd60bb4931e6d924f34e84519f35b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343581, "uuid": "1fd21c59-68a7-4077-b432-c2fa08b8f4d0", "comment": "Malware payload (Formbook)", "value": "6acd233bd9cbcf3a0e665a88de9647f633da6c6a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343581, "uuid": "613a06bd-50d7-46db-b9fe-a1a674dc2c44", "comment": "Malware payload (Formbook)", "value": "a1c87b6822b5a2f57aaee33cd518aa70748a16e457a3d9dcb80fc5d405e4335a44266edd4dcbcaab020634134fc73920", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343581, "uuid": "0f2c9742-9882-4c47-b007-b8ca79b54815", "value": "T157E4020936BC457CE70ECA7E12B1144603FF6114AB54EA8A0F5B64CA6DE7363A706F86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343581, "uuid": "171c5ad5-3369-4c60-a594-565abf507496", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343581, "uuid": "c5a46e79-6ea2-4209-82c5-1b4e11a4a736", "value": "12288:pGbiSAx5PWPQA0pWlBbsn3EWdzpIbXKL31SM1XlLSBsjzC0KeHoWbVtQ/tE:pG7Ax5uPg5+W3kMSBsjHR5tQVE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343581, "uuid": "f6508307-d32b-4047-b0a1-cfb6f668c38b", "value": 696832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343581, "uuid": "e166dcf8-3aa4-4d81-b23b-5d35dc6e2624", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343581, "uuid": "86e4d514-a641-4bd2-adfc-1656615ce989", "value": "Invoice 2796.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a2a860d-61bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696317155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317155, "uuid": "1d6f7771-4519-4793-ba7b-dd9007d073b0", "comment": "Malware payload (AgentTesla)", "value": "4075e2ff83c48431a919180e35601df7", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317155, "uuid": "0bbf4192-03fc-48ab-9639-614e3ad25e0e", "comment": "Malware payload (AgentTesla)", "value": "0e5b809d6608349e70e32d793291ae14cf0e437a72a95e4b72f3e3a8839b27cf", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317155, "uuid": "1aa2f9f3-af4f-44a4-9221-620918cbc790", "comment": "Malware payload (AgentTesla)", "value": "181a8c4a67b6e95fb4216d1123928d689e29ab89", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317155, "uuid": "29594bf8-83b8-4df4-bd5d-6c0280ac7b7c", "comment": "Malware payload (AgentTesla)", "value": "1a8b2efd1d25c6a31bc8bbcadaf3ad0ea0fa70e1e5933f97f26fb2a4613b8b83561723f81aa522ed36ec072bc9c0cc94", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317155, "uuid": "98dca302-8a97-486d-b37d-119ffd6f3718", "value": "T14A74234A8CD17B3EF193E3980DDFE5F1B8CAF5708544DDE7E4CA0552EC2261E4A88968", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317155, "uuid": "fcea5d56-f94a-4c5d-8a5b-e648bf6a3d4d", "value": "6144:6bVSK30+X9lxmKbDQ2Du6Dxoa4Ac7MKcixCEf0hfynzbZy/XmDQe/zFOrrpVCGYa:rK3Vtbe2D/DRSoiABfynZQmJorpVCw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696317155, "uuid": "7e6302fc-f443-4479-a55e-e4c8b9cd4938", "value": 357668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696317155, "uuid": "d8017ffd-1e9c-4d4c-8cf6-dab73c918019", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317155, "uuid": "9c5deaa8-c2f8-4938-9322-9a7a981b9dde", "value": "RFQ-000112030687_1.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e13e9da-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696313403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313403, "uuid": "86c06e61-3b16-483d-b7d0-f7cb66df2ffd", "comment": "Malware payload", "value": "f423b9a20050151bb9e67f2967948ddf", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313403, "uuid": "00f3bd4c-7246-4c25-b5ff-80f62674d1f0", "comment": "Malware payload", "value": "0ee9c92bb2a33e17cd63f1038f1f012db057b881adb4fa69bf8a018736915a0e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313403, "uuid": "b83a832e-fda0-4f2f-8850-174dda541384", "comment": "Malware payload", "value": "39b8feb8e346556c6a1926f213e7af55be8eb8e1", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313403, "uuid": "074b909e-abf8-454a-ab41-78949d255efb", "comment": "Malware payload", "value": "605c533568609d39b731bc5fac3b4141c5e1d3efb8d8921aa9fb68a70019fba74050a99257ad7803794d64b641341500", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313403, "uuid": "6c3821c2-2a80-4cce-bc9a-921cd1d1348a", "value": "T16555D00F9914EB87C00883F86E1379990E0E7F15A7C16DDB14537B8B7E35BA258CA69C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313403, "uuid": "d5cfcf3f-0879-428a-8a19-b64baca9aba0", "value": "24576:yWQmmav30xWupxZyNw6VSAXZSWeTgZyLw6VoAXZSAEsQk1xbVkwTA5r/Cf3wdxmp:3QmmQ305756VJEqX6V3EYTbVLTWC/mQp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313403, "uuid": "afd81106-f884-4a26-9438-2c58a8ce0a7c", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313403, "uuid": "88766c7b-10c3-48ff-99c8-4eb78018affd", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313403, "uuid": "c554d893-f5de-4e10-9f3e-90c4199019d1", "value": "NEW PO 23C14660.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aaac571-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347274, "uuid": "4f3a6326-aa8a-4751-8acd-88f7daaa9d69", "comment": "Malware payload", "value": "6db85e0633ace57107d90469a5e9621c", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347274, "uuid": "f0e39799-05c0-404b-a47e-fefba145159a", "comment": "Malware payload", "value": "0f71c85d7207b715af1db1e8ff91df472d111dd6e2d642c14f28f9aebcbe414f", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347274, "uuid": "3413518c-dc66-4622-9f53-2b71fdf64262", "comment": "Malware payload", "value": "2bcc486d19a8d9ed0e9df78ba3e67ebaf5d1e5a2", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347274, "uuid": "8290a24e-3290-4709-bc36-3c11a62c1cf3", "comment": "Malware payload", "value": "b2e114aab0afb394508b1999e6afa1527b3545468ff02af4924968b9c5634c63cb4a9966c14f95b214fea14e2d91dd89", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347274, "uuid": "aa9d5ad3-3505-497e-8f79-bcead34a5f56", "value": "T1A1B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347274, "uuid": "7d33fa52-290c-4f79-8c73-c97a4e918687", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347274, "uuid": "25fd3943-775e-40a5-b594-fa426de9cc26", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347274, "uuid": "4feab090-9bbf-4b56-8ad1-06b931e5cf03", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347274, "uuid": "33cd9de4-d5a5-4b5a-b581-dd0807053ecc", "value": "AppleApp(220).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaf41b0b-623c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696372320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372320, "uuid": "bce7d1c9-086e-4547-9a3f-33a55106c9e9", "comment": "Malware payload (RedLineStealer)", "value": "46a22f0849344f152364d921c3c28435", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372320, "uuid": "92a06ea3-4ef9-4d09-8f34-2a74a6da4338", "comment": "Malware payload (RedLineStealer)", "value": "1041ffa7fe11147bca657c7f9b58b76a63fab9bedd01e37726e7a5f9df72aed2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372320, "uuid": "8df38f19-e4ef-4078-99c2-bdf365b68a9b", "comment": "Malware payload (RedLineStealer)", "value": "44fb399a95aaddd99270fe73a8705f53c0f73b72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372320, "uuid": "ff2ae38d-e210-46fc-a0f4-f3582126d4b1", "comment": "Malware payload (RedLineStealer)", "value": "19fac1bfbbf3f8963cf3dabd3c93e0a6a08c8e3312b48d67f84f28461b82c3bc1667a8a6765a43a8e33eee97e3dc1071", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696372320, "uuid": "534fa6fb-514f-4097-8341-fe17562040f3", "value": "T1EE850C41EFF95B89F6F35FB856BAA611087ABC6ADB11C2DF1261504E0821BD0C970B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696372320, "uuid": "e36455e7-50f4-4b1a-b4eb-0cf684aaf284", "value": "0019c5cc9dc02122ed11385f5bfdf094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696372320, "uuid": "02704878-4f1a-4772-b4ce-49a748bbbb61", "value": "24576:WwzT5gWn2HsJRx/6a9DhvhSCPhwtzZc7m6fgA7:dx/6a3vtqtu7m6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696372320, "uuid": "e98007c7-efe6-4da3-b268-fb99607f41ab", "value": 1757184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696372320, "uuid": "59f3dea4-a066-4d82-b5bb-773607f0a6cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696372320, "uuid": "65c017d7-3f93-4eed-ab9c-0911dca33802", "value": "SecuriteInfo.com.Win32.SpywareX-gen.27732.11537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06026355-6199-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696302035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302035, "uuid": "c0d2d7c7-0106-44e6-9bd6-94a78a17ec09", "comment": "Malware payload", "value": "be2b47cfe43c6554987230adc304981d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302035, "uuid": "009d88ec-873f-4645-8b22-e2dbff780351", "comment": "Malware payload", "value": "121b1c6100719fe4b4bc3bf3cac96a6d08d9b550282257e57d654d59e1f153bc", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302035, "uuid": "83743f2d-9ecf-44ea-8996-891f8c3d3b90", "comment": "Malware payload", "value": "61b529125fbb9b3114673fde2c7302d5c08ba08c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302035, "uuid": "73fbea10-f84a-4943-8bbe-feeb7c65b3cf", "comment": "Malware payload", "value": "a9731beaf8e1e6903e35e301d9ee597fa695cae0c45e38d4a672813c3596f7938f93823878abac662452f14d838ca0e6", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302035, "uuid": "af6dd41b-7ad0-47ec-ad93-5f0c6e5bcee5", "value": "T12DE02683A2EB26E8E6078DF938AA8BB09312AB624C729049C569E0115CE1B651590B10", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302035, "uuid": "2d8c0790-e0d1-491f-8129-37155c623441", "value": "6:5jSylGldWs90JyW6OZ41kJ3COO9+5ahtoUJi4NncLT+SbylGLdpB5oHu+lF:5jSylGLWs90b6OqS3COO9+5ahXiAcn1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696302035, "uuid": "6dccb446-4b6a-4d15-a6c6-cfd151fffbf0", "value": 337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696302035, "uuid": "d31e0af3-7a8f-45a5-bed7-1da219e7ac70", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302035, "uuid": "f92ecdab-0ddb-4d53-8ba6-0c9ecad6c100", "value": "Direzione629.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfe9f9e8-61da-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696330264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330264, "uuid": "553f1f5f-f098-40a2-9438-c087ab6139fa", "comment": "Malware payload", "value": "6bf0a453da6cd8ddd6a5d7387b16b2a6", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330264, "uuid": "ab8d730e-5ac4-48d3-874e-8dae50edf7be", "comment": "Malware payload", "value": "13f86fea54992306e61d746f069cd31f10081a947bef6c04487c85cb375db83f", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330264, "uuid": "5772d3ec-0eab-4cdf-b833-b025dc358b6f", "comment": "Malware payload", "value": "fbfcd32251c9de818f3b55723e1da71e1500c5a6", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330264, "uuid": "65f6e23f-e645-4da3-96a8-fc8ecdde0dc4", "comment": "Malware payload", "value": "d2d30e33de5428078a74e6384ec563ff1e107b7c06f6763a446be47764ec989b62142bc12c35209ef28bc4af35b260ee", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330264, "uuid": "5c9dede6-32fe-46e8-a7c2-2dcf7b183f12", "value": "T128B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330264, "uuid": "58a28783-b0a2-42be-beb9-fb264b563174", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696330264, "uuid": "906db621-7330-4c38-bc3b-b018ff87c741", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696330264, "uuid": "26508b85-4ecb-4238-b370-689b3fc2b825", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330264, "uuid": "f4470901-ef71-4315-986c-469cd3493de0", "value": "AppleApp.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c747cea1-61db-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696330706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330706, "uuid": "4acaf0d1-59c1-4c84-ba50-804411019cf5", "comment": "Malware payload", "value": "c5f22a89dfc6bb7ec30325140c8469e2", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330706, "uuid": "8c0931f7-9c4d-4d7e-82c3-382a31653a11", "comment": "Malware payload", "value": "1437ceb1aa34814873a79f00669e02a2782c97fc10a4bca4d19a27856ff49873", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330706, "uuid": "f724ef26-a4af-4d42-ad6c-172a594dcb11", "comment": "Malware payload", "value": "4247225b54b8f8e793a566615c698c549ebdd297", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330706, "uuid": "793fbe53-8568-4e3d-bc1b-53c4062c9e88", "comment": "Malware payload", "value": "8b8ac6512c80df2367b8d89bec1e19c1646709d54a11f611c1201e477e2efc75a98f8886a6151db2d6ed154b93ced6bc", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330706, "uuid": "942fca5b-7d81-41b2-bd54-af2f5d530cbf", "value": "T100B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330706, "uuid": "aab2d1a0-f06c-495f-8f8c-1fae74e8cdbe", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696330706, "uuid": "3a965f24-4ed0-47d2-b5aa-c4219048d1df", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696330706, "uuid": "eef9dc11-3157-4636-808e-10162a49a618", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330706, "uuid": "8978152e-e5ec-4ddb-a283-494a9144568d", "value": "AppleApp.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b995b9a-61d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696328700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328700, "uuid": "8ed5aa92-ef41-42ed-95db-7e2eb82e7ec5", "comment": "Malware payload (Mirai)", "value": "a9abaec2e93d979bcf90441c02221c28", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328700, "uuid": "3c3d22b3-5d7e-4ea4-9012-b07deda59436", "comment": "Malware payload (Mirai)", "value": "1552a03e733c43f1a7df4cc75383a8becfcab99704fe0e47f9eab51b9a491737", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328700, "uuid": "2df07cfe-4e5c-4b28-b7b5-a05f3171a325", "comment": "Malware payload (Mirai)", "value": "f08a3ed1286e7443a2ec37f55b677439efad016a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328700, "uuid": "ed504feb-be10-41d6-9824-2498b0051f54", "comment": "Malware payload (Mirai)", "value": "dc97e23246566fdef9985b9e2cc16178cefb2eb23ed6d662d7a795eb4b7f11f5af330f839d7b267fa54f056a67571662", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328700, "uuid": "034655ce-903c-4c6a-9265-e62e0e75c04a", "value": "T19D536DC6B4119E7DF5CBE7BE44220D0EB821626150931B27BB6FFC83BD721A48956E07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328700, "uuid": "4e623da8-a952-40e0-8383-bc93c50e3e92", "value": "1536:kPqRg0FZTbSX5xZLepSGossFpxhOx2X/ZOqc/yA8L:p5ofF8I9cKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328700, "uuid": "39defa7f-c27e-4ec7-9ffd-68fc6a07a7e5", "value": 66508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328700, "uuid": "8bdaae5e-2cb9-4af8-8f9a-5b90aff76b58", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328700, "uuid": "54966733-aa25-4f94-a822-99ff0c3a08f5", "value": "a9abaec2e93d979bcf90441c02221c28", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72ed297a-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374373, "uuid": "52a1bc9b-2661-46d1-b318-d45f884c768a", "comment": "Malware payload (Mirai)", "value": "ed82cface2748dfa20bacea4d08440b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374373, "uuid": "e1dee2ed-ecb5-4d8d-8b92-78951b41c2de", "comment": "Malware payload (Mirai)", "value": "1584dfde7bd0095c726c23790b6d98126a4fcbf1fd2e81ba2cd57d6be6f7461f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374373, "uuid": "c943366f-f9c6-4c64-a2ff-99c337333d3f", "comment": "Malware payload (Mirai)", "value": "d7427cb269dd65a07be05503b241652d5a642e42", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374373, "uuid": "54179786-4f3b-423b-b704-8438d718d9a4", "comment": "Malware payload (Mirai)", "value": "a7fe9d67be4a87885f0b813c378a7046a4bb090c55d108bb49f4983779d91812d8a2e8a06a10d7327f5fff9c55f92bf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374373, "uuid": "b83494bc-59d4-4e9f-8421-e6c6d8e7b911", "value": "T17F332BC1A583DDF9EC1525752176FB328776E43E115EEA87D3A8EE33B842601E20729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374373, "uuid": "475c507e-e95d-4341-a0db-e8b7b81bfcba", "value": "1536:5jWr+SCflT5rGlNogIokJ8stmDaXVPzQm00nBQ:5jWSVflT5qlmokJ8sk+ZkmBnG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374373, "uuid": "3da80f46-3510-404d-8d41-b3dfae43dd9d", "value": 51548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374373, "uuid": "246ff72a-c9bb-4932-9d04-0bde120482f2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374373, "uuid": "302cd204-bfc8-47cc-a0ed-4ee076924710", "value": "ed82cface2748dfa20bacea4d08440b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fff1012-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696313406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313406, "uuid": "09a7ee50-fffa-4b63-bb65-db8ad5eada4c", "comment": "Malware payload", "value": "8cd6f1c8a99ee0a820e0b197cc34794b", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313406, "uuid": "187230ed-f1d4-4e96-ae5c-d1f79ae35d38", "comment": "Malware payload", "value": "15a2b8bf32589a9821dcb70b9219636667013060081b58ee8cbdf4dd4391738b", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313406, "uuid": "e55ad2cd-45e8-4345-be0e-5cb2f12e26ac", "comment": "Malware payload", "value": "01c40fcaf8449e6df910a7e9e75cda67aa210efc", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313406, "uuid": "98306478-13e5-4128-b4b7-e50995f4a689", "comment": "Malware payload", "value": "ee0d2fe60ecdcda340da14645a38c7ee04944ca533fabd58572e7d18ae89cd63a8f53e55a8f1292f100af08f64d75e1b", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313406, "uuid": "c64c1756-3c05-4e6a-84d9-7c7b35f2292f", "value": "T17F55E00F9524AF97D00983F87E2339950E0E7F19A7C569EB1453BB473E316A218CA6CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313406, "uuid": "32561e59-3a69-414d-bf24-8b3bf4d41578", "value": "24576:MWQmmav30xcdIZyNw6VRAXZS4tzxZyLw6VoAXZSDKzThbBcoT4JoiPXwix:hQmmQ30N56VmEwX6V3EGxBbTdivR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313406, "uuid": "66d97862-d70d-474c-b87d-32fbf2093239", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313406, "uuid": "353d770b-b398-429e-be3c-abafde535eef", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313406, "uuid": "418e67a8-695f-402d-a68a-a1fbd4fe2870", "value": "TT PAYMENT - 02-OCT-2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a455aa7-6203-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347649, "uuid": "1ab68e80-3dc2-4d36-a0f8-26576ba98368", "comment": "Malware payload", "value": "2b965fd5ff2f4324418c5ba5ae75fd9f", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347649, "uuid": "b9ea469a-fa30-46e2-af13-7ae7bcd00093", "comment": "Malware payload", "value": "1652d33b22824d3e3eafd77eb894c19b84a313b6eb0f87fdcefc4cd6d43f700f", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347649, "uuid": "e8380294-55e2-4e49-90da-18e88464ef3c", "comment": "Malware payload", "value": "7ca1b2efec94950cb626011cac750758c2a179f8", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347649, "uuid": "1e142bb7-43f9-4202-80f3-c252ac574289", "comment": "Malware payload", "value": "f2542428d096b9520c299aeaaca76861798c39220e526db761ada9f3161b77a06d10edb94e9ae609487a9d61fad3d66f", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347649, "uuid": "3d8297cf-0d56-444a-9028-0fa2e641c272", "value": "T17FB42338112D3CDBCE5356F7AEA42B629CDB85E729B4129001B242658C6FB4AF9F444F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347649, "uuid": "f2299b3c-06e0-4a3f-a22b-1d4e2bdeb8b3", "value": "12288:JMGiNz/PUAg4Nq474U1ue65dRDwdFBg+3oEpVQaoKk:mNzkyqi4UQ7m3BRo5ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347649, "uuid": "6f4a60e2-ac27-4be5-af51-e0281178604a", "value": 500047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347649, "uuid": "3368befa-86e0-4217-99d1-9698e0031ef7", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347649, "uuid": "c9c3ebcd-949d-4979-ba1e-eb6268895f18", "value": "Installer_v2.1.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c6b13b2-61ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696338338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338338, "uuid": "a2cae3ea-5a90-472d-a0ee-dfda02f70afd", "comment": "Malware payload", "value": "80938f2b97904e714002731135a47737", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338338, "uuid": "08dd838d-c9c7-439f-be49-f851a0daa47e", "comment": "Malware payload", "value": "16d0c3a7f9183b4919c27c4ff6a8c88928243354a2e439978f50d44f74441281", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338338, "uuid": "5d5316cb-accc-40b1-a16e-8a719d2b5a8d", "comment": "Malware payload", "value": "f26697f7bbd11b407d4aa753678260002a037778", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338338, "uuid": "73ea17da-9a12-4bc5-8d89-8fdfdc811bad", "comment": "Malware payload", "value": "281f4c9e0261653e46af210f2de8b646d4113a8216a60a3684e551565412c820829aa7c9415ad82ad60c543a9fd21c9f", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338338, "uuid": "2f9f8f22-a06c-4756-9d12-ae90f182cbb1", "value": "T1EBB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338338, "uuid": "502a017c-390c-4626-9f44-c82cdf5f2974", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338338, "uuid": "33c65c28-2468-4d81-9f0a-066557a00005", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338338, "uuid": "925ab0d9-1883-4146-8c78-97919087a339", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338338, "uuid": "97bd4ca1-b659-472e-b198-c3aa904df25a", "value": "AppleApp(54).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "275e337c-61fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696344611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344611, "uuid": "0b64ef4d-7a4f-4a47-8b1e-f9f825f8c7de", "comment": "Malware payload (Mirai)", "value": "f8a4c6b22b5d841d48d6397ecac2b4f8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344611, "uuid": "34a2cc99-05a3-4b64-9a88-d08e69514fe3", "comment": "Malware payload (Mirai)", "value": "17039646612f66fd0d1829e29ac872e029d2a7423ad4d22717327fce9dcf597a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344611, "uuid": "99f2da74-caa2-4c26-b503-fff7b10a1215", "comment": "Malware payload (Mirai)", "value": "59bc1f0746b43498f96a95cc1a2fced375ba34c3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344611, "uuid": "8d67508e-f446-49dd-8916-e516c6a9cb74", "comment": "Malware payload (Mirai)", "value": "e87c2f72034fbc7c21ccf49a0f5b95a596f3919d47683437ddef1f006c3b42ff0af62f58e00c60ef7be969a59a8eb5b5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344611, "uuid": "85dc8d87-e299-410b-8910-85715767042a", "value": "T19DC2E1BC7EFB6F43CE1700356958EE2782B0A5A5D36BB797B24441026C031E6BE26CC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344611, "uuid": "e6927e5a-0c9a-460b-a98e-1cbe8fce415c", "value": "384:MB1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjQyp/:0Mw4DZdFbBy6x3K/KdWnH5ipc0NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344611, "uuid": "d22e3199-efb7-4f99-b5a8-4e71d5f8145d", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344611, "uuid": "be41dd25-97fc-4f8b-ad98-dc49a7e145da", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344611, "uuid": "295cd250-42fd-45d9-b023-424e1f5bf7bc", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7c9a3b-6235-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696369292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369292, "uuid": "070e6d57-87cd-4808-a9b9-ebae1156704d", "comment": "Malware payload", "value": "b34425a6662003be2574c04821ee2f23", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369292, "uuid": "9a764632-6fcd-45ff-a6f5-933371e17072", "comment": "Malware payload", "value": "17924fd5ea0601bedbae36df4920db30e2d059d338e7380e0b14d81b4abe43b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369292, "uuid": "26a4ac7d-f6a2-4060-9c49-57d56fea3b58", "comment": "Malware payload", "value": "15a184732bc8d862b587fa0fde186e6112a242b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369292, "uuid": "8b4d0aea-05c2-434f-9f06-40ca1aa3f16c", "comment": "Malware payload", "value": "ae26510b7f7462d1030ef0e2df1d511d472efa853ffea37ce18e7f046c7a8b26e4bb08fc2c9ed85a8882278621af7d54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696369292, "uuid": "8363ff67-8734-4319-84e7-7bede1a93f07", "value": "T1D265236632F884ABCEB5277034F346471E3B7C666C6587B16281AA2B5C706E2F471337", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696369292, "uuid": "b2da6bac-115c-47a7-9d60-efcddd6aee6f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696369292, "uuid": "30f82d7c-0692-4dc9-8b42-817f89b22728", "value": "24576:5ypn0R1dMUa5K+fIFaISr1wdyXSsY6kKkBslN4bOr1p3xFMezTtQU/2qUb5l2OGI:spW1dWIMIFaISY/s2ilEOr1p37Ia2qU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696369292, "uuid": "14c905bc-02af-4157-8bbb-f6eefea4dc98", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696369292, "uuid": "af89cc86-329e-4de4-930f-b7ac354aef96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696369292, "uuid": "d9f010ab-d408-473f-8b34-97180b7c5cdf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "066dc70c-61d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696329523, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329523, "uuid": "c41e2ded-0d7f-4fdb-99ca-985e471892af", "comment": "Malware payload (AgentTesla)", "value": "cf0b8db72ddb63a0e318dbe90becfb9f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329523, "uuid": "dc0e556c-b4bd-4a65-86b6-d16bc3f177ea", "comment": "Malware payload (AgentTesla)", "value": "18356444df0b7be47aad19c0e811e7a75ef465e9daa785374ee0fda0b1ae3bb5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329523, "uuid": "240fb279-3da6-45b6-923a-6144f287096c", "comment": "Malware payload (AgentTesla)", "value": "2f806b6f35af6b06ae398f788d66cd9430c8b3a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329523, "uuid": "a9861794-ff07-4f0d-99aa-046c4cc0d6f8", "comment": "Malware payload (AgentTesla)", "value": "88571693dcb16f8b5d246db8a0c90ea6b5d106efd2c2d660a09703ba3af49e891037f893bab3d5d7f248b99e2bfff9a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329523, "uuid": "09085df4-6073-41a0-adbf-2a5ce271c865", "value": "T144D26C6266580852ED6B5A3024CACB360D717EEDD8D1C2AE31CAF2164FE230157BD1FE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329523, "uuid": "556bd589-15cb-4432-b0a4-1656f6efe330", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329523, "uuid": "bc35ba56-6da5-456c-babf-67fdd4662a4b", "value": "384:n9VRB0LYbjmjrhlNyb8E9VF6IYiTPxXtFRMORF8tIYiztFRMOywrjTkJ8JN77hhH:R9yjrLEpYiTPxdFPYi5Fqwnd3hT5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696329523, "uuid": "28eea7f2-1ffc-40f6-8df8-369db684cf7e", "value": 29248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696329523, "uuid": "0e914695-af7b-423f-a70a-16b7d0f3cce0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329523, "uuid": "9c3ccd2d-7400-4f52-abed-48426afa6dcf", "value": "SecuriteInfo.com.Trojan.DownloaderNET.290.28806.31273", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216edc0b-61d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696328710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328710, "uuid": "367c014f-423d-4535-b669-9224df2c0675", "comment": "Malware payload (Mirai)", "value": "d7a0a979701d474182721ec1d617989e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328710, "uuid": "75abbc04-7447-41e5-b1b6-b05eb76ff782", "comment": "Malware payload (Mirai)", "value": "18bc10e3a1ab64613a9625867baa741c6c193f27708aa4bf5025756edcf45249", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328710, "uuid": "d30fabdb-e7d3-4420-83fc-3342a1e8c1ce", "comment": "Malware payload (Mirai)", "value": "f19c4fcedbd4dd5371290fb5521aa8475093bd00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328710, "uuid": "3572dfd3-d516-4b04-9f0b-b0f1186831f6", "comment": "Malware payload (Mirai)", "value": "862d3d240ea2484673239217d82f82607e9f1e1d15b7b4d9f8643e64667ca91ad3abb62b747e7433125eea4018fcfc80", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328710, "uuid": "d7bbad46-5fb7-4a05-8452-cf21cb873a5c", "value": "T1A5C2DF40E105CD41EAEB39F52E449BD6BBD02B5B6A76CE912B6053D1AE4C3678306DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328710, "uuid": "65145d02-64b0-4e1e-9934-170a74156070", "value": "768:ZVdafO76jpmNJJKehmA7trpfIX9KeA7PA4uVcqgw0t10tLyQ:xam+AnKehPRa9aY4u+qgw0tYuQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328710, "uuid": "d231e240-5617-43e2-9d22-d4509ecb9c45", "value": 27544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328710, "uuid": "0521c179-fc31-4e6e-8960-8b3bd48c83f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328710, "uuid": "13cf0917-54c1-4b4e-aa92-f72239292086", "value": "d7a0a979701d474182721ec1d617989e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cfb166b-61da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696330205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330205, "uuid": "a0db19fa-d961-42d3-9a16-3a02a8461e1a", "comment": "Malware payload (Mirai)", "value": "518d3882eba7ff2b72f574984ced1467", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330205, "uuid": "d45f5857-527d-4c56-8c96-fda856d12e6b", "comment": "Malware payload (Mirai)", "value": "190fdbfcfad294880a48139bf003eea0841a165ceb80045201ae97a773c6d6d2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330205, "uuid": "671cf0eb-da45-475e-a10a-6b42af80aa12", "comment": "Malware payload (Mirai)", "value": "65c7895ed0359d6816ebf148b4d8b9d0d15d4a57", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330205, "uuid": "55db83e4-21e9-4a26-a8a5-5a56526acde4", "comment": "Malware payload (Mirai)", "value": "2615aef46b678507f13139bc8cab0960627bcf3ac764d086671cdc3795c5387add573e4c7fc6a7ffc19679b5f3273182", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330205, "uuid": "f5acb74b-7091-4b54-bd2a-e859c76cded4", "value": "T14613F1D0DB1E2633D2F40431F5BB079694AA63EDDFEDB9329845AB5438E314E03AC198", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330205, "uuid": "8cd262da-65f7-490b-82cf-b5205e096d2a", "value": "768:9C3sdOmwXCUP0qgEpELCDN4Iq3UIfDWj2C9Udq2I+uxMUabW:A80Oqt1DefSqCezIVMvW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696330205, "uuid": "e98c1edb-44ad-48c6-9032-5bed2c0a2c22", "value": 42804, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696330205, "uuid": "3596a44a-f6f8-4460-ad3c-4f3d56c7561f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330205, "uuid": "b6448a8c-a1d1-40eb-8d2c-37d0bc4e128d", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32b561da-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1696313706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313706, "uuid": "702d4a47-0f4c-472a-947b-6784376cdbac", "comment": "Malware payload (DarkGate)", "value": "35fd17ae7d69d054a19c8037d9d06bec", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313706, "uuid": "7d7794b5-9956-444c-8b10-17c56f179418", "comment": "Malware payload (DarkGate)", "value": "199c04762e7697644f49d7204564def1038cacc8894b23912b0db8e86a30cf0a", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313706, "uuid": "36ec223b-b9e1-459c-a9a6-3f53548971e6", "comment": "Malware payload (DarkGate)", "value": "d72f0b73280858d629e3104ea97493f229db241d", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313706, "uuid": "4681e069-90bf-4ad1-bd06-21317f597ae5", "comment": "Malware payload (DarkGate)", "value": "c4bd5aa6ee58656504eb5c0ee35ac3366ec91a382b7a1adb16ae8f59469db3defda84dcc96828b7122a94fe47569150b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313706, "uuid": "a60838fb-69e4-44ec-a0f1-465ceba07086", "value": "T13141302536DF8B29D6B1093B98637330C677BC66E536871D03D09C8C7944200EC65F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313706, "uuid": "aefc2660-4d26-4d2a-97de-807f09fbf6e2", "value": "24:8agWJCnScMtQOvA8tQN+K+/fClmU4i85/zc:8aumt8+Q48s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313706, "uuid": "71da0c4f-4909-4c3a-90b4-bf3cc29b6da6", "value": 2056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313706, "uuid": "3684570c-4d68-4c52-ab3b-763728a2a814", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313706, "uuid": "fa092feb-4513-4d4a-ade4-db9e3f3255a2", "value": "XC.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93b1705-61c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696320428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320428, "uuid": "d9dbb32f-9208-477e-9bb9-82bf3b590a8d", "comment": "Malware payload (Gozi)", "value": "abdc3673431fa20e3151acb069be0c42", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320428, "uuid": "3725fc68-f107-46ea-a44a-8887acebdb75", "comment": "Malware payload (Gozi)", "value": "1a7081393c8f81e484b734028f2ba86cee7f3213fc230be5af38b6e83541892d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320428, "uuid": "68408eb4-4501-4e9a-b401-0529b073388e", "comment": "Malware payload (Gozi)", "value": "6eea5c3d13393a7438530dfb0e5a59cc3b7efa15", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320428, "uuid": "41c70409-056d-4cd4-913d-e6579b848a04", "comment": "Malware payload (Gozi)", "value": "9b5862fc58cb7d9e9f18484d7fb1182c8a981d22249b7af9bc0fc82b9113cde189794eae4480da7be9a0fd95ecc0c82c", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320428, "uuid": "4d22cee5-cdae-486d-b11c-a3387e1c9f85", "value": "T1DBF36B0873C1A4B1D6BF69372864DBF25A3CFD245B20699F7788D53A0E112924E3C9B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320428, "uuid": "ae1c113f-1042-4d2e-a0e0-0d9f4437367c", "value": "b708bc91029a5428d40eddd35d2240ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320428, "uuid": "b9784623-a54d-44cc-9334-782862c36d3b", "value": "3072:c+88I635m7NiIrYKWSz3yTah7fEvbnK4l9TMqO8QfCkLazp:G8hKNicYSQnKQsrDLazp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696320428, "uuid": "aa1d2370-ba63-4edf-84cd-4cf0ef091b54", "value": 158720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696320428, "uuid": "2d3fbcfb-b1f7-4946-9c6f-a2587f2d7621", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320428, "uuid": "0b41c9bb-3b9b-4a9f-9a6e-8c8966e9998c", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970fde00-61dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1696331484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331484, "uuid": "9514a950-fcfb-41b7-afd6-b5aa132bd011", "comment": "Malware payload (Gafgyt)", "value": "6a3545c197b9cc66f8b1e790403e656a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331484, "uuid": "a56a9ee1-f7f4-4a97-bb5b-40d333452fd1", "comment": "Malware payload (Gafgyt)", "value": "1a8967a85e947eebcbed3ca1d0b7f93e4fd1234bf844e64df7b55d36d7e1c94d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331484, "uuid": "88fd1e74-5edd-466d-a729-773bd5c8326a", "comment": "Malware payload (Gafgyt)", "value": "a89c5a411c274bd8fe3565e89e606efcb0f8e367", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331484, "uuid": "ff268184-8be2-41be-88c2-ed98766e5677", "comment": "Malware payload (Gafgyt)", "value": "fc512fd6736ff985f23dcca4e4993bb2fc6a26ef949f8a5f0f89bc53e1d83bc0990f7ab455a3efbae1c43802d3edc363", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331484, "uuid": "a95068e7-2f49-4173-9f06-9f90503c15a2", "value": "T176B31813B7B1DABEC08252B12BDB92F19423FD7D0732622B33957DA51B388D96D59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331484, "uuid": "f124dabc-a496-4c9b-a38f-e31945f80ddf", "value": "3072:Ld0wlSAewzi+Xn+8Uhw6W+aP2JmDk1c8xF6KjW:jfO8IB3JmDk1c8xF6KjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331484, "uuid": "2ff5a848-7fca-40b7-83b1-e40e3a0b63e7", "value": 114825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331484, "uuid": "d5f5c323-e743-4e12-ba04-76adca393134", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331484, "uuid": "7b98d6a4-6395-4f33-b0e8-56777183e85f", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ecd00fa-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1696357159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357159, "uuid": "5f5f8e9e-3548-4dc1-81d6-345d1152dd24", "comment": "Malware payload (AZORult)", "value": "d519d134fceb77196de17d26c25b921a", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357159, "uuid": "a8e4790e-ddaa-4c3d-859a-abbebd82615d", "comment": "Malware payload (AZORult)", "value": "1becd6b6658eaadf19e7af46b1994af7b86e78e9c5c2443b865e9f426684d5fe", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357159, "uuid": "a7b42bbc-6fc8-4a96-ab21-0e1c6d55d238", "comment": "Malware payload (AZORult)", "value": "d05b072892bfa30983d95d83cc15c9eb34f58586", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357159, "uuid": "a62d4528-84f8-47f0-bca9-69aeb306e4ac", "comment": "Malware payload (AZORult)", "value": "b54995e6743ca99bf5fbc87c1afa9aa1a85ea7ad16a7b90013f02f241e280a4d842d0fcb587438d5a4587ff24c1fbb18", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357159, "uuid": "7b2790cd-338b-435a-a139-3bfb1601c1b4", "value": "T1043512037AA4C527D7D917394805E77D6987BE64AC00C95E36A0BE6F39F2322590E3EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357159, "uuid": "0469584f-8c5e-4b28-a50d-1b5627e91e1f", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357159, "uuid": "b5f930e3-c90f-4aee-9d61-f238978accd8", "value": "24576:LN9+kioQ75q7aBmoAL0IoIs2DEV0X1z+At4Yw6ZbW3:LN9+kijqaAL0ULg+X1z+K4br", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357159, "uuid": "3e3bee0b-421f-43ca-b963-5242cee842d4", "value": 1086756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357159, "uuid": "7951dee9-6306-428f-8b18-81c4b59e7c82", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357159, "uuid": "aa2385fd-9679-453c-a381-292e3b93bc18", "value": "YP61700IK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbc5f40-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696336592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336592, "uuid": "d3b78a0f-8929-49de-bd75-604da2ab8ebe", "comment": "Malware payload", "value": "1d5712a6d40cf090cd1b88ae462d5fe3", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336592, "uuid": "9e963650-2f89-4161-a381-55cbe225e6f0", "comment": "Malware payload", "value": "1bf28b4dadc5127f3a84f05a0304499cdae5c6ccf37d2cec2ca726af7a3a8bcb", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336592, "uuid": "734eb928-8c38-4fef-9be4-ec3ad6a06383", "comment": "Malware payload", "value": "6acea8686bf429ce68c2b35701c6b6830301a4e8", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336592, "uuid": "9bb51640-b983-4854-97de-e445d4b26be2", "comment": "Malware payload", "value": "81828ab302689c57c23e52b20b3a4b8406ade91ac0dfd227fd423321eb5182a03aa9daa7dc3578bed3926265c2309772", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336592, "uuid": "9faf7a3e-8507-46cb-810e-8d7ca6ea5ec0", "value": "T1B7B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336592, "uuid": "5ae74866-8864-461c-85ac-a83f684e8048", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336592, "uuid": "e3ca945c-42f8-4de8-a44e-23dc7fe6b894", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336592, "uuid": "75c1e0f7-b9bd-4400-bf7a-e8056f9c53c3", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336592, "uuid": "e3c20b21-6d08-4c33-8935-b22fb84e06b0", "value": "AppleApp(2).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5566c7c9-61a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696306034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306034, "uuid": "9fa57b00-af77-4e1b-9b9f-891a7240dbe1", "comment": "Malware payload", "value": "6c075a18642bc3723d26593ab670489c", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306034, "uuid": "e22187df-94c2-40a7-9157-7d23f8083915", "comment": "Malware payload", "value": "1c17b33a9c1a0d572ad50288e3c3733c263c7aec2a900339232fd5acb0ffd215", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306034, "uuid": "fd6472df-430e-4b66-9f6d-b9a7a7296530", "comment": "Malware payload", "value": "c5c1d9712375366c72f9bd379b9fa7fe9ace3f1f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306034, "uuid": "331ca500-f3ca-41a8-8fff-08b65c7154a9", "comment": "Malware payload", "value": "47632845070d2b9e11c62e62207f50cf1c3bce10b61f665a959e74e6cb57d52ff8fb9a08c1606c4fbebd0ea7dcbbd9d9", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306034, "uuid": "3604b8ff-3eff-4c35-a387-9feeda4c808b", "value": "T146E07DC9A70B2CE0C4399EF561939310F537AC0264FBE0878918B91D5D8DB921F1C105", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306034, "uuid": "acf2b2e9-4c80-42ad-999e-14be947362f5", "value": "6:5j91vltU/zuPI17CHRYO1p3p9shbbA460jx6tUn+S01vltUTS/OIFFu+lWn:5jLEqPIhCxb1p59shoSct+wYS/OlaW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696306034, "uuid": "1aba6b84-f850-4099-92f6-8cb1ad5ba75b", "value": 334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696306034, "uuid": "297cfa62-3742-4986-9116-cbf8b6ab9e37", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306034, "uuid": "17e84abc-cde8-4dff-8ec1-5f364c277dc5", "value": "Cliente159.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f54cfc2-61d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696328062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328062, "uuid": "02da1c66-aedd-41af-8958-06b72eca1508", "comment": "Malware payload (AgentTesla)", "value": "aa3affc5655ab2932737a7b683006a0f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328062, "uuid": "e4dfacd0-6c53-4df6-bd53-824842ab49ab", "comment": "Malware payload (AgentTesla)", "value": "1c185d2d15672d64224c127fb562f550bd93d7b454c6363ca8e37766f4d35523", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328062, "uuid": "c24437d8-59dc-41f7-805a-7043f9094de7", "comment": "Malware payload (AgentTesla)", "value": "8af3eac34cbc1aa343b2527f83659b4f6c6fcf3b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328062, "uuid": "e83e5311-7ec6-4f9a-9300-e366e4c71105", "comment": "Malware payload (AgentTesla)", "value": "d95b11c9853d9d9cb2d21a9a2b7d1c81df94d4c1453316015e2066d0efd9541d90c4972f73d827c3ec6457574e510b53", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328062, "uuid": "97e66a8f-617d-45a5-8b77-db46993cf161", "value": "T1D045120976BA5F20D6386FFB11B0149527B5BA261E30E74E3D8C31FE6B21B581E19B13", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328062, "uuid": "ada98987-e080-4fcb-abbb-9dda0c7469af", "value": "12288:zCiSAx5PWPQhxHeqfiEPKwPe6Jd+AWQdmZBvGx5m/oQmwlW:zC7Ax5uPKfSwPeu3WgmZGucw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328062, "uuid": "5d0e3552-4c69-43bd-b431-64c203537908", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328062, "uuid": "6f0f4cd7-777d-493e-b8aa-5045b83d8646", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328062, "uuid": "2c0763e6-026a-4155-b4f4-c7f43c53df9f", "value": "USD $100,010,00.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4053f7bb-61f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342076, "uuid": "23b75141-10c2-4c9a-9e8f-b975c2698595", "comment": "Malware payload", "value": "f712c79978e4b11c419b30eb947010bd", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342076, "uuid": "1b63be78-fa09-4edd-a436-9623aca061da", "comment": "Malware payload", "value": "1c893b790be99f52c40544810d126f2f7610fe5fc0d38336dc3d6156e311a7b5", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342076, "uuid": "f3ad8fd2-50e3-4766-8ac0-8dce85364dcc", "comment": "Malware payload", "value": "778c5cfa92de5a55a0d281717b4e49a00b89a004", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342076, "uuid": "61301362-d3d5-4836-b3e7-a338aa488de1", "comment": "Malware payload", "value": "90a5269d1db31767327e5d350f486ed1e1e33214f3e7f3e76bd57181c4114d8dd2456759d15645168a22de82bab81444", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342076, "uuid": "90476645-9b53-4e92-aefb-44e7a25334e4", "value": "T1CAB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342076, "uuid": "7eae1b7a-ce5e-4547-a1ac-9c61e767d589", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342076, "uuid": "5353efbd-0b4e-42dd-b099-cff0f1797af8", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342076, "uuid": "bbc6e861-94ab-4bee-8cf9-3ccc06be82e1", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342076, "uuid": "a3a4a23c-58db-4df6-b37c-7276a34e9605", "value": "AppleApp(37).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3601a4e4-6217-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696356232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356232, "uuid": "0dfc5c15-c0d2-4e00-a90b-b122ab4c1bd6", "comment": "Malware payload (GuLoader)", "value": "287e9146727eaa39b1cb4c11e4d80b2c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356232, "uuid": "c9d3d7e9-1e81-432f-8d8b-12fb72eb59e0", "comment": "Malware payload (GuLoader)", "value": "1cf360c97ea6bddb69594b1cbd4d3e7272a50ad258cc8d47fff0fff9836baf18", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356232, "uuid": "82f9dfef-c616-4ab5-868f-804d3a0dbc88", "comment": "Malware payload (GuLoader)", "value": "0c45c9a1b8300943e938766bb8f5de7abc53a377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356232, "uuid": "9d52933e-358e-45eb-9f79-7c6556966845", "comment": "Malware payload (GuLoader)", "value": "7010543edbe3251e592265eb7673faeddb27d52bd1070345ad3782dd5323e5a950b301cb7cbc4b13b227c0a6277c2377", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356232, "uuid": "abddc1ed-9967-47dc-887f-fc9f27d347ef", "value": "T1E3E412012F8AD997EBB00A7009F3A75AC76D9E755C8126C3BF543BB434F2995DA0B213", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356232, "uuid": "b23f03cb-70c5-49b9-8bd5-a86e297c98d7", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356232, "uuid": "30e30204-3ec6-4d11-83df-7dbbe01fc4c4", "value": "12288:FuLXNdSTBky+ozlCuAsu9pIf6cZp4sVdOwEKeW1J1Hn:Fu7NdeT+ACLtS6wGsVLEKdN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356232, "uuid": "957ecd3c-8a91-4244-b090-321d8e9543a4", "value": 663324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356232, "uuid": "0918f138-707f-4d5f-be7f-3d01cd05cd35", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356232, "uuid": "fc12cac8-8f33-4ab0-9d9a-41b634d31ecf", "value": "Project Abu Dhabi P2 approved Order - 10 Lots.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be9a41de-61b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696316088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316088, "uuid": "b8e9c120-ca13-4f12-9c55-25ac5f164d1a", "comment": "Malware payload", "value": "f34b1e1e6578431e7fa9ff70d9be3b48", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316088, "uuid": "3cc475c1-ed77-4496-8ece-cc8eade95750", "comment": "Malware payload", "value": "1d045b290f325e18afb0e8d819ff6e479ac1fd26b05322e9b7fc3dd39ae2c9d2", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316088, "uuid": "a6d374e6-244e-405f-8c57-63926a923acb", "comment": "Malware payload", "value": "00b9223ecce717fda13d2c39cbe2b9100b561a53", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316088, "uuid": "6de5a7e8-6895-442c-b8a1-0b7676b14f30", "comment": "Malware payload", "value": "072a818e397331118aedb7f5445776f9c7b356975f87ace4aa5bab135df9bd0187ab46ad46397a1486e312367c977be5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316088, "uuid": "5ec86b8f-1f79-4fed-a1b3-a86cf0ddadf3", "value": "T128E18D40CBA554E882F292BACD236D82B3256759485E997C98F7058105E62CADF2E4B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316088, "uuid": "414eedcb-233b-4240-b2d2-556f170ce13a", "value": "96:cuEvlrnKWDBUR8ITEnM8/rx3eBVb1O3U8K7FdAflMeDT1xO1NM6hkbQCTKBIc0pN:xEvJnBUR8mjOx7e7/AflXT4nhR502Nil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316088, "uuid": "956a7a49-e6b8-4eaf-99f2-c82720ed1749", "value": 7386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316088, "uuid": "9a95601a-8b82-4a47-890c-a43fbc503ea0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316088, "uuid": "5d90a5ad-5bd5-4923-8084-087f9c928d48", "value": "Verification.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79e413bb-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696313396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313396, "uuid": "9c2f87a4-80f6-4e7a-8649-773dfcc3a4a7", "comment": "Malware payload", "value": "66bd2064e933a06c4af53c4347c8de9e", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313396, "uuid": "5d430196-2001-4b1a-a47d-28327a567edf", "comment": "Malware payload", "value": "1eb2d10deb038b86eaaadece40a705184b6f8ed3a24cb1f0804a1e556923e45c", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313396, "uuid": "371a2a74-6fab-4a4e-b8f8-0c8f48f8181d", "comment": "Malware payload", "value": "f8d79bb57a9d26cc95c7401f6ca962cdf59a0034", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313396, "uuid": "c431e45a-e3fb-44ec-a201-7862dc6d0f9a", "comment": "Malware payload", "value": "aa4f93ffb57a3f21e123ec697f46dd05318098a1769217516d58ac53e5a84361c6e9a10bb3011929c7bca690f637fa6f", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313396, "uuid": "d5780209-978e-42e7-809a-8ba4c0edcf58", "value": "T17A940219F052D91BCC636074CCDAB4DBC229EC9C1F59A74F71C9774F82327B29216A8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313396, "uuid": "7bfb98e3-992a-413d-af3a-7f419333a9da", "value": "12288:JFesxot3VtvejSD/WtH3JYqFxM8Am+ROYJUK:JFes2XwWD/WhZYkrA1OYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313396, "uuid": "677e09a6-fa7d-4bf4-ab0e-2d5fa874f783", "value": 425984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313396, "uuid": "af6bec1e-f6a5-4684-8757-9da47c4103e8", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313396, "uuid": "e5c67421-1bb1-4672-804a-f9c5a591d56e", "value": "Part number 91875-11400 x 6.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1881b90c-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696313662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313662, "uuid": "71318840-480e-4858-8ab4-09935b05d54b", "comment": "Malware payload (AgentTesla)", "value": "0862063639dc97750daf15585294be78", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313662, "uuid": "aed4e21a-ea49-48b5-9f28-9615567bc0ce", "comment": "Malware payload (AgentTesla)", "value": "1f82382ba93d0f863daa178a4972db5fe3405c97a97b5f78676314cd67d2dfa9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313662, "uuid": "e35d1602-3041-4689-8697-180f06a49a7a", "comment": "Malware payload (AgentTesla)", "value": "76c85bb45b04887bff19a071bbf98bc550099dee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313662, "uuid": "e096d6f7-de07-46ba-9786-aaa2a4e57648", "comment": "Malware payload (AgentTesla)", "value": "486a5af3c4eef15f2c4daad66fe6966338a1eea102f46390ad1bfe254c28f916af573cdfaf42bbf2157f5cb0a2f00eaa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313662, "uuid": "59eeb3cd-7334-4a1d-841d-83f2bf8a2638", "value": "T1D0747F2036EB644CF1737F622BD9BAE94F6FF7E21626906D2504030B8762D84CE96771", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313662, "uuid": "a5a08e3c-75b8-4d9a-8ce8-7a2c8e39b0d1", "value": "6144:mifwFMZFFFFF9FFFFFoXJFFFFFoFFFFF5FFFFF3FFFFFYiFFFFFbFFrnFFFFFiK2:mifwFMZFFFFF9FFFFFoXJFFFFFoFFFFe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313662, "uuid": "b1eaf088-dbeb-4a23-bac0-6e2ddc4dc172", "value": 353814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313662, "uuid": "aa2770a1-bac6-4d17-8e34-e7c84e9f1fa6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313662, "uuid": "4d8c3a2a-6e69-41ce-ba3b-714bcc0178e2", "value": "Segundo comprobante de pago.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "814d4129-6181-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291934, "uuid": "90a6035e-f6fd-4397-80f4-f0518138c525", "comment": "Malware payload (Mirai)", "value": "a92b2073221bb3699c0caabbd11dd689", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291934, "uuid": "3feb47ef-0226-45f4-a45d-edbd2c4831d5", "comment": "Malware payload (Mirai)", "value": "20c4e8cc5f001c03a2cae36b177e9ba05f7b719e95a0eaa74f28c69383d0d710", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291934, "uuid": "a0fd46aa-e05f-4f1b-9e78-e4b7df092180", "comment": "Malware payload (Mirai)", "value": "48da6e4f9209927b3db896b34662473644600873", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291934, "uuid": "15e4c063-37af-4324-8cfd-b1a14644dc57", "comment": "Malware payload (Mirai)", "value": "83fefc4c03871c77cf548610602d5d235cee25232147516b4e4f873f2e3e287a0e5c279d5bd0fb1d8e15d6c065b81615", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291934, "uuid": "cc3b8e3b-fcf7-465c-9c79-ade09eec3682", "value": "T19CC2D144F0018E42DFEA29F02D54D6D7BBE06F5EAA628E8162E053C25B5C3B74305DCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291934, "uuid": "0d68938c-4819-411c-96e3-4541e86e27fc", "value": "768:IVdafO76jpmNJJKehmA7trpfIX9KeA7PpLL4uVcqgw09f:4am+AnKehPRa9a54u+qgw09f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291934, "uuid": "abd3f940-f667-4537-86bc-f31be8d2ceff", "value": 27048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291934, "uuid": "41085f24-3cb2-42fc-b023-f85cab16cd27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291934, "uuid": "9753e553-7c09-4023-8405-06bba23392e1", "value": "a92b2073221bb3699c0caabbd11dd689", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86ac684f-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696340905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340905, "uuid": "73e45dba-75b9-412e-ba89-e016a2b8c15a", "comment": "Malware payload (GuLoader)", "value": "7ee8e44f987bc2ad1d3fa2c503a9df78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340905, "uuid": "fd13d447-1eb2-4bb1-9b1f-8533af25c3f4", "comment": "Malware payload (GuLoader)", "value": "2123ed455056e9b004781b40a5210e0b9d10bac6fbc49ce063b2b9209eeb508b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340905, "uuid": "bcfe8390-11ae-4701-a387-344cbe590c70", "comment": "Malware payload (GuLoader)", "value": "562b5ee014ef34c4bd680eb4e6575d7db0356ea6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340905, "uuid": "001f41c7-82ad-41ce-8b4a-2ed54898ca5c", "comment": "Malware payload (GuLoader)", "value": "7c178b6959102b29057edb67f2f631ecb6e35d816cce991057990d51eddaafe3511f8f4a33611bd7f8f62748bf5fb639", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340905, "uuid": "a28f75c7-7dfc-4e36-bfe1-1312a7422f1f", "value": "T1C21523A06AE0C8E7C7AB923086C7A60DEEF5EE20662793474F153E5CF9675C197162C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340905, "uuid": "5fe5a0a2-9dd5-454c-9c17-0297bb15f8f9", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340905, "uuid": "d2c9b5ae-fef7-4fd3-9ab0-eaf903c3074e", "value": "24576:INPx3TpsT/mdxmZleZJNELjz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTLx8levNELjz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340905, "uuid": "9fe141ae-876c-410c-b71e-d7e678be9470", "value": 875142, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340905, "uuid": "5828ccbb-995b-4dd6-92ed-68f4ef5473e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340905, "uuid": "6547cb64-93e4-4314-89ad-674c435bd0f2", "value": "Filippic.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b43bef3d-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346136, "uuid": "0a6a7b3f-9eab-44be-9755-a36a99577d73", "comment": "Malware payload", "value": "84e91fb501fa8c89a6adb2f2a6fc1a8c", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346136, "uuid": "95e48f71-2d35-4ae8-9671-d854d2c12a40", "comment": "Malware payload", "value": "21a74cb336ec2fc095db4cb30b8062b93020b7940bdabe2c76457ddc3658d483", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346136, "uuid": "0e03a502-7b4a-4baa-8bf1-47a6b49a1f38", "comment": "Malware payload", "value": "18c407b01c24237fe3ee23cde87cef834a352936", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346136, "uuid": "ed8a34b4-282c-40d4-8f73-ed83c517f6b4", "comment": "Malware payload", "value": "9b3c5162098abb91385f640f1b7342931a8b27cff93e6d17195197ddc0cd256dcbe83e0b8bd4637b94f5c83fd11c8305", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346136, "uuid": "f5bc9e27-5fc1-4edd-bd5c-8d147d8a7b42", "value": "T101B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346136, "uuid": "fd1380b1-59ee-4eb1-9b15-97c4e3971f2a", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346136, "uuid": "4ffb923d-fb62-4ad6-b9f5-ab61c3f06bec", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346136, "uuid": "e0267735-2869-4413-967f-b259e8940400", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346136, "uuid": "05c4e0bb-f53d-43d3-9a67-85ce164de555", "value": "AppleApp(171).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4433566c-61e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696335640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335640, "uuid": "87ee82b1-8bc4-4fb9-a579-11e21ad8eb70", "comment": "Malware payload (AgentTesla)", "value": "0acfb6a7921a83da8199e1a8f8a8df0a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335640, "uuid": "56b533a2-35e8-481d-a6a3-7de2b127ca3e", "comment": "Malware payload (AgentTesla)", "value": "21ecb947da227991e6b37822febbce8f12cecd9295f4a484b4cfa01248cdd492", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335640, "uuid": "4e980c3c-cfdc-4dd5-b410-438d41163dbb", "comment": "Malware payload (AgentTesla)", "value": "b85602cf2a8bab909ed9a38b35c56f1e989b7ed4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335640, "uuid": "41eb23f9-1a9e-4970-9b0f-59ffad5f37c9", "comment": "Malware payload (AgentTesla)", "value": "75d388d40350d30e3529db29e06f39326777b0145777f2e04d0864fb8b37dda6818345e3cd60286f1ae8dae76a767fba", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335640, "uuid": "b06ea2ea-ce0e-46dc-8308-f33595a2747d", "value": "T112D43350F17E535EBB863A726B6264900B71769A30633BEF9D33D6BB841861F3813352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335640, "uuid": "4cfb6226-b484-4b45-95e1-f50d6127a737", "value": "12288:pzP6GiqlFJvFeHXf9YU3XyuBHn2mqsEpIetllw/XwNckB6:pwqlFJtAXfacHn2mqsELmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696335640, "uuid": "51ad3249-7088-42f4-a4db-367d590dec1a", "value": 645266, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696335640, "uuid": "d834475b-b446-42bc-a650-baa73d018fd7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335640, "uuid": "a094191c-8b42-48a3-b352-5ebcd348e74d", "value": "Orden Roch-CVE6422-TVOP.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2b6d60-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1696313672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313672, "uuid": "b33fe1e2-e1b8-4156-8c1e-44c3d81efa38", "comment": "Malware payload (SnakeKeylogger)", "value": "2c260000648353220da2b3c5d82ac53e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313672, "uuid": "fcbd6f0b-be6e-4fce-b489-90a4730f085b", "comment": "Malware payload (SnakeKeylogger)", "value": "2259a3953f2af44474abc16d87d444b1776487e5a51dc11f7f49c1e04df68c23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313672, "uuid": "5a0e4d3a-0301-40ea-843f-d676fdb39445", "comment": "Malware payload (SnakeKeylogger)", "value": "f1833907ce38f01d3090a44fba6a98a1eaa67961", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313672, "uuid": "9f8747ef-3d5b-4881-a7c9-97480e5d837b", "comment": "Malware payload (SnakeKeylogger)", "value": "d9e785e1392afaaa60c32b8505813434dfbdef10ab4821c83ca8ff63821ca7f5230d1301c3f3bbd90efbaad20e9f5576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313672, "uuid": "ca2b5556-5bdb-4bcf-bb5c-488d965762a0", "value": "T1A1C4010132AD2B2BEA76A7F81935002007F8BA2E2472F3585DC674EF5962F118F55F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313672, "uuid": "e589d93d-e511-420f-ba02-5b2a6d7752cd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313672, "uuid": "54c32076-796e-49e6-9b00-93f4fc8e8277", "value": "12288:bneFQNumB0rIbFwaaiqlaITf4DmgDhQSGpJZrTwojI6:afy6IbNITHgDab1jI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313672, "uuid": "23989c49-b942-432e-93ff-462371aa8938", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313672, "uuid": "f0a8de7d-cd6b-43be-9647-fec885a992f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313672, "uuid": "eef1e9d7-bc12-4651-8fd0-a16e95a9bc0e", "value": "Notificaci\u00f3n-AEAT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c5256f-6237-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696370130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696370130, "uuid": "50de7e8c-a8e3-49ed-b964-86e38ea09cb9", "comment": "Malware payload (Smoke Loader)", "value": "e9cdfc96ab896b8ea343d335690ce69f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696370130, "uuid": "29a1ac21-6f7d-4672-a635-3133f1db8ffd", "comment": "Malware payload (Smoke Loader)", "value": "225e87f4a47b380ad07553d8fcea19bc8a686ea6be15a07a54677e2b067ead09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696370130, "uuid": "d44209a1-a10b-441e-959b-c10569d45245", "comment": "Malware payload (Smoke Loader)", "value": "04504c3bd59fb5f5e56146bcf7e71d7cfddeddc5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696370130, "uuid": "34903072-384c-4e7d-8197-dd577337334c", "comment": "Malware payload (Smoke Loader)", "value": "6cd02833b98964b872174bb465c7cfc9964574de52430f5e3b482489c591281a0c5bfe8dc26769ad3f6fe29a36506ac2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696370130, "uuid": "7447907c-4ba3-4a3a-8511-4ae84aeb8725", "value": "T166549E1272A1EC32E5724A318D39C6E53B1FFCA19E69579B33583F2F58701E19662B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696370130, "uuid": "c8b908e4-0054-4ee1-98b5-10657ae3a3a5", "value": "75b76fec2d6c17598f5493b9f58c5f6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696370130, "uuid": "27efb5fe-7566-4d47-8d44-44da48ea5d87", "value": "3072:A6rCtruUWRPK9OOYhL1/EPp2u9cpER6geU5EuWuW55aY:drCFulRPKW/Wn9UERxFEuWT7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696370130, "uuid": "5aebc57e-06df-4e3f-9fbc-5e49c660bfa0", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696370130, "uuid": "3d488b76-ef10-42db-8a03-7d765c378246", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696370130, "uuid": "ed19904b-fd32-4d13-a2d6-b86594febf98", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27dfbcbb-61eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696337310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337310, "uuid": "bd714311-33d1-4ecb-8a68-4f7ec14d477f", "comment": "Malware payload (Amadey)", "value": "bbacde1c1d68325516dada17bce0a48e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337310, "uuid": "dd1c8668-dda1-4f8f-9ebb-335899e7cd9a", "comment": "Malware payload (Amadey)", "value": "22a0c25c93391a9c45aa6c541a90321928c946915a53f4084c2fa01722dc04d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337310, "uuid": "88a3b637-ca4f-442f-82ad-7981895860ff", "comment": "Malware payload (Amadey)", "value": "7504c5ad612becfc9af5c65b18ee368b3653315e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337310, "uuid": "64972477-7e1b-4bf6-a722-5854ede0a026", "comment": "Malware payload (Amadey)", "value": "90bcbec4d2d08dc73c697b70c5fb742c973a10b453813b014b1d0eb99c495941ef1103a541a0523cbce9d37019e1a725", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337310, "uuid": "08b9c820-308d-4edf-9457-590e54199906", "value": "T18B936C1030D2C471D57E55351878EAB68B3DB914CFE08EEF27551A7A8E702D1AE32E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337310, "uuid": "ca005985-6417-41cc-8f08-d59975c28675", "value": "52982bbab8b9d5eafbb4ec438626f86a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337310, "uuid": "a334f1b1-ec64-4df7-a93b-61cf33b30534", "value": "1536:8uON8V8ybtiqY2bpxLW9woUsScAbcauNhV2ZszsWuKcdJUXaI89p:8uhVZbtvbpxLHoUsYuNhV25LJUXaI89p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696337310, "uuid": "a559339b-ec9d-414d-bc74-e105ec4465f7", "value": 91136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696337310, "uuid": "dda724ff-7fa8-4353-934a-d5e9fda2179f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337310, "uuid": "a41cca8d-f56e-4b16-a15c-3323b3b0d61a", "value": "bbacde1c1d68325516dada17bce0a48e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe49cb7-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344357, "uuid": "30094a2a-5f17-4600-873c-7b911661a169", "comment": "Malware payload", "value": "d8277c1f2085a3502bdf2a6cdb98236b", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344357, "uuid": "a9674061-c6c6-43f9-8ed4-193e9c4a4af3", "comment": "Malware payload", "value": "22eb159b8294163c0d146b1e34d8627ecb55438323aae68a4c4c0026b0eed037", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344357, "uuid": "f7100334-e720-4f8a-a178-79ce6d1ae816", "comment": "Malware payload", "value": "9ab61ee0cc0d6d19d8f34839254273b10b1ac551", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344357, "uuid": "499420a9-58f7-444d-9837-6d44781134d7", "comment": "Malware payload", "value": "05e511f232269180660a384ad1b3cd7e56d07870a688f98de2390adfd01dd4bf2c75ce8e1e904f89d567a52586ed6364", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344357, "uuid": "743ac15d-1e86-4eab-90dd-231e91bd8a23", "value": "T15CB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344357, "uuid": "042af10d-e14c-4853-b999-0772c1dafa87", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344357, "uuid": "99c90ed6-841c-4495-87e9-ba8e6d1dd405", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344357, "uuid": "d0f11b79-8660-418c-908f-50f4be107378", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344357, "uuid": "872bd676-66e6-429b-b0be-fa19c068ef5f", "value": "AppleApp(110).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62908ba9-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696357166, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357166, "uuid": "d3a48979-46fe-4165-a601-dd2f973cee96", "comment": "Malware payload (Formbook)", "value": "35599ac3f8df437058d6d0e7084f922e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357166, "uuid": "5f9db2aa-6194-455b-9737-96e3c6e46c5b", "comment": "Malware payload (Formbook)", "value": "247c8156cf06c5d9dec7d5fa0b158339110b556d41b0750bff34d36086554746", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357166, "uuid": "03cd6870-3bc2-453b-ba17-4f029bae4380", "comment": "Malware payload (Formbook)", "value": "1e08c5abfc99669c1980fd0acc0dff1eeea9c10c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357166, "uuid": "6499f468-655c-446a-829b-c2ead5c07700", "comment": "Malware payload (Formbook)", "value": "59eced782907e68b3052fd2c27a7bbb7d926dcff5524adb35c464808a00fb1213f0fc33bf101b7bd7ff47e7b589c1f9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357166, "uuid": "a50778c9-f896-4a7c-94aa-d713c9545c94", "value": "T13D7413E24794E0B3D4A243329D3B7AE546FA191E1EF0074F2398D70ABD358C6A52E753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357166, "uuid": "fd172c95-2def-421f-b77f-0d5bde0de2aa", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357166, "uuid": "fc697d95-e4d7-4fff-a58c-9a48a0684c7d", "value": "6144:BnPdudwDsLyYsVNvyPRZI7MW4YaO8PzultSd69LG9+z9QVBpVIDgOigWU3QSrSl1:BnPdw+1NvyPXI7haZzufM7+JwNIDNiVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357166, "uuid": "f6deae38-743a-4950-abb3-34ec8a670022", "value": 344902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357166, "uuid": "772901e3-91b1-4952-bb88-d06541429b2d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357166, "uuid": "8aec4241-eebd-4e67-95ea-c0fa04377fd3", "value": "Dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "032612d7-6206-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696348845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348845, "uuid": "b42d6772-8dc8-4fba-a28c-65d301474e33", "comment": "Malware payload", "value": "d636ef6d8aad1d7bd04f0cb8b19ba26d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348845, "uuid": "68f90d63-17bc-4415-993e-16466d5e1399", "comment": "Malware payload", "value": "253f77fb5a41cc96f4cd38f7dc12c9c258a942c88c167b83757b36b62c08600b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348845, "uuid": "6228b3ae-903d-4c46-a3a6-a8dbbc10d263", "comment": "Malware payload", "value": "cbcfab813031e73d73dcede7ca6a4ea814b3ddb9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348845, "uuid": "817654ff-93dc-45d6-bb6a-9ee821e38f57", "comment": "Malware payload", "value": "8b1cfde33e16ee12cf15a7e6a1b2d90aa7eaf387af450ceeefb78f59c38a77adf9be3e03c410d1ccc2fa68c8735dac1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348845, "uuid": "26351778-f4b5-4262-bb1a-f96508738fae", "value": "T1F654AF0376E0BC31D4764A316D29C6E53A2FFCA19E6953DB33583F2B59701E19A62B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348845, "uuid": "092ec2aa-4cf0-4596-8927-57ecba448461", "value": "775c7d434cffd499e537a34db4132a29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348845, "uuid": "f189a0ba-a092-4ca3-afdd-3b75c4e41b2b", "value": "3072:CqDqLSvvb5ayNvZUzk3UXzgYr2mK/yDDxYMWY:rDqmvj5ayNxUziWt2mK/yDN3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696348845, "uuid": "27b1ec51-5a7e-47e6-ade0-7f364e9a9925", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696348845, "uuid": "6bfa72ad-bdb5-4b0d-9a2a-90cb259d2721", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348845, "uuid": "1c2a3e25-1dcc-4a7a-a234-bd9f06dc0377", "value": "d636ef6d8aad1d7bd04f0cb8b19ba26d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff99af8-6197-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696301407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301407, "uuid": "56a06642-8c81-4beb-8ffb-a5bd729cb4cb", "comment": "Malware payload (Mirai)", "value": "da6bc4570f9b001acf21d2ed071437f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301407, "uuid": "b581354e-197a-4b9c-92ce-ba58b955d06e", "comment": "Malware payload (Mirai)", "value": "25841dca8c26d632f1f6fa7f38487a282b6c13720efd605a1c1ced5aab46af58", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301407, "uuid": "f167abc6-f714-488e-8347-64123ed00253", "comment": "Malware payload (Mirai)", "value": "22005d25422a3870b3bb3c9b493fed8665d00107", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301407, "uuid": "4479be63-6982-4250-bc69-31818463bbcb", "comment": "Malware payload (Mirai)", "value": "a0a6a0ffb38d6a9291e446f8f12cf9681ead16b6d32d00954f210c93fcc9db984c96c6445e23f9b867e0ba25d874cc3c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696301407, "uuid": "60931a0d-0606-438f-8a3d-77f716c161bd", "value": "T13933F2A2676D2AE152B04377BC33FC1AA69C17F458A730D62CF0A61977C58064FF2786", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696301407, "uuid": "90daf849-8bb9-4913-8823-5570bb73b71e", "value": "1536:j9O/ZMAXIxNUk0ULcPqF1aBexo4opKZbx:j9O/ZNKyoLGqFUFc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696301407, "uuid": "f8a8f6e0-26b9-42a1-9a4c-f5f1783bc8e1", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696301407, "uuid": "79fcaad2-e81b-487f-b701-83d0e8c6effa", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696301407, "uuid": "d7b8ec33-2601-4672-b8f7-3a122397133c", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54d89d57-6205-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696348553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348553, "uuid": "e1300919-be77-4c7f-9a49-44fb59423ff3", "comment": "Malware payload (AgentTesla)", "value": "7d32d70e2b5287337a67acc90db25c03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348553, "uuid": "5aa6a827-78f1-48c8-a46d-520ebadf4842", "comment": "Malware payload (AgentTesla)", "value": "25d22f62cf2de22eb2c70e2922628e6549374f8b130909ddd9f923cc3a225130", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348553, "uuid": "20a7b04d-ddc8-439a-b6e7-a1904e2e6878", "comment": "Malware payload (AgentTesla)", "value": "a5ba4ea78412b4106d7d4191ed9cbdf4c041e70e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348553, "uuid": "d84f8a5f-1187-4ed5-bfdb-e5a1c5b25e8d", "comment": "Malware payload (AgentTesla)", "value": "c3f4681b1b59d62951e788d52a7bb27c0519bbf8b19547fdd46a4487d02678f7d34da84446e837a514c1c8b19172e424", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348553, "uuid": "63a901ca-5b3d-46b3-bf7d-a031aee6b1c8", "value": "T105E4F03261F625E0F8D98E772C119090BEFB5D2A9D96911CE08871F90633BD8C2566FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348553, "uuid": "94f893fb-9392-4fe8-a781-8958dcf9bf08", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348553, "uuid": "013dc0c5-41c5-47d2-a643-b70d7b7228dd", "value": "12288:WwRL1H7lxds6H+CTHNHgotiylDufZG19NumB0:9BPjNAo5yM2y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696348553, "uuid": "9f7109d8-82f8-483c-b7bf-3635886ecac5", "value": 719872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696348553, "uuid": "c61504a3-d16b-46ef-85bf-b4595c4ecf45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348553, "uuid": "f1a48e87-c0f0-4848-8429-b94abc3d506e", "value": "7d32d70e2b5287337a67acc90db25c03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78fb9f95-6181-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291920, "uuid": "bfb80d55-2e74-4e25-8299-c62c8a33bfb3", "comment": "Malware payload (Mirai)", "value": "42bb6f396de32bcbdd6924f9ffc55668", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291920, "uuid": "1dfe9de5-2b72-4d8f-a1d3-1db54075dc28", "comment": "Malware payload (Mirai)", "value": "25d3cb4787ba5d47a1041a5d17320ae532f6fd155353e22472a8d59d95c1ea19", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291920, "uuid": "bf443d6a-927c-4b41-ab71-a97217f2b199", "comment": "Malware payload (Mirai)", "value": "7e335f8c6a8fea8bc7230ece9f5ae468ff5efd9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291920, "uuid": "b78d7c5d-9587-4a11-b427-50bef3a935f7", "comment": "Malware payload (Mirai)", "value": "8d069d68b29a1e3c37ebbd48321aed91edd076ddf8a2e0ca7ae488ea0285dba4f97b16a7c95aebf1a345b1e399e31979", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291920, "uuid": "2ecf49b9-0b96-49be-8b5f-c00c2b57e6f0", "value": "T156C2E170A2AE2CB2C7600972F7B856C97E434F7DE5EE3880114047FB3942D0969E99C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291920, "uuid": "2a029145-7e93-4380-8464-de76bc58c868", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEVorkXp+QhymdGUopE:A8soTAZ3alkXLvFh8nNEVo4Xpvs3Uozy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291920, "uuid": "a917f8bb-8541-4532-892b-298a2e22379d", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291920, "uuid": "7b091b0a-88b4-41cc-acb8-84e677d0bde4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291920, "uuid": "ae95957d-624a-4f5f-9970-5acbf78e216e", "value": "42bb6f396de32bcbdd6924f9ffc55668", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8191ab-61ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696338315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338315, "uuid": "493572ee-ff79-4f85-aa13-6f51c745e4ea", "comment": "Malware payload", "value": "61b79cd46e4867b98880b0cf62b3a9bf", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338315, "uuid": "e6d20201-d50c-4983-bffd-fc236231ff1c", "comment": "Malware payload", "value": "261b34dfd082ecfcd564df2197126f3e000afc7ac1939eb5eb38e495080def2a", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338315, "uuid": "5193b1de-0b51-481d-8dbb-44d62a8e6535", "comment": "Malware payload", "value": "a128a033d924197e178cc13754106d1d5fe92067", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338315, "uuid": "8361ab84-b2b0-44b0-ad90-0b2f348eee2d", "comment": "Malware payload", "value": "d2dcf864e18705c986d6450533fd973b4d507474b992a23c9c0e44f10b2ae7f89e85cc5f8f965129c492f5e706ed1cf3", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338315, "uuid": "b3a17531-41b2-4cb1-a35d-b704b98b6b17", "value": "T1DCB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338315, "uuid": "dec4b275-fefb-4b54-ba99-dd7f1d748a0a", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338315, "uuid": "e53a006d-46de-4d15-a68f-3bd4d4537e58", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338315, "uuid": "fc94893d-612a-4815-b709-c7e64c52b1f9", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338315, "uuid": "fc10338e-efa5-47f7-bea8-1b786bb67126", "value": "AppleApp(32).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a3302f-61f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342110, "uuid": "d05d1d7a-6628-4920-a9fa-d45603df6363", "comment": "Malware payload", "value": "c40f4b04f822f120c8e628f276b2bad5", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342110, "uuid": "23e42938-3fff-412d-996a-0c546ebbffaf", "comment": "Malware payload", "value": "265be411b7ff5defd797e36723ba93547dc35567ea56ee05d66abaa1a0ec65fd", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342110, "uuid": "d4919032-c8b3-4c56-ab9c-606366d058fb", "comment": "Malware payload", "value": "710b2e1575df3550c9b56f36de5b07e58eb38744", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342110, "uuid": "a5767c38-5954-41c3-8b1a-5e5bc96d4cf4", "comment": "Malware payload", "value": "80cedbbaa4a93554df9ff143c97839ea398f2209a707b5efafb1da288defc2ece82cabe2699bb44118daf8d74428492d", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342110, "uuid": "23a50379-4e27-4561-9c42-7df5b8cf1825", "value": "T1DBB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342110, "uuid": "febc3b6c-c029-469e-bd29-9f2bc091f73f", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342110, "uuid": "2c090f73-1500-40a3-8e4c-ec911b96519b", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342110, "uuid": "62686df4-fea0-4164-9ff7-fadae066fd26", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342110, "uuid": "d60321b9-e960-4729-ac89-9086ac3e4d13", "value": "AppleApp(15).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07787c0d-6206-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696348852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348852, "uuid": "78cfb081-69d6-4be7-9136-8d40aed0cefb", "comment": "Malware payload (AgentTesla)", "value": "60e0cb2dda65e61f07b78667b34ecbd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348852, "uuid": "786455f6-8de4-4899-9568-94a1828a8dd8", "comment": "Malware payload (AgentTesla)", "value": "26a294c50930c0cd9fbed08dd7fb63ea59bd2300eed46c452de0b4c5f7b95309", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348852, "uuid": "b6bc8e5a-2112-4395-a274-f2f099463e03", "comment": "Malware payload (AgentTesla)", "value": "4f974ad07111c0cf5082cb1fa039ed7718f4d6b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348852, "uuid": "0f0785e4-f98a-4c95-8678-c0b6e06c8bb5", "comment": "Malware payload (AgentTesla)", "value": "eaacb4d777361d3ade71f11a3d9bda98eb3443fd2e1aad9b79b01d05b39b5cdcad456164679245e724cf0e8dd2a6aa52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348852, "uuid": "4814f22a-c8c9-4047-9493-6dfe713d4a79", "value": "T1E9D4EF7262B6A0D4FAD99EB75C219090BEFBAC06DD16811CD41430F92A73BC5C2466FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348852, "uuid": "0d3d68cb-7646-4519-a5f9-254521794087", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348852, "uuid": "572ac1e4-5a70-4d20-8c02-cd7755daa325", "value": "12288:lJ0yXuN/VvbwTDgbLOtG7YaehgZHLWl5EHCNumB0s:z0EAdvEgelaeSHRy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696348852, "uuid": "a1c5715c-188d-4cdd-b590-5b33b69da7f4", "value": 643072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696348852, "uuid": "3b65027a-c8a0-4d5a-8ad2-b6490c0cc8b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348852, "uuid": "2352a2ea-88b1-4998-88f4-d9c0557f8e7b", "value": "60e0cb2dda65e61f07b78667b34ecbd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed439ff4-61c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1696320462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320462, "uuid": "8617267e-2715-41b7-aad1-f2d8f7a33075", "comment": "Malware payload (RemcosRAT)", "value": "e6f8d2f8319b349b973691beb61539b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320462, "uuid": "cd84c52b-c604-4b93-afc1-20895c7b27ed", "comment": "Malware payload (RemcosRAT)", "value": "26a9fcae8a113a2d5705075039f6acf5309dd6b065e28c9ee73d63b903064258", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320462, "uuid": "232cc720-91d7-43fa-a387-63425938aa7a", "comment": "Malware payload (RemcosRAT)", "value": "08f1609a8ce6e8b715b7fdd59364c1acec6e0eb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320462, "uuid": "25367eac-01c3-4135-a2f9-c23d84c71dff", "comment": "Malware payload (RemcosRAT)", "value": "623977d2090a0e2d20c5ed053877610e7ccda5d95a567a6ff692eb205712908dcaa743c403489120e5ddcd7996647bb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "remcos", "colour": "#0EEF17", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320462, "uuid": "bc4dde79-dab6-47ab-933b-39fd73bfe06d", "value": "T1CA3412986B2AD869D1D4C6FC8524D5F222E95C7E0D2665CE1BDCFE2FFD27200EC910A1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320462, "uuid": "a9f14f52-220c-43e2-bc58-664ed9104bd6", "value": "bc4f8e98d1041d53dd63bfb91ed10d0a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320462, "uuid": "0bf188ab-2861-47da-aed2-b6aee25a104c", "value": "6144:9vGSN9gWuLpcBKnVBYAsmrzpyDfOXXV1B:9vbGWulcBKV3uOX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696320462, "uuid": "39a94a83-5e4e-4ddb-8d13-705c7b2540d5", "value": 238080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696320462, "uuid": "1005370c-1e05-44f7-9dfd-64cb8cc68d91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320462, "uuid": "19cda05f-91c3-4acd-bc3d-80852d46828a", "value": "bQta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d5e81ac-61a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696306906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306906, "uuid": "697f2e26-eced-4692-b253-a962bc8051e4", "comment": "Malware payload", "value": "181317a823576fdb106c88ea3e0e0352", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306906, "uuid": "179f6a2a-0334-4e1e-bd92-76d20fa557bd", "comment": "Malware payload", "value": "272f04fb57cab8e1a9b6e70d82b0ab0e111b79cf6c345fa9a89aacc5388038b7", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306906, "uuid": "c441c6a9-4848-45ac-9547-f6f7dc37d81e", "comment": "Malware payload", "value": "1cb05b97258060d4c18165a33dad2fc2d94372ee", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306906, "uuid": "cd0bd677-dbe4-45c1-9a4d-ca28abb27fba", "comment": "Malware payload", "value": "01649f8f21ad9bc7fa84b858d0c46ab486cdd5d706c6241b5aa8699ee3421a170c1410a6c30298c199697cb3e3e08fa9", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306906, "uuid": "5381205a-6e40-42ce-a22f-6549f5aecfd0", "value": "T176E0264201CA1A62D423CDF2B0896E760420188AFC6062DFA89CE042AF6179F8A1198A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306906, "uuid": "bbde59fc-34ff-44ec-b2a3-36bc5ff2ea99", "value": "6:5j11bX6Uby9KvDnEnfA7EHFzqzlqarSG1bL2bYKxHu+lF:5jzbhvmfGEHERbL2JOaF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696306906, "uuid": "7e0c5896-38cd-4e30-998b-dfed96cec0b8", "value": 337, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696306906, "uuid": "af3cd777-5518-4eda-9675-784710d4799e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306906, "uuid": "ef13ae4f-6e71-4a74-856b-835967eb3bf8", "value": "Documenti1.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4359af-61dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696331654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331654, "uuid": "151d20d3-9dad-4c34-8b17-7b64e4c8b61d", "comment": "Malware payload (Mirai)", "value": "59bd5a5fc8c2507946f4c7a565b13b5e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331654, "uuid": "1990ebea-9eab-4601-8b21-322dfc965bdd", "comment": "Malware payload (Mirai)", "value": "27acf0636bdd347e8261bd6b0ac35f15c6c6483e9fe862fd13db59df884c8202", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331654, "uuid": "91fadf09-312b-4609-8709-b90101758578", "comment": "Malware payload (Mirai)", "value": "36a513641097a367643c01dda9a1ec5357fd5323", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331654, "uuid": "bfa70ca8-65b4-4e5b-8880-e2e21d50bb4b", "comment": "Malware payload (Mirai)", "value": "ddd0603b066dc85968fb1b93f9756b31a1143e0d70563ea9980b8e95043d6ba7934142145da6a43a966b89f9c719cb3a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331654, "uuid": "b1921548-8586-4515-91cc-4cc8b9ffb6db", "value": "T1B792E178E6D00D0AD7C097BD1F334AA1A781390DCCE9AEFE64585F08132E484E5C8AE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331654, "uuid": "cfd9ea96-d86a-4b7c-a793-e1497b27248a", "value": "384:gwDelYgoj2iQf5Wd7MAWBsyN2f2upwoqT6gLkD9xGb/aE9RglhKSNW:/DqYgoj5Qod7MAWBF2fbpwVzgeb/aEt5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331654, "uuid": "5874caab-3b10-4783-8bf2-0fef0bf5349e", "value": 20840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331654, "uuid": "6f703cdd-6002-494e-86ec-fbbafb4c2e27", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331654, "uuid": "d7cb88f5-bd5a-41c2-8c5b-8706d1d09bd1", "value": "59bd5a5fc8c2507946f4c7a565b13b5e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cc82195-61c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696322233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322233, "uuid": "c992592e-759f-4fde-a9e6-4c462b30cb50", "comment": "Malware payload", "value": "639dc278f96ff66db8b87de1ea30c4bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322233, "uuid": "0433e7f3-4f91-4142-9aa1-73363f04efa4", "comment": "Malware payload", "value": "27ea90cf1f8f3563505a74c1fc7ba830cac87bd035a020484d2107b6d0baff3b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322233, "uuid": "c2ba5259-38cb-4103-a619-eb7dbe2cf8ab", "comment": "Malware payload", "value": "8d682d027e84f81ea64bff2c91d270d4435bb1fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322233, "uuid": "5b0e9760-704b-4f36-9c9a-4d8fce40acad", "comment": "Malware payload", "value": "a9a2f97bffeca2ab52e8abde0c81d41df74599d9ce7d4872b244074c27ae794edb06263e444cb3648909ce5cff3ab5fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322233, "uuid": "c0b41040-3aa8-4de7-b9eb-f7a79d7e3376", "value": "T125E53303F1916379E2265B7318BE98A8423259DBE76BD86C4D6BB3C83D773514C04E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322233, "uuid": "de3692d3-f40d-4ec2-a13d-7980a6fed3bc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322233, "uuid": "dd42fc45-01e0-48d1-b4f6-98bdb7ca1999", "value": "49152:o/ZzYR8VwxhkgRtPt/rap9lhB9e5FEQa7hz/WMBhHfDqLddN:o/FTi++Ql4FEQaxuMBh/DqLdd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322233, "uuid": "4a6eabb8-27a8-40ae-acd0-f3bc7d023a86", "value": 3233792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322233, "uuid": "2f124f2b-2944-4d2f-99a1-62cecf06b995", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322233, "uuid": "2be23efe-ba82-41f7-807e-a54d47435913", "value": "SecuriteInfo.com.Trojan.DownLoader46.21649.17796.3963", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac78cbc-61ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696309828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696309828, "uuid": "6ed008e6-0db3-43b2-adb8-9b21531c37d7", "comment": "Malware payload (Stealc)", "value": "04f865d6b295759e0de983b3818eaebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696309828, "uuid": "afcfe01a-15c1-43b5-943a-98714ec6d277", "comment": "Malware payload (Stealc)", "value": "28b0604f50d81f4ff2a9aa4e7601d84a295624eeabc234993cfcff5ab668280f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696309828, "uuid": "28e07b39-c565-4d80-a652-f36bda37e1b8", "comment": "Malware payload (Stealc)", "value": "b48fdec084203456d1f03d1133ccb5c97c652bbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696309828, "uuid": "f3f72b63-fde1-4943-a7a8-79c9a3a0692a", "comment": "Malware payload (Stealc)", "value": "b1b683e49d90509f76b17efd81facd70c17d8cbb5d94096071a72d70915fd7547f5cb6f4ef115d75b630f27b6bd88e8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696309828, "uuid": "78b7e614-262d-48dd-97be-2df47c2a4484", "value": "T14434D02237B1C072D6AB06B55430DB917E7EB9334375C59F27681AAE6F203D29B26307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696309828, "uuid": "868ac857-8a41-4671-a063-85e00d340307", "value": "a7960cb042304220b44306228fd698f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696309828, "uuid": "8fca9e9c-e08c-4d67-9668-fd76ef16aaf8", "value": "3072:QZxW3y+Zb5iO2sh1QTJOJ1HMacAh7WDQjF+Z5PKF2n/Q:sBE/vQAZMY0D+4U2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696309828, "uuid": "e136fa86-c0f6-4486-9ef9-ed7ce85fdc29", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696309828, "uuid": "7f0b06ad-ebb5-43e8-8c1f-45034c58a417", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696309828, "uuid": "babcfbb8-2b37-4b34-b308-0186aa4e1c1d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e63f4526-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696356957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356957, "uuid": "81e18e89-6ede-4054-b9fa-79be76f3ce06", "comment": "Malware payload (Formbook)", "value": "df319f519dad4abc644dc6ffe975020e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356957, "uuid": "6edb7f61-3688-450b-84c6-8b827a592e09", "comment": "Malware payload (Formbook)", "value": "28d442e84385d04999a70982af89686000826bdfbd2cd4b6a515de4d65f11fa8", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356957, "uuid": "388c0d2c-f85a-498e-927d-d5f949052298", "comment": "Malware payload (Formbook)", "value": "12d45ccea684c449e561d6553530bd0fc80163c9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356957, "uuid": "d758e5da-581c-453a-a2b5-6bd95e6b8214", "comment": "Malware payload (Formbook)", "value": "d08d68995f3373696dfe0efc1a69cf2593a0062fd409e6faf8b4adcfae284cb34c8def61975270f38b7bd34144397246", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356957, "uuid": "d0945deb-cc2f-47cd-9105-d2140606edfa", "value": "T15E85F10B9405DB47C82D83F4BD1338994B1A7F19EBD429DB21973B5B3E316A208CB5AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356957, "uuid": "e80399fa-58ee-4282-9b3b-c9cb7842b00b", "value": "49152:3QmmQ30606VBdMT6VO8GDOFeUBjTFNKaMMKcr:3pmQk7mBdKmO/D0rjBHdK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356957, "uuid": "2e499ab2-723c-4821-9555-f5b945cd2aa9", "value": 1805312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356957, "uuid": "08302139-2303-4b7d-9ed8-43298b05c673", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356957, "uuid": "86efbac8-f413-4961-9551-506ee0aab030", "value": "po# 72842.2023.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3050d142-61d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696328735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328735, "uuid": "601e6b25-461a-4405-8149-2f0b23758f45", "comment": "Malware payload (Mirai)", "value": "977f6eaff08db6cb1e0291c5ab70a0fb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328735, "uuid": "e3980b4f-d989-48a6-9f42-f3645e12b26c", "comment": "Malware payload (Mirai)", "value": "2963d9249c56f45b4697561158f62a0824fafb9c88eb9991a266b157928b538d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328735, "uuid": "da56ad74-a541-4460-8b7b-60daad42c905", "comment": "Malware payload (Mirai)", "value": "661f82eebd26fe0ef1d25af3c22fde653351dc15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328735, "uuid": "d0d740c1-07f8-4035-9bae-416d68d60772", "comment": "Malware payload (Mirai)", "value": "a7ad5d733b2ec4640ff800cca767a6ecbd448892f329c6d4ed5ed3c67b39c0d6a63a0932fc5f50c3622c3b7a3e880663", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328735, "uuid": "b76f275f-a2b7-43dc-bffd-15bde62dea9c", "value": "T1FA539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328735, "uuid": "d445edce-27ac-4435-8260-77f13c99bfe9", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328735, "uuid": "f20f9fad-51d8-43e5-821c-4a14155c90cb", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328735, "uuid": "d0110177-9be7-478e-b24b-04ee90002bc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328735, "uuid": "468b849d-2dd8-4df1-950e-990992731f7b", "value": "977f6eaff08db6cb1e0291c5ab70a0fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e080b4eb-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696356948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356948, "uuid": "f7a18842-ffb0-46a2-ad0e-185851ad9e04", "comment": "Malware payload", "value": "c147616278c75a5a637705820897f5d2", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356948, "uuid": "1f716647-0867-4320-bd49-987f24149ef7", "comment": "Malware payload", "value": "2a7582d526d33baafb9fbaf382feec8e15b4481ee152fe312e14cf6e1e87ec8e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356948, "uuid": "a3307e1b-4f89-48b7-8af6-8484b2a4d0fd", "comment": "Malware payload", "value": "d8b85ddbf40433853de7d481c1b6e24bdadf4a96", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356948, "uuid": "ff2be30d-a9f2-4397-8f20-40bdd8a80833", "comment": "Malware payload", "value": "102561074cf07e4b90876e6c787a20a11849652f5a6fed694850cd5f88bd95369dab3aa915f247dca8d2b29eff481644", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356948, "uuid": "575cbc63-9b20-412e-81b0-6790e4d5db3f", "value": "T16455E00F9514AB87D00943F87E2339A91E0E7F15ABC569DB15537B8B3E306A218DA2DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356948, "uuid": "2145fdf1-6798-41b1-8976-15d245067dd5", "value": "24576:/WQmmav30xZkmZyNw6VXAXZSuflqZyLw6VoAXZSjA1y7ZbdMQT4pXzZeaiP/wCx:uQmmQ30D56VEEVX6V3E018djTkZdiXZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356948, "uuid": "769b6205-ac5b-4237-8316-c427d87cfa9c", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356948, "uuid": "02d723c7-b675-47ab-9f5f-3f162589efd2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356948, "uuid": "1d691d0a-cf38-4297-875d-f3f8bdeaf500", "value": "BL & INVOICE NO.SINSB2.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9094f2fe-6181-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291959, "uuid": "5a332b47-dbc6-404b-b0df-31f51d780381", "comment": "Malware payload (Mirai)", "value": "5fa042cbd68406757ef0f9a3d97eab30", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291959, "uuid": "8e9f6241-77d9-4c19-b24e-29c26e25346e", "comment": "Malware payload (Mirai)", "value": "2a91f82d165b11300f75c30e4be1034585bbf9b686c4ab2deb3253b97d5455b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291959, "uuid": "5e47aade-571d-4562-b47d-90998ddd5f35", "comment": "Malware payload (Mirai)", "value": "3f08845e138265d7c67d60eccb869c212996daa8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291959, "uuid": "71a14763-8c77-4444-83e0-4fb0ec333ea0", "comment": "Malware payload (Mirai)", "value": "12527f616052ddb6c9f42fe88d409dd4852b4c4748abd23da5e2a18581068e37cfcbbdf91bf4f25fd1a9049918eee942", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291959, "uuid": "638dc34d-be89-47a8-b4b2-ce42ab2d3a85", "value": "T111B2D0A44B91A703C6B07479A27C8F52573746E0C5F638272B20D3BCD94189772ECAC7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291959, "uuid": "c32b9932-fd87-46fe-a4cd-9c2281e349cc", "value": "384:4C9KXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BjDhymdGUop5hu76:4C9KQFH0rs3zWoDDRsjt7LB9U+BjDs3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291959, "uuid": "72cc2c30-3fa5-46ba-82a6-2e9857eec4a4", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291959, "uuid": "03085993-c119-4071-9a49-26b97498ec6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291959, "uuid": "de70090d-c249-4068-840a-fe7a6ed4cd41", "value": "5fa042cbd68406757ef0f9a3d97eab30", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd9bbe2-6180-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291556, "uuid": "2d936861-301a-4db7-841f-20a71324f809", "comment": "Malware payload (Mirai)", "value": "0f59b7c8dd2de5eaf9b9bd9d418b197c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291556, "uuid": "7913bd81-801c-43b2-aa79-d102e8e04b62", "comment": "Malware payload (Mirai)", "value": "2abb64ca87a6ae4532a242c1189258ea7caeca897abfa3c0df02eeec4cf8d5ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291556, "uuid": "e8c816cd-ffb1-496f-b48c-dfb36b6fe595", "comment": "Malware payload (Mirai)", "value": "a92b10f740b025ec4e7b62cf804d9416e7317161", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291556, "uuid": "b7f376e4-c6a3-4f66-98bd-f80239b667b9", "comment": "Malware payload (Mirai)", "value": "aa157e1845216533039426a04258874af520ba13beb5ffb60f67e2a3688bb5a102e964d1c9a5c3df6702a628345938f9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291556, "uuid": "ef58c613-b9a7-4c0c-bb71-a40253ba210c", "value": "T1E9D2F110E1066DE6DEBF7EF49D89CBC1BFB10CD8F7D149962188EF02122E8466962C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291556, "uuid": "d37734d5-3cff-4c52-a4b8-ac031f090ee7", "value": "768:6FfumngB8mXWJKQwYOkT1L8spnAmhFx4uVcqgw09E:6F0ZWJ/Z5Aox4u+qgw09E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291556, "uuid": "f2fe69b8-c893-46e4-809a-878082a7d6e3", "value": 29548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291556, "uuid": "0a331f6c-9f9a-46e3-8f64-f12e360209a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291556, "uuid": "0e0c0a3f-e931-4e82-a4a1-ef0a04b095a0", "value": "0f59b7c8dd2de5eaf9b9bd9d418b197c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41b0d302-61e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334347, "uuid": "c2ef982a-8c70-4192-b077-c695d8560553", "comment": "Malware payload (Mirai)", "value": "55d9024413efcc76c5e80910380138a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334347, "uuid": "da86df22-534c-489c-b41c-2ee73582fe3c", "comment": "Malware payload (Mirai)", "value": "2b9a607fc9b9141f8f5ccc9714dfb690bd9c25650a4cb88843955de7b05ceeea", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334347, "uuid": "87393914-66f2-4f0d-9462-f9bc2bc92fc8", "comment": "Malware payload (Mirai)", "value": "b38b2b13175837ac57dab5a91c4cdf9bf417d240", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334347, "uuid": "0d40bfd2-f350-449e-bc62-93ed35fa935b", "comment": "Malware payload (Mirai)", "value": "55dff9c386bcbc41dd0928da725274578c01d74280f3f70ca509df923db418474c75ac95737cbf4bb8f324faf6c28511", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334347, "uuid": "b7832177-ded6-49a7-ae2f-9776e1657460", "value": "T1B4539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334347, "uuid": "a62e7382-c30a-45fb-8399-d1613034d8ec", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334347, "uuid": "33505144-5d33-4a20-a54a-ae6f42e84ccb", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334347, "uuid": "86503a9e-a40d-4bad-a0da-f90161887100", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334347, "uuid": "2dab2dd2-e2ae-487c-b526-041645acf2af", "value": "55d9024413efcc76c5e80910380138a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2cc05d9-61ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696323343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323343, "uuid": "f9da1b47-930d-4c15-913d-fbf60df71894", "comment": "Malware payload (IRATA)", "value": "46d1f449540173f51003717513ef5ed4", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323343, "uuid": "03985abf-77d8-425d-b474-b5d7eb47d340", "comment": "Malware payload (IRATA)", "value": "2bed5864b7f65bbadcf300a2ca363f4061fe5b7ef0c9416e349dde701ccf3a84", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323343, "uuid": "cb090958-8c2e-4eee-9e4f-16c66b99e1cf", "comment": "Malware payload (IRATA)", "value": "1a1c24247f8c5cc8f0e08d3d72ac89282e7950f2", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323343, "uuid": "c0cc5852-c79d-4fcf-99a0-86ae2e65a11b", "comment": "Malware payload (IRATA)", "value": "90e26fa04a4e25df2f5f7fd29027c1c491472d2370ca00fd91a674642f470b2db527c1ec537754bd30e8e51132d202fc", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323343, "uuid": "660c2980-1041-4be1-b5f2-99b3e57fa1b9", "value": "T195D52283F269A45BC8F1C37225A42A3511774D1ADB43B74A391C73BE2FBBDE80B85194", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323343, "uuid": "19ecaa01-9621-43d1-be38-d33b65182bb3", "value": "49152:9/jsWXkkbeXfQLR7+2L9Jw7be6SffTeFe2oEkVCBqQyD9S9Mg0gmQIEmrggF1BCn:VBXkk6XfIR7TL9m7K6aek2oElyDz1ggY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696323343, "uuid": "abf0cf80-70b3-49d5-8b04-e566ab4abe1b", "value": 2826335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696323343, "uuid": "71dd56b6-e047-4d39-9bd5-5a9027891e25", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323343, "uuid": "a6e6b8d1-d50d-4a9d-b89f-09fd4af9bd00", "value": "saham.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a9b0810-61f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342120, "uuid": "25ba4ae8-b237-4927-8069-ebf8236cb2e3", "comment": "Malware payload", "value": "be94349a0ab8856e8bc222f86deb23cc", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342120, "uuid": "0ff8456f-fa46-438f-9550-9e9f3ea11816", "comment": "Malware payload", "value": "2d258d71b0d331d3230b1114d70e8e832fe6f0c737b10c7c290b21b759db943e", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342120, "uuid": "b6bb973f-23e1-4e38-949e-3bbf7d07180a", "comment": "Malware payload", "value": "cbf2807de301789ae8b707c05020f506cd8f8351", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342120, "uuid": "753a8364-af86-4784-b203-be79b4cc4560", "comment": "Malware payload", "value": "42214aa2f29b49ee3985bf0b4f85cd74de1ab6bb900f3ada9956eab0e1e59a0e554274c159be18a8ea24b7ea28046fd2", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342120, "uuid": "45ee7b68-18a2-44c3-9bda-c8007a205484", "value": "T1F5B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342120, "uuid": "4da1767e-07a1-4667-8bdb-4d61c172cd0c", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342120, "uuid": "96a02e03-267e-48b4-8656-1a372900451a", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342120, "uuid": "f8eb549c-1ced-4593-bdf4-3f3c9aadb445", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342120, "uuid": "33469a86-a966-4739-b7ac-502af9235ad5", "value": "AppleApp(1).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b1bc660-6191-11ee-a6f9-42010a9c0055", "comment": "Malware payload (BlackMatter)", "timestamp": 1696298688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696298688, "uuid": "4c6310e0-86bf-4860-82ce-03b9ed8c6e82", "comment": "Malware payload (BlackMatter)", "value": "bbe63d8efc8d8dc7f387b08ee07721ba", "object_relation": "md5", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696298688, "uuid": "c9d69139-2d6a-4ca5-956b-6edbc95d7b95", "comment": "Malware payload (BlackMatter)", "value": "2e8aaa6338cbf95d8d268559fb8afac64e1c0dfc9ded4bb2de63a9db634e354d", "object_relation": "sha256", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696298688, "uuid": "ac272f1e-cdc3-4e01-b660-a8705e2a65c9", "comment": "Malware payload (BlackMatter)", "value": "392e9c659916a2080524c6fb604c996f73afc825", "object_relation": "sha1", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696298688, "uuid": "7a2ebead-13a1-4f5e-9bec-36238bd9e497", "comment": "Malware payload (BlackMatter)", "value": "70161c3a149bcc099a1412b89743bcb14f1cf8b858b6c902c4e6e8c3d91afc70a326e2acb8782152db11ad695f58ff65", "object_relation": "sha3-384", "Tag": [ { "name": "BlackMatter", "colour": "#F2287D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696298688, "uuid": "f3b26fc2-1de4-4d68-bb5f-a73b591fe3ac", "value": "T11DF38D21F513D173D42728F22B367571B39B8E2C1AA57413EAD80F59ADB2823EF18947", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696298688, "uuid": "bcfec3ef-9cf0-4d4d-960f-381003740fa6", "value": "89b43582b27abefb2b74684ab12a2f8e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696298688, "uuid": "2efa8dc2-4071-41de-a4f7-1d304efc50f1", "value": "3072:guJ9OlKolUa1U197bzhVsmftsEfK6p8fXD37KvbVM9g/YCuPBDk:gufj0zi1dNVsmft46p8fXDLSMgmPBDk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696298688, "uuid": "54b8ba93-5644-4a3b-9591-5c5ec17edbf5", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696298688, "uuid": "612b4152-7d9d-4688-9aed-056cf3bf7788", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696298688, "uuid": "9212c1f2-1210-40d0-8e0b-86652b776925", "value": "payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b403ffd-61a3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1696306339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306339, "uuid": "8f71c720-0d15-4837-984d-99c9906bc4d4", "comment": "Malware payload (DarkGate)", "value": "de9a6d5f83e167fc020bb48f36684155", "object_relation": "md5", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "greadeaoptimalle-com", "colour": "#15D34A", "exportable": true, "hide_tag": false }, { "name": "searcherbigdealk-com", "colour": "#D048B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306339, "uuid": "c9c3099c-de12-4826-89a4-75941d2a469a", "comment": "Malware payload (DarkGate)", "value": "2f5af97b13b077a00218c60305b4eee5d88d14a9bd042beed286434c3fc6e084", "object_relation": "sha256", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "greadeaoptimalle-com", "colour": "#15D34A", "exportable": true, "hide_tag": false }, { "name": "searcherbigdealk-com", "colour": "#D048B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306339, "uuid": "c0997c64-f4a4-46b7-bb83-aaf60fe95802", "comment": "Malware payload (DarkGate)", "value": "7e2db72b21a9a8ba2b63cd77859dc9ac87b6afc2", "object_relation": "sha1", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "greadeaoptimalle-com", "colour": "#15D34A", "exportable": true, "hide_tag": false }, { "name": "searcherbigdealk-com", "colour": "#D048B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306339, "uuid": "d2346574-dd5a-41ee-9474-25a95f250692", "comment": "Malware payload (DarkGate)", "value": "5716d576f9ee13c4c8e8993acc11d2489227ccfd405abacdd18284dbc922ceda6cd1d44c20dc366b8138165abbc2b6e0", "object_relation": "sha3-384", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "greadeaoptimalle-com", "colour": "#15D34A", "exportable": true, "hide_tag": false }, { "name": "searcherbigdealk-com", "colour": "#D048B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306339, "uuid": "2f91ac0a-f623-4fa8-8a09-d505f88a286a", "value": "T1F4157D532B4C2A1E2536F297810D4F0C6E2967B38E265FE917DA176B512F7C14FB8C82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306339, "uuid": "82e0d93e-71b3-4be3-b21f-5fbaba7561b9", "value": "12288:wrUm6FUmjNf7VY0PhNb6u86EsC1a2pRvZfJO4gJ9lPkoTY:Nm6dTuEh4U2pPY4W9ZtY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696306339, "uuid": "69cbfa03-afc9-47c0-8429-1c2267e8b992", "value": 936976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696306339, "uuid": "9ba680e0-b54a-47b8-91ae-0e6dbac9dc58", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306339, "uuid": "c7472081-5c4d-4715-b914-627a699a9aa4", "value": "bszxeo.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "898ab2cb-61ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696338333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338333, "uuid": "60dd4493-c6da-491d-bae2-4c6d70d5fbc5", "comment": "Malware payload", "value": "941cba13b667cbe8832443926682e19e", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338333, "uuid": "4ffd8e8a-f329-4d48-84d2-701d33a6a372", "comment": "Malware payload", "value": "2f63eff933464ddcc20bae7e4d0020321973050395ae241ac98c3beb248d5317", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338333, "uuid": "c1c813f3-d998-4439-8211-1ea3d53182b6", "comment": "Malware payload", "value": "624954c17d5a099bb5f3b25ec0be0c5fd3de60d8", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338333, "uuid": "852f3367-8c5d-4da4-8498-8277ab8ceba4", "comment": "Malware payload", "value": "d3fec8aa657da10af1fefd1611e5a54113a76e71dd72b541b86b02b7e6e12a34158293129b519cae6b758319ecd64e48", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338333, "uuid": "9abf56c7-8c46-4aef-b9e6-bb14f8cc84c5", "value": "T14DB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338333, "uuid": "acfae541-6816-453c-be6f-fabe87ea2b4d", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338333, "uuid": "f22ce0e0-5f07-4bbd-9a1f-ce0520dd8f30", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338333, "uuid": "25db7382-9f55-4fa6-a5f4-00fd02408b3b", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338333, "uuid": "4f4f8d1f-9cfe-4ead-998c-487c10a49cd3", "value": "AppleApp(5).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b453f70-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346094, "uuid": "9065b4c2-bc83-4976-aac8-50bd8e347e1c", "comment": "Malware payload", "value": "562a6c6c0463b4692f18ad20b656a35c", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346094, "uuid": "194025a9-352f-4495-af5c-6cf80f11d456", "comment": "Malware payload", "value": "30829fb6189a482c60335c3267d65b173482abbb67405f3479a4763cfaa937b1", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346094, "uuid": "8c1a2ff4-65c5-49a7-867d-d988cf49032f", "comment": "Malware payload", "value": "6fb982a5b3c3bfab8bdb508c276121fcab7cd3e0", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346094, "uuid": "8efc0cdb-262a-4bda-b4e0-6ace3df753b2", "comment": "Malware payload", "value": "9781a82c8141d5f4511341e03432fe9c968da9f1b439e8590be03cf071814846b87d11c6e3829ec7aa621921e5a021e4", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346094, "uuid": "26a08891-b317-4cb6-a4ef-5a06ad5bacab", "value": "T126B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346094, "uuid": "2a798791-6ba8-4241-90fc-49e29c996cde", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346094, "uuid": "cf5b67fa-ed4d-4c01-a1ee-f5aafbf8e27d", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346094, "uuid": "648e6091-cab7-4734-8127-acb3fef7e261", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346094, "uuid": "a7401ea7-41a8-4f66-9f06-2858e6e8fc68", "value": "AppleApp(180).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e809612-61eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696337295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337295, "uuid": "e5b961b0-074a-4365-a456-a802353725d3", "comment": "Malware payload (AgentTesla)", "value": "4e4c359c0e36f7e5b3dc44af663ceff5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337295, "uuid": "8edc71a4-07a8-4845-9fc1-1655123359ea", "comment": "Malware payload (AgentTesla)", "value": "308bba46bfcb12039b06105bef71afccd82acb7df7658a8a4497c1955c67ee5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337295, "uuid": "f4740fb7-2081-4b77-9f7a-e78bf8c638ff", "comment": "Malware payload (AgentTesla)", "value": "365bfd8d57b3d126091d178b36d75b2e5d9ca1d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337295, "uuid": "ca94cf73-1db7-4d16-8437-894a5d31f8de", "comment": "Malware payload (AgentTesla)", "value": "301654ceeeb30e8e887ad0ca439b7e56a4b03db0a030039a7d8d60a6a38629aa488546b289bcf4d19248360ea7281987", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337295, "uuid": "0a5660d0-454f-43ba-9e46-e4a4a0816a80", "value": "T181E4EF7120FA6AD8F5E85EBB5C1084557EE76D098D21C20CE89432F91273BC9C61A6FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337295, "uuid": "d4598110-b533-4a76-9a68-b57b6075ae3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337295, "uuid": "e91e4c66-d92a-4ca6-98f1-368d3d49de8c", "value": "12288:eiMiSAx5PWPQmHUefOX0LGPc+oFECnGVUsHXg7c+aT7PMYmx9Nth6FV1:eiM7Ax5uPZ0efXK0TOVPwNgxmx956t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696337295, "uuid": "1dbaebc1-1f6d-41a7-9494-3b1f31e8f130", "value": 686592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696337295, "uuid": "d394d16b-a796-422e-88fc-a82016be7530", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337295, "uuid": "30c22163-792d-47e4-b94b-fb9f2d872a76", "value": "4e4c359c0e36f7e5b3dc44af663ceff5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f681f95-620f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696352731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352731, "uuid": "e75e7db6-ef31-4e12-97cf-45cb8f66a7e8", "comment": "Malware payload", "value": "e3ac95adbe3d6cd0934909611ffc4696", "object_relation": "md5", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352731, "uuid": "3446b838-295b-49fc-b475-cfbecc106535", "comment": "Malware payload", "value": "30cae27927f4d3d7056e1a47a4a8b7229ef91f95553a9e5111570cdf147c2e52", "object_relation": "sha256", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352731, "uuid": "1af8d257-bbf3-4c80-aef5-0999f358c072", "comment": "Malware payload", "value": "a8ba42ca5b0d2c2578becdbc87e031ba57df2070", "object_relation": "sha1", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352731, "uuid": "f88eddb8-b893-447c-96d5-88d255181b28", "comment": "Malware payload", "value": "a464b72f4497d8e0ebaa81b0f77e348dece936f9f43bac73c87f3010b667834e8aee4c917aa8ee576445382435702cce", "object_relation": "sha3-384", "Tag": [ { "name": "Astaroth", "colour": "#7B57F9", "exportable": true, "hide_tag": false }, { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696352731, "uuid": "9a4bbc9a-8608-462a-bac7-201eb3e986ee", "value": "T14A447D0673D5437AE4D702312B9F93628F72EC788663422B1699760E3DF1594B7B32E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696352731, "uuid": "b3a40450-3eef-42a2-98ca-6cbd2c3d6c3c", "value": "3072:QPwIY993DQY5AXU6ij4qpXqnnDibAJBVkUMcB3RUN46ILJ9+ZB5yOanVW:QoIS3DQY5AXTqp4nwEwrWW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696352731, "uuid": "9534f0ed-c9c0-4b86-b0a8-ed42df1d8932", "value": 265728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696352731, "uuid": "8607ef4b-fde6-48cf-84e3-db01268bba92", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696352731, "uuid": "b5d3244a-72e6-4f17-a5e8-5ca06475c6a8", "value": "MAIL_PDF_ARGENTINA_GOB_AR651c3.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "810be5f4-61ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696338319, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338319, "uuid": "e437133e-a1d7-495c-b8f9-3e5a9d073fdf", "comment": "Malware payload", "value": "7601da7a8d06a63a50622fb50e23b4fa", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338319, "uuid": "d90eae01-8bc0-43d9-b125-6e0e009a168c", "comment": "Malware payload", "value": "30ecef7d782b65dc69c830bf84bf2800b094ceb1eb8abe9f0f258c9a556d7cd1", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338319, "uuid": "01473335-99c9-4b45-9a8d-45d0e7beafe6", "comment": "Malware payload", "value": "4fc9c7aa92a40dac379a3d2d2bb312f2ccdd18fb", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338319, "uuid": "841ee8fc-d972-4fb0-8a8a-6bdfb5925ea1", "comment": "Malware payload", "value": "2ff09c28e547748283bbb6b281ffed19a96c32bb3dad16ea0a4a13c1d6fa7b52133d12fbe2d7502f167bf12ae4f008f4", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338319, "uuid": "50112b02-5e02-484d-b842-9b750309f24c", "value": "T1D8B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338319, "uuid": "0369a843-0990-4bdf-8234-421796eae133", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338319, "uuid": "3acb7cdd-ce44-4366-985f-c763e693e1a7", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338319, "uuid": "d30a56ab-c6c5-4878-8aeb-712e4caf0692", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338319, "uuid": "18e505bd-84dd-49fb-8391-2298b77ee1db", "value": "AppleApp(9).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bdabb87-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696336646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336646, "uuid": "5acd503a-3480-4257-a3ff-65a0a3613349", "comment": "Malware payload", "value": "3e164ae8454d6f60eab904e4abe0f9cf", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336646, "uuid": "2cce3e1a-2da5-412a-8f7a-722509db0473", "comment": "Malware payload", "value": "30ed0ffa447b4976d7f32dd111911b8d4d15239c7c4f36018ad0c1ef915c35a8", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336646, "uuid": "7fdf58c7-ec8f-42a1-aaaa-8b195e592be9", "comment": "Malware payload", "value": "7c3d66fdd1f5b490c681ea941b0d24a309bdfb15", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336646, "uuid": "a2426f94-15d3-40a6-b5c8-8cea903768c2", "comment": "Malware payload", "value": "495d8787d5037385c1f8ada67bb0c433b42843dc9c058d66a399fd362deda51fa836c4b1ba714b6142f9e285bb531ea2", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336646, "uuid": "6decd8e0-9d7a-4b14-b3d6-0a16a3b2ff06", "value": "T15AB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336646, "uuid": "ddeda324-cc7d-42c0-baec-350448f48f89", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336646, "uuid": "ecbb92b2-1a70-40dc-bc66-b6e700aea32c", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336646, "uuid": "91b3b222-b145-4ce4-a901-4e42901a517e", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336646, "uuid": "88854174-5820-4360-a22c-24a9c248f75b", "value": "AppleApp(11).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126dc9e4-622c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696365192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365192, "uuid": "79a3d1e9-0267-4214-a4b7-9a3a7f0d9e8e", "comment": "Malware payload (AgentTesla)", "value": "c3fdabfa7e016aa9b2cacbb5fc9860a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365192, "uuid": "3d65f6b2-6d1b-4354-b25e-5b17d3f98e20", "comment": "Malware payload (AgentTesla)", "value": "313897bcfd2d0d82e6f41eef6161976f84c602ebed626ee29feaec6ee36f2c94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365192, "uuid": "1900c56c-f904-449d-bbeb-3cc4bd54fe59", "comment": "Malware payload (AgentTesla)", "value": "70e5f0dfb1a1dc4d6668f6333ecbf83aa49d13bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365192, "uuid": "ea9ed5e7-b6b1-4b0d-bf28-91767c000ff3", "comment": "Malware payload (AgentTesla)", "value": "8a6c368a838bfc4c1857f69b0d88dfac2fc7474e6f85f0ddd338535d39c0d313e2dfc604afb37a4cd849b96897ef9869", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365192, "uuid": "d8ff17f1-52df-4a8f-aa6c-9e26cc56c673", "value": "T1E0F4F8212DEB509DB3A3ABA95FC8F8FF896AF673160E70B5306107468722D81CD91735", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365192, "uuid": "9de9ce01-c4b1-4707-80f2-9ad52e46d9d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365192, "uuid": "eb3ebce7-4d31-4b2a-9442-b85f207c73fa", "value": "12288:tNTeVyTF63SThrGvvmfjje59IUwnZH0h:PB43SThy07", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696365192, "uuid": "d6656777-2e54-4389-86cb-f41e81eb6301", "value": 739328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696365192, "uuid": "494924ad-9882-40df-b180-94b50c9370e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365192, "uuid": "5e121388-a392-4ff6-a922-77b2d80a8fb5", "value": "wireguard-pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04e3c55d-61d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696329521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329521, "uuid": "9661590b-aa35-4be7-9af8-0e2d6a3a50f8", "comment": "Malware payload (Mirai)", "value": "394603e3118c31ff9f7f61ab9eeaa40e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329521, "uuid": "ee9854cf-bb81-4eb2-afd6-18c9cac83d0a", "comment": "Malware payload (Mirai)", "value": "31bcf8f60dff59a08241205304a4ba639bed50aaa69d5fe51ae08879823f0b5c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329521, "uuid": "a6ccbe1d-1709-4700-b8fc-577ce90343da", "comment": "Malware payload (Mirai)", "value": "576464004423a674834d5df5863f17af7be87b0e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329521, "uuid": "9a8e684a-c381-40fa-90cb-889bf2fc4f6a", "comment": "Malware payload (Mirai)", "value": "9ef3d8f6d6953afa1b802a50313c4675426fc9e123bb7f40990b28a71a9edcf8d7ee031f0ab3a6933e1516bef1890aff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329521, "uuid": "3f487fe3-5c52-4f8e-8cd1-8edb3d624b60", "value": "T15CE2F14672038272C35113B9EC7646873B1133F591DEB99272B405C0CA9765AABEA8EB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329521, "uuid": "a1d3f13b-8211-4689-ab1b-7701cd914527", "value": "768:Novonr1JoCLgrjtGPTX39didrXsLkzfYKTix/sdx+HCc19q3UELEm:Pnr1zUrjWTn9dKT/zAKux/sn0aL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696329521, "uuid": "7bc2b73a-56e9-4091-83b5-9354dc78e0d9", "value": 33236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696329521, "uuid": "49caba50-f060-4d45-a253-48eba659193d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329521, "uuid": "efc7c5f9-458b-4e19-8400-f7feaba55ff7", "value": "SecuriteInfo.com.Linux.Siggen.9999.16585.31327", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "437551c0-61d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696327478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327478, "uuid": "195ec253-11b7-4751-9b72-e3e64cea9b1f", "comment": "Malware payload (Gozi)", "value": "3f4f43c62a011f08bdfd132078c366f4", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327478, "uuid": "02c95aac-23ff-48f2-81f0-3cfd6cd88157", "comment": "Malware payload (Gozi)", "value": "31ce7210f050439db9dfb5d7998b1101834c8c7613942a6e73719d6c66bc7e32", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327478, "uuid": "921474bc-e40a-4df8-9572-0d2a246c9d73", "comment": "Malware payload (Gozi)", "value": "ef5ac4d530df3c4fcad6ba26360c383765e87eb7", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327478, "uuid": "f50bc6a6-c509-4f79-bce8-a5604a291a06", "comment": "Malware payload (Gozi)", "value": "dff8378cd494b81af7476107f57fa63ed568b7de0fccc7fadf4c551f776d6fbbaa9adec812173c49d7035b6a82a11904", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327478, "uuid": "ad6afa07-939b-49c2-8720-6844dc896c83", "value": "T17E04AE0DB7D19032DABF167310B0E7F5693DFA604B225A9FAB44D2760F201D3866C967", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327478, "uuid": "6aef5800-a80c-4084-9411-884c183d89aa", "value": "b708bc91029a5428d40eddd35d2240ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327478, "uuid": "08ef1667-b0fc-4eab-badf-d19c4918abf9", "value": "3072:976c8IAr3ZskIrYKhSz3yTzZkmkOSc3xhmpafpKEp9ptl5lCUL6zp:pL89TKkcYNcDkqHyaBt3pL6zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696327478, "uuid": "3dadb51d-ae3d-4d36-b230-f2b4c9954830", "value": 185856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696327478, "uuid": "48badd4b-959f-4345-aeff-2a5f3ab229c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327478, "uuid": "7c190528-fc54-4c13-81d1-078c5b1d59a1", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9dbab5a-61dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696331650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331650, "uuid": "016ef5f4-56d0-4136-b9d9-27e785a7ef55", "comment": "Malware payload (Mirai)", "value": "f4bff6169dc332bf59bdd57b0a34e69e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331650, "uuid": "030f5149-8f34-489b-aacd-1667948d175e", "comment": "Malware payload (Mirai)", "value": "3224bf7b6d9c33be35c6bda3362c917520320b3e29f4024b5edaa92fb19c3279", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331650, "uuid": "ec5b2620-a78c-4af2-85c6-98b4436b60da", "comment": "Malware payload (Mirai)", "value": "19746dace8c7f4664c931dac9039c5aefb479925", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331650, "uuid": "a63f5cc0-1f6f-4051-9462-b2e0b215728a", "comment": "Malware payload (Mirai)", "value": "905529e657737b1b7e67ae20dff1c76deb18b1f1e76008b02f1428e9e529bd8e45413d06349f1f573bce5d74bcebf0bf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331650, "uuid": "5495b895-2cea-4eec-983b-29948d390921", "value": "T13282D068D7789607D864973205BF9606EC7BFA6CDEDE195958803C73017C92E0E2CA90", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331650, "uuid": "55b72942-9eba-4b61-814f-bd6bdfbfefde", "value": "384:YdrfIkJejLk2UaoIyR03DcK72fVmQQozpVO3MfQaCR2:YdAX82cA3DcSC/QofGe62", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331650, "uuid": "157ddee1-1ce1-405d-81c3-8945d490155f", "value": 19052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331650, "uuid": "921bec2c-64ef-42c8-bc7a-f0ba70473c78", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331650, "uuid": "a83f60be-bd19-41f8-bb60-5c824f984df8", "value": "f4bff6169dc332bf59bdd57b0a34e69e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5144957b-61a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696306886, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306886, "uuid": "f16b6ff7-bb5a-42dd-805d-09525325c525", "comment": "Malware payload", "value": "ea347d9498b9be586a0f779f973e3583", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306886, "uuid": "fd2daec4-fa6b-4f0d-af39-c09fed9d1210", "comment": "Malware payload", "value": "32d30608f82ff1d92e4952bc12e4337f250093fcff7b88d7f01e8c7cae47d9c3", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306886, "uuid": "3fdfcc03-0562-4685-a085-926fb9dbd9b1", "comment": "Malware payload", "value": "0db75e16ff6b98cf508878e6d7e00b5c6cc43e1f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306886, "uuid": "011014f4-80d9-4a79-9d3c-bc4bcbc85038", "comment": "Malware payload", "value": "8cb175a0423840360b527bca18185c33d76f9e23ec22b497df40499e1a32cbb7c1e2c64c30111c75a30587d31a5feb62", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306886, "uuid": "63443f44-78cd-4cf8-8016-5bf3fb2991cb", "value": "T1C0E0C01A9EE74797DF12CEB614C302606071504025D46203CCFC4132CD623608E2424C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306886, "uuid": "89229cfa-f0f4-494c-9666-6ae47743def5", "value": "6:5jdFsG450eoahxHPcJQPyk9ceCfUda05+VQg6QIAwrSWFLj450epj7k7u+l5:5jdZPYvuQaSceIC5+VQg6HlV83Ta5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696306886, "uuid": "e653d8a5-33d7-4530-86bf-881d321246c2", "value": 349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696306886, "uuid": "c4a0beb1-5a90-483f-9475-3f3e18c1d407", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306886, "uuid": "c33ee211-5c25-451f-89b2-21c0f7ca0c2f", "value": "Amministrazione829.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10885ce4-621c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696358317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696358317, "uuid": "9ff0a54e-210f-4732-941f-104783e087bf", "comment": "Malware payload (RedLineStealer)", "value": "7e866f0d7c0f952c01559d3e58117fd8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696358317, "uuid": "cc8e8676-509e-4644-a331-bf72ae4b2d2c", "comment": "Malware payload (RedLineStealer)", "value": "32e15f06e7e2676a74651e81e87fc3bd89ed6b70ab8e3bccd3ad1cbfd92ff823", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696358317, "uuid": "1d9db842-39de-481f-b7bb-474dd459b00c", "comment": "Malware payload (RedLineStealer)", "value": "b9d99de51ea50c33bfe4873e50bd743933a3ccf3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696358317, "uuid": "3b47cd6c-24fa-44c9-92c4-f30a875d016a", "comment": "Malware payload (RedLineStealer)", "value": "24eb01d38f81b206149f676818bc8b846a1686f5626196145711f65a332786be43d8f1e3e3c7ae1fe153c94b974669d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696358317, "uuid": "c5f16cad-e5a4-42a0-842f-64c43043c2f0", "value": "T136C401A9D0F1C56EE6CA4435AE9431D966728043A623FBD8EDC8D9A8705E7C3D7C00E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696358317, "uuid": "dd48ed65-9e94-4158-a21e-6c16ab3a118b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696358317, "uuid": "2b315211-df49-4e55-8207-a9f251515667", "value": "12288:Kk9Xj2/ze3AisuLc2CHsRa0C6rH7NzNRcKBjA1fkcTsMSbSeNr:V5jC4fRLhCHsRo6r5zEGjAXsMWB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696358317, "uuid": "74361514-12a5-4dad-a2f0-fcf737988726", "value": 545280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696358317, "uuid": "0a35f617-1426-40e3-bc48-615ffddf995e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696358317, "uuid": "1edc4c57-838e-4ee6-bbe3-ee1066387b93", "value": "SecuriteInfo.com.Trojan.PackedNET.2418.11881.23560", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4bf64b2-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346190, "uuid": "e20b16e7-46ba-42aa-abd3-671510504c84", "comment": "Malware payload", "value": "feedf5d0232216011303bcf0971dbb7c", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346190, "uuid": "e9c17012-8185-4f16-b8eb-69a37f8316e8", "comment": "Malware payload", "value": "3357fb16fcfaaac427a760965fe987ee85b1c40a731e8e663e5a1b86fdd4d81f", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346190, "uuid": "befdc496-7943-4664-b88a-7a654ce547c8", "comment": "Malware payload", "value": "583fe7bc26faa8aa8fe009a5ae70d3495d0ed4ea", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346190, "uuid": "a8e8fa23-f610-4d82-85b3-a820d47c84cc", "comment": "Malware payload", "value": "acdc157fc65e997aa0bbc601d3387eb4dbf50dd7569f4ccaa7f3f07fc8a541420b96db1d702a77c69ff762a18c0fe162", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346190, "uuid": "b0a37280-e9c7-452a-a831-73930b21fc23", "value": "T1D1B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B890A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346190, "uuid": "cdacad8b-bfc9-44b8-b841-25740e985c09", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346190, "uuid": "6722a85e-180d-4672-8447-03c8cf8bdd28", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346190, "uuid": "47e7aa16-0f88-4a99-9b62-fd1be904f296", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346190, "uuid": "424ee562-c7ab-44f0-b2fc-c302761c36d4", "value": "AppleApp(182).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e516643a-61ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696316583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316583, "uuid": "efef791f-3a24-4db5-91bd-cd6d73657e4c", "comment": "Malware payload (Formbook)", "value": "a98fbd73262f445842542f1468307824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316583, "uuid": "7b4a9fe1-32a6-4ed5-b065-4b9c7605fc70", "comment": "Malware payload (Formbook)", "value": "3365f0fe697d468a8589961b708d9b05dd34a43f3c5d58356a83530c27d919f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316583, "uuid": "b6ef37a3-23bf-426a-8a76-70aed2aa50f2", "comment": "Malware payload (Formbook)", "value": "bb42a2171b78a76dbe3d6d6f4222483f74eb3108", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316583, "uuid": "5ea8b4f9-f3ff-4347-a55b-171abad70ad2", "comment": "Malware payload (Formbook)", "value": "79c785cb905a15aa69e8ce7f1e11009f1c7f61b508490033803dcceea3184467568148c38f39f0dbc4310f2d5edc2e26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316583, "uuid": "d73f48cd-20b5-487b-a780-fd554b66a17f", "value": "T1C084125BD3A9C187D2720EB02C3856275BF8B6362AD8874FC380B70D7917543D92FA66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316583, "uuid": "cd2baf6d-00e6-4ed0-9124-3d198db97d36", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316583, "uuid": "6682cff9-9c0e-4458-9a71-1d1006b98c16", "value": "12288:BnPdwwFW+e3e57rCbP1fGVCGY1mZK+c7YkICBIKB2gDuC2:9PdwwFW+WIvm9b1mbCBIKDDu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316583, "uuid": "b477ecef-06af-408e-b9f3-3cd437a43fe8", "value": 401740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316583, "uuid": "cc927455-1866-45e6-96ae-c9f732bd28df", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316583, "uuid": "531564d9-8a57-4771-a750-42f0f6f9d39d", "value": "BANK DEPOSIT #HR76.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27d8522-61b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696316095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316095, "uuid": "7920a68f-a612-4b45-afc5-8775a8977ef5", "comment": "Malware payload", "value": "e52db303ab306fb2393cc7ac6a3b2044", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316095, "uuid": "be2b3fa4-8ed0-4b4c-9e8f-f5e3489f6a4b", "comment": "Malware payload", "value": "339137a2917b7ce87a29c8a80ed879b5398155a681c755e7e53686b6a393bec9", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316095, "uuid": "b0fe1d5a-3bf8-421a-aaf2-a6cca829550a", "comment": "Malware payload", "value": "1d89ac923164cead0f8d318fe1ee856f5abf7d23", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316095, "uuid": "6301aad1-7dff-4c12-8134-83e8c6be12bd", "comment": "Malware payload", "value": "31f102d48998639e803abcf465e318bbfab3983b934c3b5c512ffc6a7fa7c1acf4afe1b06b2631729765b3de0d1bce2a", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316095, "uuid": "6230a1c8-c9d2-4671-85a7-f22bdb3bace2", "value": "T1C6033022618548761473C5A9AAF54F29FE428277CB069244F6ED2BDB0FFBCA0DD07748", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316095, "uuid": "90f12278-a45e-4403-a81c-eece4ff3bb22", "value": "384:Hu3Bvh209aWECcTmfiLK2D8DSsW8CMu5horKfBKMK2pwXAPyC:Hu3BZ20sWCTwdC5sSKmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316095, "uuid": "39a0f86a-b962-40ef-8949-c118565a3162", "value": 38246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316095, "uuid": "adb17d99-f6f9-4ced-afef-d7255915ddb8", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316095, "uuid": "960c575a-4db5-490d-bd72-5ba70d8bed56", "value": "Verification.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76c0c7eb-6231-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696367508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367508, "uuid": "0f470d40-0eb2-4db3-8224-863c7d3527cf", "comment": "Malware payload", "value": "5399fb6e453415e22574998ee5b44242", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367508, "uuid": "dff10d7a-4179-499b-b3ff-88e204e5c510", "comment": "Malware payload", "value": "33ede71b4b1c854c3af8d035947a1cb0e8bd6eefcca74eb17f42fdf002e0b856", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367508, "uuid": "f16c7366-df27-480e-97be-329807cd9c4f", "comment": "Malware payload", "value": "3d5ee081d6230987522b37e76cb9e41f5702bc62", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367508, "uuid": "9a283d04-81e5-47ec-88e2-31aef0499105", "comment": "Malware payload", "value": "5fe1b9a24b031327d8d6d144ef98e5a687d22646984e9fe371b816143dbec0919e4f3879e54277dbc018a49be92a4172", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367508, "uuid": "dcd16835-a377-4897-9a88-694e6e800859", "value": "T1C924011F78DAD494E01750B76116C377EAAC86A9A506D17F6BF84109AC30DA80B03FEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367508, "uuid": "a98755ed-76b2-4599-8c8c-5bdfd44f38aa", "value": "3072:xilYsXK53c0nlcI4xR4p8b/M95/nu9duVviB1xQkJ641whWPaG2/YdjiVNh+Zt0B:ElYsXA3CkF/TVuxQki0bCYdjKcZtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696367508, "uuid": "deb9b7ec-a821-4a4d-8021-84b8bfc5aded", "value": 224290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696367508, "uuid": "d4673352-230e-499d-add7-fd7b4e7f8846", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367508, "uuid": "72507f5c-4899-4b08-afc9-e788dd097097", "value": "Amazon10-2.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33309eef-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1696313278, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313278, "uuid": "7cce69bd-70ed-40e6-b516-8aa81c101f8a", "comment": "Malware payload (RemcosRAT)", "value": "69bf840d279bb17e387e74914a122af6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313278, "uuid": "3e6220ed-35eb-492e-bd91-cd1b95926bd9", "comment": "Malware payload (RemcosRAT)", "value": "343b2ad0290badf5ce4700a3b93866f63ef8157b157f09cb3c9da4f3efd1c1c2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313278, "uuid": "2b4106a1-e0d6-43f4-b67c-8219fb464cae", "comment": "Malware payload (RemcosRAT)", "value": "7c5e6a9c7107ed3ef251d5571ef2dd053165ec8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313278, "uuid": "f3abfef3-66b4-43fb-84b9-cb2dce836cd8", "comment": "Malware payload (RemcosRAT)", "value": "cf35876170a2c5672633e484c7c4fbb5f8160a07f9caf391b6cc78fd42353acbb1d30c3a4d562d518373ead6be0b6a52", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313278, "uuid": "6f197112-d7a0-47df-9e48-93e274483350", "value": "T145C41242F310856BDDF54F7168BE47124FA6ADBBEA936A0B13C437492B7335202AF241", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313278, "uuid": "a445b746-a04a-4ea3-b4ad-9e7b4f20e39d", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313278, "uuid": "8f18b90a-9738-4150-beae-d3dec1df48c3", "value": "12288:V0obxAhh3kCS/ylnAjQSLhBPlyF1+SULR2NpT5R:hlAoiFSnlyFk1LR8pT5R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313278, "uuid": "68bdcf73-178f-4370-be3d-6bcb81a13966", "value": 588456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313278, "uuid": "fb620fc4-17f1-489b-9181-ef2759b1994a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313278, "uuid": "9d80b63d-0efc-4abc-848c-cd7956c7b76a", "value": "file.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd7ee3a-61c5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phonk)", "timestamp": 1696321110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321110, "uuid": "469868bc-daf2-4e2c-b408-0605a7d9d142", "comment": "Malware payload (Phonk)", "value": "1b54e265ce3b7c65b480ab8014bf326a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321110, "uuid": "07814b8c-3f5c-4f69-ad97-2e01dc8349f5", "comment": "Malware payload (Phonk)", "value": "343ed81c3b97f9cff2d0ae5fe734dd1849d4d0fd3dd3887cde9ca4186ef91a47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321110, "uuid": "37a0915a-a1b7-4864-8837-bc1e592ab754", "comment": "Malware payload (Phonk)", "value": "7edd64b669f00bc13213867daf87dcd983787048", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321110, "uuid": "509a01df-a2a3-4d5e-a96e-8ff8bb709b88", "comment": "Malware payload (Phonk)", "value": "03af946fc254e9b6eb52cf5bce6776e975ce1730f9a8db9ce9b6b5a38e79e54fcccf016aa5e19637321692e4dfbae74f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phonk", "colour": "#69F639", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321110, "uuid": "624960d1-38b7-4b2b-bc23-5caf8acc9a67", "value": "T139E538447E428D66DE5D22F2DE1E159CDB10DD222F40A29B2AD2F5C9637DAD38C4E383", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321110, "uuid": "daa7d55e-7d8b-4ba1-a1ff-fd919de845e0", "value": "49152:MroptaZwYrKwg6fbPMVJQyh1u2/WoLLfXZ/6pkJbbb0Y:Mrcta0hg2JfUk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696321110, "uuid": "f1454179-e93e-493b-8fdd-61b945e83a55", "value": 3289088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696321110, "uuid": "526a828f-1a35-4040-b703-b134c5cfcef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321110, "uuid": "3594a088-e262-4303-a6f6-5a473191d0da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3efd7fed-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1696313727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313727, "uuid": "1dcae568-365d-4296-980a-f26be13fc6fc", "comment": "Malware payload (DarkGate)", "value": "be8c41dcac19e51aa5a3673478e7e676", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313727, "uuid": "7095ea44-8fd6-4e7a-a2d6-b37da2c09e56", "comment": "Malware payload (DarkGate)", "value": "34c7aec70b108d23a18b3a963bd14163d09f8242c7aef03fb99c320d0f094032", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313727, "uuid": "91bb4c2b-8d58-4152-bc39-6370d64e4d0c", "comment": "Malware payload (DarkGate)", "value": "9bea78de48503f96c1428690dda0dbd5f20ae39c", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313727, "uuid": "95b57e68-a6a8-4ffb-a635-0275ad4d9320", "comment": "Malware payload (DarkGate)", "value": "7b6469947506fbe6dfa8b54a0847f585efb2f952f76f63621cdcbf36323b478f07e0ae18308c7b268126aebb5dbb3ff4", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313727, "uuid": "2cd4ee87-cd4a-4e21-a720-87b10e34c402", "value": "T1834100153ACA8B3DE3B10C3A88A77325CA77B829E971430A0244DC8D5964240BDB9F3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313727, "uuid": "009bf160-358a-4057-9b96-89fb95a41687", "value": "24:8aSWJCnScMtQOvA8YK+cUCV+/J5GUakxJi85ir:8aomt8zK+8wo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313727, "uuid": "bceaa299-e07e-40fd-ac8f-a83720e20bbc", "value": 2052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313727, "uuid": "cc4035a5-6a37-4777-b3b3-f9a477844478", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313727, "uuid": "fc2ffa1b-6e07-41c2-b21c-3ac6217e568b", "value": "2AO.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4acf6824-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696345959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345959, "uuid": "fa16a59b-ba40-4048-9c46-bf8e6a112fe2", "comment": "Malware payload", "value": "089e46962657e664c9b5553cc215e137", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345959, "uuid": "5dd9f446-2882-44a3-a480-73b57c0dc399", "comment": "Malware payload", "value": "34d66bc650fb4ed9ff26d35e1acfa517caa819f6813d35c02b48fbf5ecc2fcbb", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345959, "uuid": "af0d46a3-a27a-49e9-8a30-f04915cd135e", "comment": "Malware payload", "value": "56721f2278ce623cbefd640eab669e6f8045cacb", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345959, "uuid": "a82c79a9-495a-46c9-b9c2-e8c7a778ad75", "comment": "Malware payload", "value": "6b136c9f301961318aa12476b5ebf363ba1bcd8384a60a2cde71fb2154d6f98975ed814a0dd56b49a319f898deeacb43", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345959, "uuid": "bf068038-8f49-4bcd-8415-aeb60a8a5acd", "value": "T18846C8242DFF109DB373AF694BD8B4FF895EF6632A0A64B9106103464723D81DDA2739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345959, "uuid": "998e43b8-41a8-4a99-9ff6-0736519bd81a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345959, "uuid": "6a55dfe8-422e-4d4d-9844-757bdd6f94b1", "value": "49152:qWM5dxpUyU+LrDw2fNHRoNrbG0aesh/a0C38ICjyUd1weqBAPtKZ0YwPVfYoOTGN:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696345959, "uuid": "07e82c6e-5915-40f5-8e8c-e615921cdb5d", "value": 5694464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696345959, "uuid": "68e126e5-bac0-4bbd-9101-3d21a2ba6d3b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345959, "uuid": "6098efe4-83a8-443d-b403-e6cfcb987d31", "value": "VisualStudioSetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ada6f086-61c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696322502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322502, "uuid": "5788da34-da4a-4f73-8908-dc32bee19285", "comment": "Malware payload (AsyncRAT)", "value": "35d084531b1a07ab40b88a7a5abe47fe", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322502, "uuid": "06a52721-75fe-45cd-acd1-25186edb0e87", "comment": "Malware payload (AsyncRAT)", "value": "34db481a4a12573be41a3817e1f25d366a335666561db6fb7c743e471852af96", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322502, "uuid": "1abf343f-5d06-461c-80ec-66fa586619de", "comment": "Malware payload (AsyncRAT)", "value": "ed83bd462d47c55ca63c0f9e5a54ce435720438f", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322502, "uuid": "7b66d6b4-6573-40fe-80fd-ffbc2b1cc21e", "comment": "Malware payload (AsyncRAT)", "value": "e9c8d77535f7184138e0466cde64accd2d40e800b2f06a70914c0567629012aa80a8060621df4bd4a2f5727eb3423acc", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322502, "uuid": "ad13c452-4082-4f8d-b38e-d53284134435", "value": "T13274C181D34DC83BDC0F796FA6563E16C5742BE2DAD590AC8764784866B8E12098CCFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322502, "uuid": "bac25b3f-d437-43de-8e5a-02b299023a00", "value": "768:Hzlndvg2VI2EWZhpu753pOk0JBl6tmh14fCvCFUG2aTuCvR12BLpD/k6gFXxGdc7:P2tp5+c73a3VIdiqUv79x0VJFT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322502, "uuid": "254c4619-398e-4969-abba-84cffd605b64", "value": 338398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322502, "uuid": "c3c041b9-cd3c-4e4d-9bda-44eec2a7ce1b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322502, "uuid": "488e2fb2-c189-4f37-9a31-d9c3c205ccbd", "value": ".xxx.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a6e5baa-61d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696328725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328725, "uuid": "3e910604-403d-4cc1-950e-1b1ece4bd54e", "comment": "Malware payload (Mirai)", "value": "bbad33c80d69dca48650aa396b0c662c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328725, "uuid": "f5e7eb12-dcda-4199-b172-535877c6b19a", "comment": "Malware payload (Mirai)", "value": "354cef39dbf2e9a91f9a147a8ae21b826d32dc9a5d825d379d76783b16cb0d83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328725, "uuid": "5685e296-cfc9-4008-98f3-f28e7b617650", "comment": "Malware payload (Mirai)", "value": "4d0ea42da1549702c22b45775376cb45ebdd2e25", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328725, "uuid": "431b3f68-4128-4ac3-acaf-4c379d3259c8", "comment": "Malware payload (Mirai)", "value": "40d4628f9cf1185d2615c3bb580deb766b8ddfc5322e117138a91e949cdbad51fe5275bbc433832ea416c64465e6cc9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328725, "uuid": "6e1475f0-f010-4373-98de-a7920caf0082", "value": "T15DD2E11CDD1DA944D56D3EBD40DE61B6358C6480A369EA8E1722C818EA27F4BFC4B0F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328725, "uuid": "7c305fda-0382-4575-ad7b-0c858e8b015e", "value": "768:K1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNxbdJbpWGPOX:KbDs06t4BEub4sU/MbUxbdzPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328725, "uuid": "d61e408c-2468-4a1e-82a4-34d9603cc827", "value": 30548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328725, "uuid": "8729cefd-7956-469b-9577-4f96c2bcec80", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328725, "uuid": "1c000c85-249c-4c2a-a851-5a49a9f71246", "value": "bbad33c80d69dca48650aa396b0c662c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a0e5489-6194-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696299975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299975, "uuid": "1dda93f0-494a-496a-8648-fd327058f719", "comment": "Malware payload (RedLineStealer)", "value": "283d2a195407b09cae7ad7e968242499", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299975, "uuid": "4903de0d-91a6-425d-9bd9-1922cdf42bdf", "comment": "Malware payload (RedLineStealer)", "value": "354f49185bb77b7100cea985fe84ff6b82ef9d0d1850c7d1f3a5be2565587815", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299975, "uuid": "8feb3a4d-873d-4cb9-abb9-20443eb6c08d", "comment": "Malware payload (RedLineStealer)", "value": "ffe50b99c02f892e10404ca368606abc7327da79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299975, "uuid": "e3813b87-3b5f-4b0c-9b36-76be1b4a037d", "comment": "Malware payload (RedLineStealer)", "value": "96b9f58a2b94fb79335f4a88ac20bd3c1a06c8921a567d4252b3ecf9d1a0b4299c8b76381bb8c68f1ae9c85dc36d9745", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299975, "uuid": "2aeb4155-d5a2-4b3d-b850-c25cd52023c2", "value": "T149842884269C26AFE1EB1B71103294D1CD17D3A862A4693DB2F36077F9B0FB7562C217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299975, "uuid": "197bc78c-2b39-440e-9553-1896d7a43a77", "value": "f707ada0aac189999ec6eb4a5a71dfbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299975, "uuid": "e81cb428-5093-4833-a7aa-309e3c1bc791", "value": "6144:3wook1KQkXHfCz35J82OO5YNG8FA6pn7jFb5kNko6/ldpRxJg9pPIwohvaTO4:Wk8j2OO5YT6ifFb5kS+W4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696299975, "uuid": "87f2c007-b961-4ef2-8b20-2d25836b5acd", "value": 401409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696299975, "uuid": "19989a17-3185-428f-a74e-887987ca0eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299975, "uuid": "237d231e-5ffb-4200-89ed-619780006773", "value": "283d2a195407b09cae7ad7e968242499", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "194049b5-61c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696322254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322254, "uuid": "eae956e5-7642-4cd2-8349-fb9cfac41479", "comment": "Malware payload (AsyncRAT)", "value": "f28440ac7b4b695b3ca845d39e0e4816", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322254, "uuid": "25f39f6c-ce47-4ec3-87fa-29b04b474379", "comment": "Malware payload (AsyncRAT)", "value": "3599b6519c4dbda4c2c4cc9639f6dd26a779f61bf4e144294d4d5c1c435100d7", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322254, "uuid": "3abe2111-23d5-4c09-8c61-da2ac0438b6c", "comment": "Malware payload (AsyncRAT)", "value": "b9b289560e3ecd15c6fcff2bd22941073728b2cf", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322254, "uuid": "e16acca4-fd31-449d-826c-cf4a1c2c39e3", "comment": "Malware payload (AsyncRAT)", "value": "4efca82719285e491ecc5b35d22a9d77f0776eafb245a8b3fd9d21d259a8d51fd51e41054aa897bea62e1abad3d6a9eb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322254, "uuid": "a59a4dca-f22c-492f-98a1-2280d7cd5687", "value": "T12413F113DB8B0971E44EF67EDBCB890A75ACD21E14A4C1D50F8B64B145FE3522FA112C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322254, "uuid": "61db0645-3d77-431a-a6d6-1a7e357b381e", "value": "768:885NgbNNw3EQ0Xmzw7fsYqqDwJ23byR9FUHfMB73LcvdpN2:v+v17f/brQ4fbv3w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322254, "uuid": "7aa0ca87-9a20-4402-8608-d3f5295be4e6", "value": 45065, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322254, "uuid": "32338d75-6071-4f5e-bdc9-1fcafe7b9187", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322254, "uuid": "f3f8720a-d626-4bd5-aaff-9dafa3c493d4", "value": "cafiii.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64717724-61df-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696332258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332258, "uuid": "10f06c4e-5648-4b30-ac74-7b5035c2c13a", "comment": "Malware payload", "value": "ce42454a2bfc48ff011351a2615b471d", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332258, "uuid": "ea3d26b5-1cb5-4759-a63f-476597123fd8", "comment": "Malware payload", "value": "361a51eda57aa57e73c223695db55bc96fb3b2924a4563e062de63decc34192b", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332258, "uuid": "57b30968-a08a-45b9-9d49-87f6c14bc219", "comment": "Malware payload", "value": "72f7188ca97f4b159e987c1655e9c979a992c6af", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332258, "uuid": "5691bdb8-d24a-4aa3-b924-7556e9372c8b", "comment": "Malware payload", "value": "261b5b870c8cc588df786263faea1a6c54fd18ed78fdab11d2af5f0b36d3660e1a736a869309862e859f88c0b2010f35", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332258, "uuid": "4410daf5-61c1-4101-ba92-95b8effe0f0a", "value": "T170B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332258, "uuid": "0a89fb9c-ce89-4059-be8c-bd0f92e3aa37", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696332258, "uuid": "a0e3e2c5-8b0f-4011-b35d-e0cbc36c2de0", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696332258, "uuid": "4f98f552-b826-408d-942d-4775f57800aa", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332258, "uuid": "7c14a9a1-d220-4cbe-8619-817913800ee2", "value": "AppleApp.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832ba5b9-61f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696341329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341329, "uuid": "86f95478-379a-420a-863d-1a435d0f5251", "comment": "Malware payload", "value": "b77f474548189d0acf35ee23f0bf87b3", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341329, "uuid": "ba72d4c3-8349-46ec-922e-3537fb71877c", "comment": "Malware payload", "value": "36e8ee02a3fb09ba7d2fdf382486f616610c667bdab4cc429decff6eba0e6427", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341329, "uuid": "ea7b040a-71f6-4e37-97b8-5d5569921635", "comment": "Malware payload", "value": "cc0b08e9035b0cd33d9ee49b1fd9449bad6978eb", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341329, "uuid": "336bbf17-0313-4596-9dd8-5c265c69366b", "comment": "Malware payload", "value": "f95670e80d537584152cbe9532c606697d64ce9142fd142aab5ef9df2a008f9f42c597a6f6797d1bd203dc0d7ce9fc90", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341329, "uuid": "1eb52e02-bea2-4729-822c-27cd070859ab", "value": "T1BEB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341329, "uuid": "71cf2244-bed3-495c-afb6-e8e6d811fe5b", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341329, "uuid": "498d4650-bc64-4bd4-a494-ea1d28c07c87", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341329, "uuid": "b7633307-706c-4dc0-9e8f-babb2b72762b", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341329, "uuid": "5259486d-7a34-4042-a41b-addf13f2d766", "value": "AppleApp(86).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20fa5b06-61eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696337299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337299, "uuid": "e4b131e9-c8af-4450-9feb-16e2dfac708a", "comment": "Malware payload (Stealc)", "value": "e795e3057192238233dda7ca9b383b46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337299, "uuid": "4e618152-4d33-4106-9c5d-500b668d4057", "comment": "Malware payload (Stealc)", "value": "37598ef0d60434956df3670b94e6dee091e89deb67e9eefa820c24312923f8b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337299, "uuid": "d46fc59f-dfb6-4862-ba88-38d500761a78", "comment": "Malware payload (Stealc)", "value": "6abe077bc96256ca357e655481a1bf97702a8cf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337299, "uuid": "167b2713-2ed9-4d08-9406-966b206053c2", "comment": "Malware payload (Stealc)", "value": "7d120ff6cc9f7336b7969234cc1fd4a8e9c88618aaac5d00b5963ada2163f4401936d071c2d58cc0dbcdb8d492f39747", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337299, "uuid": "a23b25c8-7cc4-401a-9353-23961d369480", "value": "T113549F1277D0AC25D4661A314D29C2E83B2EFCA19E6963DB33583F3F59701E19A62F43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337299, "uuid": "d29b1530-5b1e-4e7b-9555-1351cc4cb69c", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337299, "uuid": "682a3f03-4daf-4106-b5fc-ec0fea015ba4", "value": "6144:uS9EYv9UayReL6CKOoZPMg2wG/iGYW6c:HeUKa8gfpiPMg2x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696337299, "uuid": "582a44c6-a671-4c6b-a59c-994bf72371ea", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696337299, "uuid": "911c96ac-f7cd-478b-92f7-54b6d85ac33a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337299, "uuid": "455ee6d3-6a18-4fee-a3e6-6cd4fd736fd0", "value": "e795e3057192238233dda7ca9b383b46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0abc6e64-6199-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696302043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302043, "uuid": "7f36b675-a081-4651-8c93-fcdd6e65ab6c", "comment": "Malware payload", "value": "4f9108475bb4c91d9adbef204b56c255", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302043, "uuid": "ec4220e0-f28b-4d44-9153-47e518143f68", "comment": "Malware payload", "value": "3768b1287059ec707ca88b7e3d30f912c25426533504c5422cd6d89ec34ea12e", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302043, "uuid": "5a5755ae-e117-4ad0-a5db-333f7772d92e", "comment": "Malware payload", "value": "1e18617b94125bda9c5fcd75420f5c6d71eb6bbf", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302043, "uuid": "5cd60e64-5f74-4efb-b15d-4bf76e29ae0f", "comment": "Malware payload", "value": "c0cbd7e00b6d8b8b8a2eeec80f7deb2a738de0a0401fd9a5c0b2a9eb2b7eb227e22229beceb049e57ce788a052b2745b", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302043, "uuid": "42578f83-02b2-4aab-ba45-da17691b59be", "value": "T11AE02650839A8EA9E583D4FA98A75B165475D98488A01215C8EC7C7F2D4738626452C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302043, "uuid": "41a10862-a001-473b-a7ce-6e433d38bae0", "value": "6:5jEPtL3U/5NlGF9LT47cQyiZrQyMbivkX1DsxOc2ySBPtnv3U/p/KMHu+lBlXn:5ju+NyLJiZb8XeBcnqCMOaBlXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696302043, "uuid": "fa3c4b55-80c6-4b5c-a3ed-85f04bc6c392", "value": 347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696302043, "uuid": "edf93658-88c6-46e4-ad77-9227fe04782b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302043, "uuid": "cafb4d6c-f8fd-423f-8f6a-b33ed47ea1dd", "value": "Organizzazione854.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e8b4fba-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374366, "uuid": "a1166cdd-4828-40d7-8da9-2a5bb07e3751", "comment": "Malware payload (Mirai)", "value": "566db213e51dcd4ca62b937586880e37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374366, "uuid": "0c39054b-93c5-4e2b-b33c-9f2c2f4c9a48", "comment": "Malware payload (Mirai)", "value": "39b1d63ee83daebdc88f1379f82eb346d39702bb7b63867f6aa256c45d661e03", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374366, "uuid": "6d941a5a-b0fb-4fbb-a481-33e16819a021", "comment": "Malware payload (Mirai)", "value": "bef44153da8f5d57fbce2911ea539d859e5a5480", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374366, "uuid": "034983ba-b6da-4202-85ed-d63a1f6e5447", "comment": "Malware payload (Mirai)", "value": "d959aea894a0b3881c99e97d9d0053c4ded7732dd335f47c690a43742805b590eb17bc084c6e352659ad64dda7ddd5c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374366, "uuid": "7dd0df08-e02d-4a0f-8517-b1c37c9ea2d3", "value": "T12A431795BC919A12C5E422BBFB5E418D332523B8D2EF3303DD212F15779A81F0EA7691", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374366, "uuid": "4811b93e-082c-4dc4-8f00-d42a725fbbd3", "value": "768:OZbXSAt9KcoBRO6DOGtZrzTW7bZsxVI5S7yDvJpompkpPh1P+Jt5DKR7debNLaLa:6XNtIJZrvKbZsx+nkpPh9at52OaYJVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374366, "uuid": "2cf63b8f-1efb-4597-b28d-1aae3c8825cb", "value": 58300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374366, "uuid": "250437e7-9bd9-4cdd-ae72-bff1ed31f7d5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374366, "uuid": "301937cc-fb1b-40fa-b6c8-c4ae4b540d6d", "value": "566db213e51dcd4ca62b937586880e37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce030782-6187-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696294639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294639, "uuid": "73f5fb4c-14c6-4d38-8fb9-7272ee542a65", "comment": "Malware payload (Mirai)", "value": "8e288d9eb08445b1cc6f3c83242bf95f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294639, "uuid": "5695e94f-5414-4b2c-bec4-bba4d73a71e9", "comment": "Malware payload (Mirai)", "value": "3b73d8e5ad4874f224c525805ac71221487aa1022146c2a3fb8fbabbf024ee1a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294639, "uuid": "4f00ffc5-223d-42b5-bdeb-933d6db54a15", "comment": "Malware payload (Mirai)", "value": "897fe9bb00f93f22f00aebf9653f6b5662b2bb03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294639, "uuid": "3aeb4eaa-c27b-4325-84fe-0a6b9b8b34f3", "comment": "Malware payload (Mirai)", "value": "adeb9cf44bad30a1d0831e0d140bd4522513f29d056f58744a5f797297b2014a29823aa4f18c4109ba602e047246bba4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294639, "uuid": "bad9bc48-03b9-4bba-a9d8-0dacf8551fe2", "value": "T14203F24096DC11ABE9201CF99920D28053BB47BDE135F9632D79EC90BC5080A6FBE95A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294639, "uuid": "fdb7644c-f282-490c-8c2b-2367bb499998", "value": "768:l4yvMYH3qPIxB3Sh0kCAQj2csdQU5vk32KmG+Dh9q3UELrkT:l4vkZxB3SCkWFsd2GKmXDULq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696294639, "uuid": "799c89d8-f11f-4cee-83f6-0b2600938a23", "value": 37928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696294639, "uuid": "7359c910-9560-48ff-a0cf-5ec0f94b770d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294639, "uuid": "200d409e-3e91-44a5-99b4-78991219f7c8", "value": "8e288d9eb08445b1cc6f3c83242bf95f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e1517f8-61fd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696344998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344998, "uuid": "0296ac2d-051e-4f3d-9a41-031c4ff6d10b", "comment": "Malware payload (Smoke Loader)", "value": "beadcdac159c40cca0b563f706f635d2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344998, "uuid": "8487ddea-f39d-4901-a4e9-62468f9969d3", "comment": "Malware payload (Smoke Loader)", "value": "3bb4266482ffb1bafa94082f9f98831a2367c103185437770908d9179d0d1a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344998, "uuid": "ae1bac75-bab6-45bf-b35f-1cdeaeac36cd", "comment": "Malware payload (Smoke Loader)", "value": "72fca8510678cabb1b7a38d89291e89d6d44e498", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344998, "uuid": "77272752-ba11-42f5-9b3c-9d35c28288a9", "comment": "Malware payload (Smoke Loader)", "value": "b9e377369178bb9ae0a0d45e0d9267f2bcda5c43873b5f69de6ed45e0a1c0d5217c837c132b11c6fd9eba4e903a02911", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344998, "uuid": "42dd0e5b-ff60-4049-a081-c4b2763cfd7c", "value": "T18254AF1373D0ACA1D4725A719D29C5E43B2EFC918E68679B32583F3B59702E1DA62B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344998, "uuid": "7caace27-1dae-49fb-b986-bf2de4b2bef7", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344998, "uuid": "64e22aed-8c21-4199-84b2-d3c4b8694027", "value": "3072:Pq8ltmvKdVaKR/LrLKITqBTXRoZnylSfc3Ns8QY:y8lcvgVaKRDrwIyIcds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344998, "uuid": "0fe436a9-ce69-4e42-8763-6673409a4f63", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344998, "uuid": "3739f47f-987c-48d2-8f50-ccb464759c7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344998, "uuid": "48fe10e2-9d50-4316-a863-56a421591743", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7890463f-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696336587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336587, "uuid": "18aa4da8-28b6-483b-baca-367c2ef9f226", "comment": "Malware payload", "value": "1849ba438c0408a14af9689c1212848c", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336587, "uuid": "042738b0-0303-4b7d-bb25-6d062fb3e605", "comment": "Malware payload", "value": "3c5848a31bdb6e3abcbe76b985cc0d5f69ed55359d8fdd34f12dd76439737b5d", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336587, "uuid": "82af4c04-7800-4e48-9dfd-62a540b59953", "comment": "Malware payload", "value": "617524f45f6081ff37ada2ee7c2a8ed811b62bb6", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336587, "uuid": "9b43f576-24fc-4639-bed4-918d9c85674b", "comment": "Malware payload", "value": "ff7b381cc672f1a427a89ea6fab4de203ab15017665ab8e19974f14ccaf58f2d9f2e4127b5bfa4d8a5d0cdb978b4381b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336587, "uuid": "763e8915-ba3e-4cad-88c6-2d0f7a255369", "value": "T125B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336587, "uuid": "11190696-93e6-4a9b-8bd6-bcc68c0fa3b3", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336587, "uuid": "146bd473-e267-4006-9a32-135d971eeced", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336587, "uuid": "2082ff64-77fa-4a68-9348-e5bfc1b646d4", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336587, "uuid": "316810e4-5e9c-4661-be6a-a9a51e48fafc", "value": "AppleApp(97).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1563b706-6248-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696377223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377223, "uuid": "af9da9f6-c1c0-479b-ba6e-cafd499c3cfb", "comment": "Malware payload (Mirai)", "value": "9bac261269f577e55377306464a5a967", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377223, "uuid": "b8f1ae5d-bb3d-4305-b22f-832d85652a38", "comment": "Malware payload (Mirai)", "value": "3c88ae44047104ce68f6d09af8cdddb96afccef7ad3f638d83a5a73b75bcc727", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377223, "uuid": "2c07da0b-3e0b-4b3c-8abc-4ea4c6895349", "comment": "Malware payload (Mirai)", "value": "9a979b53a339a04341322c65076679c57724618a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377223, "uuid": "c2371389-8032-4e58-b5a6-fdf799bd9125", "comment": "Malware payload (Mirai)", "value": "8df20d8cc7a4ae2367f69d570d36af71b54b108c0939c89677109056f87301e3acdfc581d97e3233fc4930da3f2af05e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377223, "uuid": "0365544b-13c6-495c-b359-8c5cd7277b44", "value": "T132244C46EA418F13C0D617BAFA9F414933339BA4D3EB730689186FF43B8665E0E67605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377223, "uuid": "36477dad-1a55-4e7b-8c96-7e9e120b2b2c", "value": "6144:YkWL6hye8c7Hj+WxaQPr1Fcn1Sb7ruSBg/2d1aRjKBOd3FNM/9JdjXmKw2cg2UoS:YkEhy7ZxaQJFcn1Sb7yx2d1aym6/Ldjt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696377223, "uuid": "ecf6a243-81a9-45ac-93a7-ae739312b571", "value": 220306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696377223, "uuid": "63f27bdb-40f8-4c26-81f5-cc5aa8cd6606", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377223, "uuid": "67d24090-f327-484f-a439-112665e4e3f1", "value": "9bac261269f577e55377306464a5a967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132e2ad6-6248-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696377219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377219, "uuid": "bfa2a142-5ee0-44fb-8ea8-0b44f2e6a68e", "comment": "Malware payload (Mirai)", "value": "c519e5a7e8ff0a5a1d81a46bca0b5272", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377219, "uuid": "2a58afe8-2d6d-4493-bf62-944c9c44e9c1", "comment": "Malware payload (Mirai)", "value": "3c8debc32ba1e5581d63a7ecd54466bd753bf245b50bedbe421f2a027044196a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377219, "uuid": "c0a497e0-8866-456c-9ecb-2ec87ea058a1", "comment": "Malware payload (Mirai)", "value": "610f1606b4376f9b751cdbd8c5206fb89b90609c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377219, "uuid": "3b2255eb-328b-4acd-970b-b85ab55a7214", "comment": "Malware payload (Mirai)", "value": "29689e1e7cd1a4c42d1c51134c0e9c91f8f4b965d7edbcc99679c5114262f65d598a4b3278c5fa4dbb678b0b7b479b35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377219, "uuid": "83060aa0-9cd5-40c3-bb25-3f74a22080e5", "value": "T112339E77D469ADD4C1488274AA3ACE741B63E11086A73FFA9A59C7668003CBCF7193F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377219, "uuid": "8eb39ebe-58d7-42a4-86f6-c899e840a9e8", "value": "768:BaYwtHHXAB6qEU0tJ9/74vPbWbgSnR0PJoPQfC1V5ML6os7gCFcc:BaYwtHrZDDV4CbZ0PJoPQfO5kOgCF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696377219, "uuid": "dcdf464a-d167-4d47-88be-8b750f85e919", "value": 52440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696377219, "uuid": "1add726a-78ec-43f2-8d7b-a7c98a1e2550", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377219, "uuid": "7136b059-7d00-4ade-916e-af1f6a75d9d2", "value": "c519e5a7e8ff0a5a1d81a46bca0b5272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5749acec-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347268, "uuid": "516d7b23-0180-4565-ad26-986749d0c47a", "comment": "Malware payload", "value": "64545d7898164555eab2602cc797f355", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347268, "uuid": "148da8c6-6c44-48bb-8df5-bdefb79ff385", "comment": "Malware payload", "value": "3dc9d061586d244177db2aa2521846fce358640ed1f937283dd8d7e9e68bf1d9", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347268, "uuid": "ce77417e-dc00-4b69-bbe0-50ef8091e0cd", "comment": "Malware payload", "value": "a752ac11fddc123ec3939bdedeeb12afef8d21bd", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347268, "uuid": "530c8663-fb1f-4895-8994-7878a022f4b4", "comment": "Malware payload", "value": "a711dccd70d1478a68d204aaf22755070e5b453db128f989a2f377c7c1024002a94ec3b11b22b9c3f960c451e4a74f38", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347268, "uuid": "8545d141-4de1-4f9a-887f-144c8b9c9708", "value": "T156B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347268, "uuid": "44816703-e6e8-4a3a-9d57-af3fda62dc4d", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347268, "uuid": "8d88cd91-ef91-471f-bed0-3896ccd27a29", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347268, "uuid": "5e6a90f6-dcdc-49ab-baf2-549a6a7e434e", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347268, "uuid": "ad659720-6a15-4c19-af00-bce246812d66", "value": "AppleApp(236).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f8f760d-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696340947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340947, "uuid": "5d7fe3ba-c879-4045-8739-91dbaaef7e41", "comment": "Malware payload (Formbook)", "value": "279b67bd99398311b8bd9e633b3fc6a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340947, "uuid": "5e0c4ef0-7626-4fd7-93cc-d0a7209b8483", "comment": "Malware payload (Formbook)", "value": "3e940bd501847e7bf60b525599626211d32f705d7c616584629a5dc0206bc52d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340947, "uuid": "30f75ed2-faaa-4c4d-b098-abea4fe3dd0d", "comment": "Malware payload (Formbook)", "value": "f472edc2b7a4ef96f5bda3f9c79436729051904b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340947, "uuid": "70465cc1-381b-4cee-b77e-cb880efb9847", "comment": "Malware payload (Formbook)", "value": "4897b2df9d478ae0b50e5f68d2cbea35ddf30bbbcc130f57793022769b4fde54223f481aa642620a1a5ad22ebd514ea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340947, "uuid": "f8ea9138-ec29-4753-b1d8-d2ccac895a6f", "value": "T134E412093BBC8578DA6ECE3E1273445203FF7109BA54C38A2D8764C9EDD73934A85B96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340947, "uuid": "fa5c6a84-da47-4807-b1ee-58a5f0aceaca", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340947, "uuid": "0403f890-a748-40e8-abc1-d2de6cc02127", "value": "12288:cpEiSAx5PWPQ5PgV7CvgMAWiqwEShrPOn0NIrb2a0P:cm7Ax5uPi4pCB9ieCPOaIr6a4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340947, "uuid": "9e215900-0873-4af7-b826-2f2f65c925ca", "value": 707584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340947, "uuid": "8c64d565-33a5-4731-932a-487a606a3b76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340947, "uuid": "3a2aa455-d6f8-4c59-97bd-f7bf25a6e9f6", "value": "Quotation 78957.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1153b14-61c2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696319904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319904, "uuid": "4bcb0449-c77b-467e-b667-63909729ff05", "comment": "Malware payload (AgentTesla)", "value": "2f94639355e43f44bfb2167207bf6e17", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319904, "uuid": "3252415a-40c3-4a38-aa96-656e3d28b4e9", "comment": "Malware payload (AgentTesla)", "value": "3ead70e86af04ce4441ac9da7ba8238e4a006466954c3a8d9e44e17f4e920652", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319904, "uuid": "db1d3a46-2830-45d4-bafb-4bb9c3bac523", "comment": "Malware payload (AgentTesla)", "value": "61fbe9869c03bfaf31237382a476bb32d7c3fa1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319904, "uuid": "0bbf1885-e997-4a62-89ac-de93d370cbc0", "comment": "Malware payload (AgentTesla)", "value": "d50692016bc2e11179f6f28e7a6d85129e9cbc9f10f990b7054e9a7e3ccf630b5b015b1eb526289de5852b720695a39f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319904, "uuid": "9ccfbbf1-7987-4187-82ac-3eed500c5c33", "value": "T1C555D00B9414EB87C00947F87E137D990F0E7F19A7D16ADB14667B8B3F346A218CA29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319904, "uuid": "14f96306-ca16-4d9e-8a7c-c54ef8724f96", "value": "24576:EWQmmav30xWutxZyNw6V8tdZ2LH6ZyCw6V8AXZS945JYLJxbT84TgJmrWjfwqx:ZQmmQ30N756V6Te6V7E+5JYrT7TZrWDZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696319904, "uuid": "41acd629-8446-42d8-987c-aa42b6b8420d", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696319904, "uuid": "9087b1cb-f514-4cba-ad34-344f9767c2df", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319904, "uuid": "25ce1301-77b3-4df1-9d1b-a265705020f8", "value": "260.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c968bf-61f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696340124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340124, "uuid": "fb9e69fc-8f88-4a94-abbd-0d3a4bf31231", "comment": "Malware payload", "value": "b902839c87b4aac8d4ef2be82674357d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340124, "uuid": "23e39e2d-f877-4996-b477-73cef1b7ad06", "comment": "Malware payload", "value": "3eebb28d9523241754ce6569d77e8b2b125c2d720c6ed0dfa48b08e313899eef", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340124, "uuid": "9e98b365-2911-4a4e-b94d-9c476df89519", "comment": "Malware payload", "value": "ae54f43f88dd439c73fde68479c2e6321f8f7d90", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340124, "uuid": "53c5f585-d0b7-4698-b9c6-4e6ec979a5a6", "comment": "Malware payload", "value": "a864be96b30d3b82f929c197daf0438d545f5985469d50d4c26cd4d20968e11907276510149a80a6a1cf4ad6186e9935", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340124, "uuid": "832ac80d-5b4d-4b89-8cc9-ab7932bbd8cf", "value": "T177431A95FA855B12C6C1127BFF1E438D7B1B079CE2E973036A29AF3133874660E6E491", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340124, "uuid": "cc82209e-4717-4280-b469-86a7454562bb", "value": "768:bGMuMd91AbW2RoYMlJ58w9qum3PIE+GwFV3NYLglBLlSDGK3I:CMjbqW2YlJ5Wu1VGAD5AaK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340124, "uuid": "9aab99a1-9980-479e-9941-fb87dc3b876f", "value": 58856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340124, "uuid": "0f20d592-8bbc-4dc2-80b6-21fccf5fd4a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340124, "uuid": "3225cb8a-06ff-4d9a-a158-191f1bcad746", "value": "SecuriteInfo.com.ELF.Mirai-CKM.3626.20072", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a1093b-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (njrat)", "timestamp": 1696343664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343664, "uuid": "daba6baf-b251-40cf-b026-10099cd683cb", "comment": "Malware payload (njrat)", "value": "e782fef1056c8725e60e298742004176", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343664, "uuid": "436a5fa2-cdf3-4eaf-98e4-d15b6a15b429", "comment": "Malware payload (njrat)", "value": "3f9af37fe399e8cb8eb4e61f7541901788ec1f4b63f99a110fa025421010df43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343664, "uuid": "05f26a48-d4d8-469e-a13c-c1bf2955d940", "comment": "Malware payload (njrat)", "value": "4dadd7a9364d8a33751005c78d816871512f3056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343664, "uuid": "01027be1-d3ec-4cac-ab7b-41c82fe2fbba", "comment": "Malware payload (njrat)", "value": "d76de0b978d726e8ce801984fdee076c45cb7f456376353f25754beedc532b209be4fe971da5f3febe75ae2b6b3b5953", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343664, "uuid": "0761844c-5e4b-4d1d-a66c-cc9e1c4907a8", "value": "T126E2084677A58229C6BC1AF88CB313110772E3438432EBAF5CDC98CA5B676D04245EFA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343664, "uuid": "bed99db1-8a3f-4a9c-95de-1e17e6a029ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343664, "uuid": "c819bfa0-894d-4b1a-bfc0-b157cfc306dd", "value": "384:w0bUe5XB4e0X0gONaiaXLilpknD+WTCtTUFQqz9TObb4:1T9BuizaXWlRpb4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343664, "uuid": "706a02b2-4574-4581-920c-0071ca865682", "value": 32768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343664, "uuid": "e6beae1e-2c55-4add-a512-43f17b16267f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343664, "uuid": "fc504433-5620-4fde-88cb-4612f94b2bf6", "value": "xkX69dIw9KOs.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "028d3750-61de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696331664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331664, "uuid": "fd7e1685-d6af-4ab6-adf7-c8872f19c443", "comment": "Malware payload (Mirai)", "value": "58d62f4a51281b235ba6f5597bc171a0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331664, "uuid": "52596bd2-2b18-4083-952c-4e68641fc083", "comment": "Malware payload (Mirai)", "value": "40399eb89b84197868d42f1a2bb28e48d83eb0b2232b7fe3e31d14e45a44be85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331664, "uuid": "e786325c-357f-4fba-8e92-1ac528659b5b", "comment": "Malware payload (Mirai)", "value": "12ffca6c01b745fbde106823aa7e63d2ee5aeb9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331664, "uuid": "f6dddcc1-636a-44af-9ee2-ce67dd3a46b4", "comment": "Malware payload (Mirai)", "value": "01f0816b241c5eb7c7c7a34319769e77afd6d231ff3e74b8c8100c364da0b7c6a15a9c8a0b213e79d06fde198381fff8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331664, "uuid": "cc07f8dd-0720-4c64-a15a-f3208272613d", "value": "T16162C0F6FC53B1F9FA21EF38642D47CB7389D85092648A242B5309528C3752AB11A1D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331664, "uuid": "985d152e-af9f-4a69-96a2-76bc0e23e3cc", "value": "192:JxQiv6L2EHIvJ2DcbZ1CB8WfGGJSKnUaN3UKNWaQ49PLuaWHUxaf4kd2EHEes3UY:DvybOY64BdfZHnUQEKAaPuaTaA9Ejsr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331664, "uuid": "d2883d0e-802b-4626-b866-21046c8c7ba3", "value": 14540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331664, "uuid": "28d742fe-3bf7-4fac-9241-5b4e6678eb03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331664, "uuid": "6b47dd22-184b-4a7c-a323-254eb910d7ee", "value": "58d62f4a51281b235ba6f5597bc171a0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63d49e60-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374348, "uuid": "80a9ec58-5e53-415a-80d5-150fa9216bc9", "comment": "Malware payload (Mirai)", "value": "a372fb03c19106d4d77f3813c66a0c6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374348, "uuid": "837c71da-9688-411f-9648-cc256a99241a", "comment": "Malware payload (Mirai)", "value": "404762da5ab632fadd7bdd666a23614e8309a1d9e1022fb6bfb7e2195130c728", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374348, "uuid": "e3878e1e-1ed6-4ef1-9909-c5b353feb39f", "comment": "Malware payload (Mirai)", "value": "751cd8b1e48a1107502a5d5d1e9293e8d72d7460", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374348, "uuid": "8871d13e-af1c-4507-8082-28311c2523a6", "comment": "Malware payload (Mirai)", "value": "8e09a2ded9fbe999bd438c8efb752303a18b9daa79fb3eef1c7d3736399eab0f6fcc73e406331a8598d68202936c92b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374348, "uuid": "816bee34-6012-4010-bcae-630f185f2f84", "value": "T11C430655BC919A12C6E422BBFB5E818D332623B8D2DF7303DD212F11779A81F0EA7651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374348, "uuid": "a80223db-32bf-4d74-b59e-2a5363faffab", "value": "768:wJrbptysMOEVOHUXjZPRkaKw3UBVI5S7SVbYxoArupPh1PokUt526G5YbN1CrqJB:Ub2sGjZ5mw3UBPupPh9jUt59pCOJLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374348, "uuid": "94ee32da-a6c6-4146-8918-e6473c623ed4", "value": 58300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374348, "uuid": "d16276fc-fb47-4a52-a27d-6fc591ea5f34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374348, "uuid": "271228eb-6802-421d-a40c-e17583396afa", "value": "a372fb03c19106d4d77f3813c66a0c6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f34e1fd4-6248-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696377595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377595, "uuid": "2aebf44c-94f3-4b1f-84f5-7b76a7a78c7e", "comment": "Malware payload", "value": "453dfdbd4e5ba10fe72c97df24feedc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377595, "uuid": "ef5e7c6d-5907-4383-bcc7-9ca73719b82a", "comment": "Malware payload", "value": "40fcf3ae64c9605131be25fd22e5412e3ce7c45fbf38aa9fb442c414074d3c50", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377595, "uuid": "65c719e4-551a-4fe0-b646-31afcfe7f992", "comment": "Malware payload", "value": "2d1e34a00204834d44c0ce15022599e942f23b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377595, "uuid": "b72542a1-f566-4ea6-b3c0-6ed2a0187874", "comment": "Malware payload", "value": "81878cc8506a271fd1c34c21c483877e87d59ccbaf9bb1d5c60fee0d242d9f4969478695bef72d2041e5292083b25be0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377595, "uuid": "a03a9b7a-5d7e-45c5-a29d-9c0f26b40d70", "value": "T115648E536290BC71E4214A329D2AC5E9372EFD61CE2967AB332C7F2F47701E1D662712", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377595, "uuid": "e428ffb6-e380-4491-aea0-c500ea14a313", "value": "75b76fec2d6c17598f5493b9f58c5f6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377595, "uuid": "be304a09-0c5b-473d-be68-fe6b85693c65", "value": "3072:UKKgjruhEHPmHLobEgi8frr7XBDPw0y0SW/JY:ZKg/uGHPmroLHTr7RP00n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696377595, "uuid": "60c55778-c581-470e-ae95-ec9e74cb7699", "value": 313856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696377595, "uuid": "ddebdc20-acbf-469f-84ac-244b5bff7fe4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377595, "uuid": "fc546228-84e8-42da-b885-35ee7290f959", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1443868e-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696313655, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313655, "uuid": "48eaa9c4-6df1-4aa7-982d-9da27f793aa6", "comment": "Malware payload (GuLoader)", "value": "922a302070e9f98b52be96d9feea6edb", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313655, "uuid": "c4cfc51e-6382-4894-83fb-b8bc0634136d", "comment": "Malware payload (GuLoader)", "value": "4156fb871571c268e88901fb258cb031be24c7771bf63f137ac33ccd688969f7", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313655, "uuid": "99ea1222-cefb-4c3c-a242-6705c368a00f", "comment": "Malware payload (GuLoader)", "value": "1801c1bf16294dd5dd179f0a1604a0b0b7eb65ca", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313655, "uuid": "07a5ea47-ebdb-4983-b397-c8371bca5718", "comment": "Malware payload (GuLoader)", "value": "06b00ed1c2b020414f0c463e889b28ec6030a526da3442d5eb13152d38d94dc3eccd748987853c1d143fbc1471fb3b19", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313655, "uuid": "3f6aa753-e474-41fa-9592-cbbb8a6551f6", "value": "T16DF26CA4D9991F2A488F26F7DC4248D2493D82695923002ABEDD138ED31F94CD3BEF5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313655, "uuid": "ad554614-7e6e-4afa-a4af-4867310b90d7", "value": "768:9zccYggDW9qQAOjmWO6uwCArm3CLN/svoLOjF2ErKaXHKkdEqEZXy:9qgg6oPArm3UNsvb4Ha4C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313655, "uuid": "cbecd72c-111d-4d20-82f4-2369e2c378bb", "value": 37016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313655, "uuid": "6278002c-e299-4f96-a0d3-153379b6dfdd", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313655, "uuid": "e6626c24-5a3d-4ed4-9458-1c4d5de68538", "value": "Payment_Advice_PHHSBC3J02663515-T01.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71219b3-61ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696310922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310922, "uuid": "ba447cfc-2300-4b69-98a0-ccc309bc1664", "comment": "Malware payload (Smoke Loader)", "value": "2273853089e50bd583c82ba8ac5328e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310922, "uuid": "4fdb44ad-e616-428e-b2bc-1619c8d50746", "comment": "Malware payload (Smoke Loader)", "value": "421598a5b3994cd97d39509c4a09207bd2b8ed3deeab1338ebfded4d502aeaae", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310922, "uuid": "c81b9b9a-d5ab-4f3b-8856-28ab26a6f172", "comment": "Malware payload (Smoke Loader)", "value": "7723ef15cd45c675eeba8a82356042830e720b82", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310922, "uuid": "0b560eba-069c-403d-a10a-6cf17aca4f86", "comment": "Malware payload (Smoke Loader)", "value": "4491c4d34715fea2bcd88c6d21ce03118c7e8e95254fb5367867a4c0be82fedb72674193a3174652877f7303f5d0d31e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310922, "uuid": "b5871540-7cc9-427e-a667-ae30c47bbb8d", "value": "T1D1549E2373E1EC25E4621A315D2AC6E43B2EBC619E6957DB33583E2B4C701E1D6B2707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310922, "uuid": "e26ab101-6fe0-4b9d-928a-202962641c65", "value": "22101b09b25f37226d51fdc3f87abcff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310922, "uuid": "18f4f25a-8c89-4e69-ae16-83fa1dd917e9", "value": "3072:lFJUOsBCsBLIs6hFpS0wFfRcFz3JBy1IQPdT0lc8c0o/Ehi7SnLw:DJUOqCELIs6HpShcFrJYTdo+zf/Cx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696310922, "uuid": "495dd585-8bf7-46a3-ae9b-5d2a16dd74ab", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696310922, "uuid": "15b2d0ef-069b-482e-a774-d51dbc9c83d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310922, "uuid": "15f822f8-1683-41a5-9b23-9f1d202697b3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7d54464-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346142, "uuid": "591e2e05-d870-4f2a-92ac-186f9ad420ab", "comment": "Malware payload", "value": "970cc8cb0ee50339b0cd89e34ac152f0", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346142, "uuid": "68dc514b-2054-4fd9-bf1f-ffb846efdff9", "comment": "Malware payload", "value": "4426187b1c9757842ea445594de963df4e3b1cf3a954557afda2a8b0ae2e4b94", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346142, "uuid": "55885c10-8f50-45d2-b1ce-9dd75964b59b", "comment": "Malware payload", "value": "7df9f5f0599be1f884556bbcb453c55970e1d857", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346142, "uuid": "e3fd4050-d931-4895-b1aa-0501f9374225", "comment": "Malware payload", "value": "036d39e2c0348220466b948dbd34ff77a2c964c0c50fd8891726f2cbdfb1f0d3e5a86ed77c0565236998ed47f8a58457", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346142, "uuid": "ffce9287-7dce-480c-865b-d26370602f6a", "value": "T1B6B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346142, "uuid": "932bd049-2f93-4ab5-9d95-bb338eab3141", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346142, "uuid": "f616325c-fc8d-48f2-a17d-b60048295804", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346142, "uuid": "cba415df-41e2-42a0-a7ee-4865b1df9c75", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346142, "uuid": "8768c75a-bf31-4881-a520-b875aa426f0a", "value": "AppleApp(196).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78556fe3-6203-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1696347753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347753, "uuid": "1fd6fed5-a94a-481e-8d33-a063f8d02aa2", "comment": "Malware payload (MarsStealer)", "value": "f0c2a8ff2890cad08f17e607ccdda7fc", "object_relation": "md5", "Tag": [ { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347753, "uuid": "3b8a770d-07f2-44c8-9826-ca26cf7fadfe", "comment": "Malware payload (MarsStealer)", "value": "44c42156f16ae3664c2ba2aea2b8224bebdbc98e5978f56b5b1384a8a11917eb", "object_relation": "sha256", "Tag": [ { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347753, "uuid": "bfd0df44-405b-4a82-a293-459c9f986491", "comment": "Malware payload (MarsStealer)", "value": "87fbf60e9ba1d60b546347632f1884fe1c531f0f", "object_relation": "sha1", "Tag": [ { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347753, "uuid": "906beda9-4979-462c-8ff8-fd967061ef78", "comment": "Malware payload (MarsStealer)", "value": "2bcca4b6133023dcf6732e28c33f844f771dac6bca0eeb7118292b352b3fe9982ae6d1b317acd19e94a3a20d33ed93b6", "object_relation": "sha3-384", "Tag": [ { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347753, "uuid": "a0b0c004-5692-4781-866a-8a634a9d0295", "value": "T169560A242DFF508D7273EF654FD8B8FB895FF6632A0A64B9105103464723E81DDA2A39", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347753, "uuid": "18abd792-9785-4c10-ac3f-e1a13a847994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347753, "uuid": "7556b992-06e7-4669-ae6e-7e053da5e11e", "value": "49152:9so8Likxo9IiDqmbTp15J+/EE8Yfbebq/9jTaOS9SW5NyBFTGbxN+owQ:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347753, "uuid": "1fc9dcaf-9006-4915-ace1-1fdc1789bd79", "value": 6213632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347753, "uuid": "3a7512a0-9d66-49da-b4db-c72678d47839", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347753, "uuid": "b42b1e48-3d87-4a01-8bf1-7d3f1a136947", "value": "\u0417\u043e\u0440\u043a\u0438\u0439 \u0413\u043b\u0430\u0437 5.409 (setup).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b338799-6215-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696355409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355409, "uuid": "fc1fe94a-4ef3-4303-aa95-cfe8654a5381", "comment": "Malware payload (Mirai)", "value": "2c4ea0048f53552ab4a55475d1eddf6b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355409, "uuid": "47f5d695-e045-4712-b3e4-73e24a7c4651", "comment": "Malware payload (Mirai)", "value": "44ea2980394e3841f922825c6e8624802149104ba9ea09d5a376cc200671b205", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355409, "uuid": "e699dfe0-b7ba-41aa-92b3-e7d12d77786c", "comment": "Malware payload (Mirai)", "value": "6aad41e376136cd7396283ba261b53d2cc591eb7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355409, "uuid": "d4ff5be6-0cc0-484c-b673-12b2894a045e", "comment": "Malware payload (Mirai)", "value": "4c60c1ca392ec64504537344c84128e293ce07884026fcca3fa66343b5cfa9fa810aa3ab95f2348996dc6a09868bc0e5", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355409, "uuid": "982d3093-e5d4-4c6d-bdb6-553d6bcb53a4", "value": "T1F6731985BC91A625C7C156B7FE2F018D331997CCD1DA3242DD286FB87ACA81E0E37646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355409, "uuid": "dfa48ed9-2a6e-40c1-87ff-1497802281cf", "value": "1536:+z2jUYZ/PCY2UHPA5FotEn0Clnb5fU27i1nF2c:+zIB7486Dn1M2kn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696355409, "uuid": "f1a18de2-cc3d-4c4c-989f-c580865449f5", "value": 74808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696355409, "uuid": "777d2701-1cd2-45e9-83af-6b53ee31a0e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355409, "uuid": "e076c578-0f57-4abe-82a0-9fa33685b643", "value": "rift.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5940ddb7-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374330, "uuid": "c8fd7016-9bc5-4fac-877d-4fbab3185589", "comment": "Malware payload (Mirai)", "value": "d650935447313b7bcf71d61ddede7a89", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374330, "uuid": "400f8e95-b645-415c-97ec-2bff14d1b5fb", "comment": "Malware payload (Mirai)", "value": "45e613879ee3f5f313f262341cf6e84de86b92acae7f0c19934029cecd7024fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374330, "uuid": "22932591-afcd-411c-adc3-a1ac9cea634e", "comment": "Malware payload (Mirai)", "value": "6408a77a515b7ee597de204c75560d1f518c44f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374330, "uuid": "9b2fd22b-d9f3-4c70-9625-011001df548a", "comment": "Malware payload (Mirai)", "value": "269f937c9f5c4b684c3fb7d8940185d7d0677b163a9b1d760d8feed50a83094c072419dc99c517fe37f902298423b1d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374330, "uuid": "06d76902-e6d9-4735-a22b-dbd64a473f25", "value": "T1BA63E746B8918E11C5D413BAFA2E118D331367B8E2DFB213DE105F2477CA92B0E7B956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374330, "uuid": "5ff9fc7f-01b6-4b3d-a0de-fb3245b37fd2", "value": "1536:9RnK9MMUlcZDWthY7pkwifX1v8AemR6/3483XMfiChZKipm:CM5lFthY7mwcJ8AUyhZKip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374330, "uuid": "c66303fe-6222-4e1c-9794-feb8e68fa41d", "value": 66808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374330, "uuid": "3421df16-e771-45ab-a767-76ef09140777", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374330, "uuid": "2882ac16-b837-45af-a0c7-058a6ae9cda1", "value": "d650935447313b7bcf71d61ddede7a89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bcb8db2-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696345880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345880, "uuid": "8c19284a-1052-4a61-9915-f355c8ca5671", "comment": "Malware payload (Mirai)", "value": "854900172f8ff707165fb0b11cc0572e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345880, "uuid": "a6c746b5-a568-4cab-89f8-f66abe562a30", "comment": "Malware payload (Mirai)", "value": "45f3fcb5924d9af0d684ea21d3f997a70893350211d9be2d8a9b6f5d2f1cf422", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345880, "uuid": "7a0a90fc-e9c5-437f-92e6-5d8e82418745", "comment": "Malware payload (Mirai)", "value": "c2a3b8788f42f75ea6b0e5f425953c99bedd58d1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345880, "uuid": "d4822d91-976e-49c4-b7fd-65f3691f9ed9", "comment": "Malware payload (Mirai)", "value": "00776687818a7f563306317dcb250b158a7c3f56cfa58f7bda52887652a845a19ce29971d74b2e402930219a9ce994f0", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345880, "uuid": "002425cb-7caa-48f0-8635-283fc2e36fd3", "value": "T110D2D0EB65BFF273C076B878206015D4FE383A13E31E575B0CE6ADA865F66813A50D21", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345880, "uuid": "1e185a77-36d2-4625-a2af-c8a4d64f691f", "value": "768:9YSoXdJZ5U05VxmHSSc+H2c+lPZ71Sx0sp:9YJdJZ5UQVH/+KZctp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696345880, "uuid": "e8761f3d-a51f-4b6e-9770-0bfdee48b017", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696345880, "uuid": "462263e9-6bda-4f2f-ab03-dca40ae3bef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345880, "uuid": "fdb4ea29-b6db-457a-94a7-1cd4d01912bf", "value": "854900172f8ff707165fb0b11cc0572e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dbb044f-6205-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696348541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348541, "uuid": "288e628e-4e55-433a-94be-b5ee322e79a2", "comment": "Malware payload (Formbook)", "value": "85c27234aa291cde56c1a78603d71081", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348541, "uuid": "fb1c656f-36a1-4498-b1ca-d03db11013ad", "comment": "Malware payload (Formbook)", "value": "467c52a90f7d13e15318cd8c68ccd3483f7de5c728d1137916b1f440aa1e10c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348541, "uuid": "ebeafd57-fb52-4eab-a3a3-b46f86c28b2d", "comment": "Malware payload (Formbook)", "value": "2ff954f2f223fe6e9fe2e78ace13427f07a5e69c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348541, "uuid": "0c63c424-679a-4a6a-8760-9094103d245b", "comment": "Malware payload (Formbook)", "value": "0ee6159804e02981758aafae16b25f52092e118fbcb4d06d56bbcf77cbe01ce6c8b6b4a27548d2db4a9bbc20e446f756", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348541, "uuid": "5ebebf84-8d49-4802-90d4-9fc0f44486c9", "value": "T160E4EF7A61F56AD5F4EA5EB75C5180407EFB5C0A9E20D20DE84831F8123379AC24A6FF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348541, "uuid": "091f0d92-1750-48c0-93f8-e1b6fd04799d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348541, "uuid": "125625e3-8b1f-42c2-a2f7-535886bbc8ab", "value": "12288:uXiSAx5PWPQKpES7mmrcBzA5DpdwzV1PLR35XkYfdxTMcTIuIdY1Be:uX7Ax5uPdBcKpdwh1t3K+TT7IQe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696348541, "uuid": "dcfb0b5a-c79b-4cce-b9dd-bd5d311e515e", "value": 679424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696348541, "uuid": "335f0a6e-4ec9-4e73-9b75-302412d98168", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348541, "uuid": "186ec7d0-d2e5-4640-804d-499dcc8ce4c3", "value": "85c27234aa291cde56c1a78603d71081", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757c759f-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344313, "uuid": "81ab3c4c-ed6b-460d-82e2-b637caff812a", "comment": "Malware payload", "value": "928224c97b6d8a170e4df635beb2bb39", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344313, "uuid": "583d476b-cfe3-4080-93c9-819546d2c7d3", "comment": "Malware payload", "value": "4685ead750404c682e9e9af4b03b323081ad0cbae5f544bc1c4f2443087838c9", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344313, "uuid": "88d99022-ef63-4a02-ad78-6c38d44123c8", "comment": "Malware payload", "value": "6b90a875e5c40da2a1a9cba10cade3492bf8a186", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344313, "uuid": "5b8b4527-7cab-4982-9820-129266293f4a", "comment": "Malware payload", "value": "6f6b3e62965ed2c8e34d4e3bf6e63a55cc2d542c8e88d2967abfb905535e6e43b25ed1cbd0160774644837364d851965", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344313, "uuid": "60354b82-e210-4976-96da-3639ebe60e87", "value": "T184B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344313, "uuid": "8e6c38a5-225a-4ead-926a-721583c5d89b", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344313, "uuid": "abc54727-93ca-4e52-b8be-be3856d9396a", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344313, "uuid": "8946a7dd-1d82-4a8f-81cd-3861974c71a5", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344313, "uuid": "e38d09a2-14be-428f-bfc8-9b18f48a726f", "value": "AppleApp(125).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e04078d-6227-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696363117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363117, "uuid": "351237e7-2ad0-4abd-9084-aced6d4a9e49", "comment": "Malware payload (Stealc)", "value": "08d66d1953d4a10d9237424ca9a92cea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363117, "uuid": "d58549b2-34ed-49fa-89dc-848aae45328f", "comment": "Malware payload (Stealc)", "value": "472937fd638157d20a88c109ec4abe4e1dae0a6e5727821fad8515c3aff05656", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363117, "uuid": "57d48360-63ea-42f9-8e0a-9164d4b528df", "comment": "Malware payload (Stealc)", "value": "9c82f2068dd72b4214728c2c3d8e4ff81bbbfe13", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363117, "uuid": "15adbbfa-3ace-4455-835a-830967d78fd5", "comment": "Malware payload (Stealc)", "value": "15d75efcf1577c86e595bf4a71963ae4749d49f104468869cbc845beb46f7ad62db9005b1f6560329441f709ecc009d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363117, "uuid": "f9b3c580-42a1-41e6-a5a8-7f70f83e3384", "value": "T1C2549D1272D0AC61D4665A329E2AC1E53B2EFCA19F7C539B33983F3F49711E19662703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363117, "uuid": "01da3b22-e92e-45ae-96aa-f6fc9ab403a7", "value": "4a68060be2303bc791c841045bc41876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363117, "uuid": "165c2ff2-efec-4ccb-b1f6-78b8f49116bc", "value": "3072:9vGG9Pu+ENPFPMAsnG7qzIp2sALUsI/wmkQWIY:JGG5uRNPFPvTp2sAM7k1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696363117, "uuid": "004077ea-8020-41e0-80ae-9885a2a6d2d4", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696363117, "uuid": "f432f027-b66c-4280-891f-332eb43ac045", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363117, "uuid": "7a09ff86-41c8-4fb7-bb10-6eea6aa147c6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb53748f-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346148, "uuid": "8e654c99-2fee-4805-83ba-d2fba482a425", "comment": "Malware payload", "value": "b244a7d6bce49590f8e05dcfe3252b6c", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346148, "uuid": "3c94c9ba-5677-49f5-8a73-6b65c2face93", "comment": "Malware payload", "value": "47787dea51d4577da0392a2e9defc64b77fd4af2d2e2c18aa07b647857c7f48c", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346148, "uuid": "181919c8-50b2-4050-8789-18d78d1cf0a5", "comment": "Malware payload", "value": "bc6c9bd90088493e21e2c2ea9df5589fcc639f6b", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346148, "uuid": "a5efad90-d54b-4548-acba-6a13e1a106c0", "comment": "Malware payload", "value": "ec3a1c1d31d757af0d2054cfe17470dafea4724e29d465805410a1fab591eaaffe28c18aa9223fe5cd7a31aad88512a9", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346148, "uuid": "494487b5-bed4-4e1e-9482-7c4a84fb622a", "value": "T120B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346148, "uuid": "aede4008-2ca5-48e0-aabf-6fad672ca46c", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346148, "uuid": "20a96ffd-de27-4af0-9e73-ff8dcb5dd9b7", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346148, "uuid": "5785dd96-913c-4351-a462-0572e9cb8f22", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346148, "uuid": "f00c5420-899c-41b4-bd31-c74fcc417848", "value": "AppleApp(159).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785288c1-61c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696319407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319407, "uuid": "a89b0d9e-fe17-40b6-bd07-34ff1ba51863", "comment": "Malware payload (Mirai)", "value": "2ce778c006aeece6aa31cda9f4453f31", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319407, "uuid": "899bc6ea-b023-4a27-91cc-159eb6637d76", "comment": "Malware payload (Mirai)", "value": "48876b8a1290bb23193378695eac6174e0dc95b36e7eea4c6b75001ac8b04656", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319407, "uuid": "296330fa-06a6-4dc6-b529-8287b2087b57", "comment": "Malware payload (Mirai)", "value": "9fe8ecca0eca56921220887089fa27d1d0f1e4e0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319407, "uuid": "a22b980c-1e2d-494b-8232-a6c50c8e44f1", "comment": "Malware payload (Mirai)", "value": "d005e162c048d4e98b0dc4f272d88ec3501f589449513e3eb7e35eb190602701728991b58e77f01028d485ed793a3cab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319407, "uuid": "6fd9c2a8-0485-457c-905b-20f2be7f568a", "value": "T129C2F1B003666121A23C183996BD8F85EAC663F6A2E335654E1133BEF3C654B837C5C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319407, "uuid": "636a6386-d00a-452b-9c12-3d5d3ca3447c", "value": "768:W5Xof6RPGMaXL6IrpJm/XVYE3mn0WRgITGXLGts3Uoz1:+of6RPGMaXGIrpkFYeWx6Swz1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696319407, "uuid": "61a50cbd-58bb-463c-976e-4a5823f83875", "value": 28288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696319407, "uuid": "fb757e0b-a611-49fc-a2ca-3813be178ff0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319407, "uuid": "840418bf-35d1-4098-9149-e0dbdaacf837", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f30fd10-61dc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1696331068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331068, "uuid": "5dbb31b4-64f9-41a6-a02e-31d1e043202a", "comment": "Malware payload (MarsStealer)", "value": "5dec04f16047bd29abe7229447d5d0d6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331068, "uuid": "88ea3116-4a0e-4254-986e-0fa644a8445b", "comment": "Malware payload (MarsStealer)", "value": "48aa1d4be25d9800400fa2ab7209e5a5593799524b5794cb8d028b02c62ae6ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331068, "uuid": "a7a2ca86-6c05-487d-97d7-a4a352b1fbfb", "comment": "Malware payload (MarsStealer)", "value": "826cf11166ddf56c88eeee51b840f4632141767e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331068, "uuid": "392561a4-54f8-48af-b56d-783ded23444c", "comment": "Malware payload (MarsStealer)", "value": "c4caf03843f86808a6a1ffd1590abc4ec79e73142fdbff3a95354d4b04d8f55ddc9c30b3ff2f4747499cf1f548750383", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331068, "uuid": "b28e62f7-8706-4ffb-bb1b-43f14500f23c", "value": "T10854AF127290BC71E4626E315E29C6E43B2EFCA19D6963E733583E3F59701E19672B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331068, "uuid": "d6242651-641b-4128-a084-5b2ff81cbfd9", "value": "305de144f6fc937af53e7fb65cd3b646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331068, "uuid": "3ccba4c7-3799-4fc1-ae94-14d385455ff2", "value": "3072:kjW1HEpCtBZ+sQpbkgeOO+Ot3XE9w6PAm6txJ0QoxuTTy:X1HKCnZ+sQpbrFOrEW6PAm53m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331068, "uuid": "effcbcc4-c395-4dd0-b3c6-de19bca63540", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331068, "uuid": "f3c3a0e4-3845-4d78-a85b-dbabf634585f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331068, "uuid": "42017941-4932-4252-8dbf-5f648c989ece", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73690722-61ec-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696337867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337867, "uuid": "4f5ad926-1782-4037-a55e-daf4efbcb922", "comment": "Malware payload (RedLineStealer)", "value": "8e4953b029a067606b849f9ee0c4b84a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337867, "uuid": "a8764eb4-4cd4-41c9-a308-ba5a9fdd7439", "comment": "Malware payload (RedLineStealer)", "value": "48eb3ec3e2861155e7452daa59c6b022f15c3927bcd482fe15b0827460e58c6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337867, "uuid": "e31d77a7-d576-4702-93ea-66117e40c38b", "comment": "Malware payload (RedLineStealer)", "value": "d436270f3c48dbaff65b1b457151b54ea16e2139", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337867, "uuid": "8d1a6dee-de1d-44b5-9cd9-78a2f663592b", "comment": "Malware payload (RedLineStealer)", "value": "ee4f4c58b8521b45f8db758f9eee2a73fc2b633d51f9ab6c5bf1149fda2e129bacfb4fe0ed4df4ea7198cccc9cfc2b36", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337867, "uuid": "768b5ad3-2bb5-4cfa-8aa1-ab73a7f06c36", "value": "T100652323A2D891A3E8E64B314CF612930E31FDD04D7C967B674B596A0CB1A815D37B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337867, "uuid": "b78195da-5fe4-4f06-94d1-d0c963dc667f", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337867, "uuid": "528f5204-037f-4fb6-91fa-271eb9c495ae", "value": "24576:KyWIlnP1wm8LGHLxaZqoelH8det2gh4t4oeprHSY6MN6EexrIyLiizypi/XmGVv:RWaIoE8Xlcd82git4oWjBNN7IIoypifJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696337867, "uuid": "d7cf6ba8-cc7a-48a1-83a4-2b1b609318dd", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696337867, "uuid": "5b7c15ce-d396-4249-80d7-993795908116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337867, "uuid": "3a0fb97d-9710-413c-88f4-499833c21ea0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "335bf7f9-6215-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696355369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355369, "uuid": "41e541aa-4eb4-4bb8-b9e9-fdf603c07991", "comment": "Malware payload", "value": "5f32065d2330cb09aee6ed9fa7ed1c21", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355369, "uuid": "c83690f8-be78-4cc3-a279-bbb2ba913a24", "comment": "Malware payload", "value": "4a35f8134f64ad28c5fe261d7cf15256ecd758566c2ddbf4bd962925502ade41", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355369, "uuid": "57d29fe5-75f3-411c-ae48-24200490dfba", "comment": "Malware payload", "value": "b5d617bc1626cf79821f2f0c0e2e043f04da5707", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355369, "uuid": "9ae21e50-962d-4ea5-bb9b-d651141e258f", "comment": "Malware payload", "value": "16dd7529741591805db6147f8bb2627efa128b04d8c64c4a480e3aced13cf08c75600d235b7a85ce8606c6cd6c0430c1", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355369, "uuid": "69cc0e93-469e-4de7-b896-8d8487656424", "value": "T1F706EF42DEEBC0F5D94B26BF502B662B997DD305432B86C397502E31B6602E31E393D6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355369, "uuid": "1b56f9ff-8264-429c-a60a-de4718b807ac", "value": "9e604fa03f90625680ac2f8bef162aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355369, "uuid": "277f0e03-bdc0-41c6-b5d7-fb0783e238ef", "value": "98304:UVHFXSCmqsSgfkV9ft9gnOMmgqT6d9y426tTB:UVHFXSCmqsMXl9oPfCzB09", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696355369, "uuid": "dbb77474-7123-417c-baf8-b6c0055b5947", "value": 3969240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696355369, "uuid": "3e45dd12-ada1-43d0-b5ca-ec9ac3cc55cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355369, "uuid": "5b6d2eb2-ea66-4878-bcfd-5a62635f47d7", "value": "fmodstudio64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89a5a348-61e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696335327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335327, "uuid": "a04599fe-a92b-4a32-bf4a-4de3a59e8392", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a229cb823576bbd773be5a646537cbc4", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335327, "uuid": "1aa4844c-f658-4e2c-b3a7-b978a32b8be3", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4b0669367c06892e5cb520e4cc0d135c93d3e361bb5e2d638a87bfb6854f1c03", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335327, "uuid": "bce8b7b0-6a4c-440e-b38c-7091908becc5", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "4d8a46968c20b58b44dc6bdb1e2833931b32f83c", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335327, "uuid": "cb0179b4-bc3f-4188-bfaf-1fb43333771f", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9b9e66bd2681d660a9093d6911bff6b4b3b168fef9ecf727a761947edcc8b2fc4d474eeb2a9bdcf2f84cc0b8ee3e7e21", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335327, "uuid": "3df8f3e3-8b59-4508-a235-2662b8c333bb", "value": "T16F55841172F95B59F5F34FB86ABAA611087ABC6ADF11C6DF1261904E0C21BD08970F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335327, "uuid": "42d32a3f-89d5-4b77-83ed-4ae82aa533d7", "value": "0019c5cc9dc02122ed11385f5bfdf094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335327, "uuid": "899c371e-ce2b-4297-a4d2-1b9da3897dc2", "value": "12288:cmwxrUbsJGmd2ArcuoVX9X6a9Dhvhzb0D46Nmbj:cLrSsJGmpY6a9DhvhUEWm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696335327, "uuid": "b592fdc5-39cd-4401-978d-d716b00b327d", "value": 1374208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696335327, "uuid": "c41a7f6b-49e4-4fe8-94a3-82a3ea9a24a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335327, "uuid": "8f63e0ba-56ae-4a1f-ae7f-d62ff029cce0", "value": "a229cb823576bbd773be5a646537cbc4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511dbf67-61b2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696312898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696312898, "uuid": "48ccea35-f7c6-4751-b9fd-66e756623603", "comment": "Malware payload", "value": "d53171d108afee9cdfcd948f986d5541", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696312898, "uuid": "9631ef76-9723-4d9f-b656-d6229d9b549b", "comment": "Malware payload", "value": "4be352f2e263f8eb6b1d8c2e66c00fc29ee7144cf2343736afd32d5fd38e3b15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696312898, "uuid": "10cb84fb-b42f-4852-a22e-80888d26f501", "comment": "Malware payload", "value": "9bc72eb673e31074cb93a6618bb2e5b936c13c66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696312898, "uuid": "bdacd037-1721-4835-9b99-4a023ba4164c", "comment": "Malware payload", "value": "f57d77edf16ed7de0a83de51c79e34c3391e2d8402a8ec3e8ca33346f4470aa37f9253b6550fa5e098efd10e5f9093b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696312898, "uuid": "ed2863c8-5446-4918-954d-5848d8f733ef", "value": "T1D5962A43F8D555A8C4F9D3B488614262EA703C5C0B7933DB2B61BBB42B327E09E76794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696312898, "uuid": "534d3e52-8d4a-44dc-bf15-cc0e78d0b083", "value": "f0ea7b7844bbc5bfa9bb32efdcea957c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696312898, "uuid": "f7bd2a07-1532-4e33-8c65-b7f810e093a0", "value": "98304:D3xGW8gvQ2gPwWft0+taUMvBP/NGqELiEld2j:LxGXgv38Zi+IUMvBP6LJY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696312898, "uuid": "39691fa3-8eac-4b9b-ad77-1a195191f686", "value": 9376768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696312898, "uuid": "8565ddbe-3356-47e0-b5b7-24ee36ce7b28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696312898, "uuid": "bc3efd48-a9b6-4374-8bcb-c3cb0041018c", "value": "d53171d108afee9cdfcd948f986d5541.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d6c36e-621f-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696359686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359686, "uuid": "2ce6c911-ba44-4cf3-8738-e24431d93e5c", "comment": "Malware payload (AsyncRAT)", "value": "0d76dddfed038deec75949c317971b81", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359686, "uuid": "576b42c6-1457-4af1-ab51-615b29624638", "comment": "Malware payload (AsyncRAT)", "value": "4c000abca2a926307a6a1d42a27694ebd5668643e4c5ca788cc5f162f8edfe72", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359686, "uuid": "1b13168c-964f-4289-aea4-46691ce110c9", "comment": "Malware payload (AsyncRAT)", "value": "94af5866d875768f53a80d21714ce8d946f55f19", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359686, "uuid": "b119a679-6f2b-49fd-a38a-f998cdc639b2", "comment": "Malware payload (AsyncRAT)", "value": "27e02e8bec00da9a9776ae00f10ed211ed8a482b7603a9d3f0e447d6da053e277c7b514dde31c813cce6d143e8f57bd3", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359686, "uuid": "16cc3c99-7bb1-4b37-bc92-9f47e3199b93", "value": "T18844B1A72F2E8287DF4B25FB640439A2CF5C6E5D93DAC0201AE1616FC189CFC6591973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359686, "uuid": "6dc1c40b-3ba4-4de1-8432-7277db080d2c", "value": "3072:n7ctzHXFj7hTwhsoEYBFpAk6uc63iFhT6rqOBKm+FlTtnxogHu8x3O/syJOMRjmJ:5yL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696359686, "uuid": "c42d1321-be2c-4a43-8624-20194fb09606", "value": 274423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696359686, "uuid": "aa40dbe9-10fe-4600-91d5-c03ec1178b63", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359686, "uuid": "79311d54-476d-4ca6-8a8d-83f7e3cf04c1", "value": "T2.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368b59f0-61f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342060, "uuid": "bba3a203-8122-40d8-a933-94f820ddc99c", "comment": "Malware payload", "value": "fc961c5047bd36f30b69eea4c7fc1fe5", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342060, "uuid": "f782c3f6-ee91-4f0c-9654-f7aaf5ce193a", "comment": "Malware payload", "value": "4c1543d9bf6862907bdcc7810c3e9ceee90957049b9f5077540bd824bae30016", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342060, "uuid": "b985fc65-32d4-4818-83af-9fc1d2e8f9a7", "comment": "Malware payload", "value": "997129441ef27565374b0eb8d63e0833a47a2b22", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342060, "uuid": "c872a74b-b258-43d2-a1d7-0b1d3ca590d2", "comment": "Malware payload", "value": "d9ea4d752f04880717209eda03554860f0aaa87e43f342034a925f44a83ccc93b349b33d7d1fedf46dac386f490f84f1", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342060, "uuid": "2db0f694-f671-4bfb-9d59-11807573b7c5", "value": "T1F9B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342060, "uuid": "b0403fbe-fc06-43c0-b2fd-54cce28f595a", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342060, "uuid": "fea95b4e-b72b-4fe7-91e8-35c1fd83f767", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342060, "uuid": "17426d6d-3596-4952-9de2-35026d797fec", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342060, "uuid": "dd474d1c-9660-48a9-87b3-63de4b585277", "value": "AppleApp(51).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "459ef331-61e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334354, "uuid": "ccc05fcf-0d0a-46d2-aa68-46ff4cd7c4dc", "comment": "Malware payload (Mirai)", "value": "8e920929df1dd06cd3a3b5518d1b3ff1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334354, "uuid": "07420eb0-d1b2-4c6c-94a2-7791a25ec62e", "comment": "Malware payload (Mirai)", "value": "4c4de9669e0c41abda1de474f880b2f6768e3776a3d818cdcea7e81a1a2a3207", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334354, "uuid": "f2905637-663e-4de2-b426-84b3c34b65aa", "comment": "Malware payload (Mirai)", "value": "91379635120cb26b3012c9e6253ad6b33eab05c4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334354, "uuid": "7bbffc3d-58b6-4508-9bd1-58db8c29b5e8", "comment": "Malware payload (Mirai)", "value": "61986bb32364f307106081b309d9951b1e1c6b1900eb29e2784670f5b40c885dc6a8657a8b4cde0dd02f191d8efb67eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334354, "uuid": "af1199c1-dbc0-4cb5-a36f-279aa7e36f02", "value": "T1F4D2D08877D253FA8C8DC67D735E003A709A74E9A7B29363B306D5430766180F691E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334354, "uuid": "bf809852-e452-473d-abd7-4725c7101937", "value": "384:MJd/PxEDLd2TwURz06lowYcEaqsD9aC450LQixBfE4jdlz0lewZ90BKb2U/KpNyw:+lxKd21RhxEnsD16IHE4RlY990M28Kaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334354, "uuid": "51734b4b-e47a-4af3-b6b7-5938eb86e812", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334354, "uuid": "608f434e-2971-4e7e-a585-12da09d2db3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334354, "uuid": "8d1e073d-90b2-442c-95bc-89baaa62e22f", "value": "8e920929df1dd06cd3a3b5518d1b3ff1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dccfda62-61cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696323870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323870, "uuid": "4f35f50e-7dde-43f5-b243-27b10b4e306a", "comment": "Malware payload", "value": "46392f93dbe11365dcc6057a0e0c3c6f", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "seroxen", "colour": "#36D6D3", "exportable": true, "hide_tag": false }, { "name": "sxr", "colour": "#BEDF7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323870, "uuid": "49f920a6-5c63-46e9-b4b8-3dc5638eba5f", "comment": "Malware payload", "value": "4c6e90e178396d000b5dd5c5bb2b9ae5bbbca5986f26ffad2a6bd0845b6b2c83", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "seroxen", "colour": "#36D6D3", "exportable": true, "hide_tag": false }, { "name": "sxr", "colour": "#BEDF7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323870, "uuid": "ce015083-209b-4253-85b1-2c1d924c1599", "comment": "Malware payload", "value": "f5e14d896d366a2d0c856aebff5ec1c7e9f5197e", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "seroxen", "colour": "#36D6D3", "exportable": true, "hide_tag": false }, { "name": "sxr", "colour": "#BEDF7A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323870, "uuid": "a5161666-e1f0-403a-adfb-af25d8e49697", "comment": "Malware payload", "value": "2f28cd52347f04c6a836a641a4c82a8180b9de23b2debeee7e46c510b2896c6378163951898b2dc2a5e7394d54761823", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "seroxen", "colour": "#36D6D3", "exportable": true, "hide_tag": false }, { "name": "sxr", "colour": "#BEDF7A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323870, "uuid": "a0b57d78-b0e5-4224-9543-bd259545b61f", "value": "T118D6AF3AF927EBA956414AF8F31E65054B8F7BF8371069D0601921FE0B44BE5C287CB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323870, "uuid": "0dbd3e44-4bde-42e3-8195-b286f40af6d3", "value": "49152:UibWQBcVln6vHr2y7++rl77xFiIf5n/IXNgbNTcw3fbRGI6U1MaRaLkFXhzhLBxV:V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696323870, "uuid": "4a6b921a-8457-4dc7-9462-44ef39c0f35f", "value": 13039164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696323870, "uuid": "f3365340-e100-4d77-b5e6-485c35d15807", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323870, "uuid": "1b183dd5-2092-48fc-8e43-7ea57b714f58", "value": "sero.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b20275e-6192-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696299171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299171, "uuid": "b72b4f2e-9444-42f6-a83e-4e737b223cdd", "comment": "Malware payload (Smoke Loader)", "value": "9b49cf8b9e480a542f92f31006c2d61a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299171, "uuid": "28e1e901-5e1a-4447-b9dc-8cbfc0208b5e", "comment": "Malware payload (Smoke Loader)", "value": "4c75a2e2511e44061424cc86123e1ea5dc4f7c8aadebc5c3bdebbe746175b2c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299171, "uuid": "b91f5865-f943-4ccf-9eef-a27fa1cb3d66", "comment": "Malware payload (Smoke Loader)", "value": "3e2f373b790dce0536c285064b98d15c2e6969b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299171, "uuid": "3b2c70dc-24d0-4bdf-b7bf-7288013d44e2", "comment": "Malware payload (Smoke Loader)", "value": "bc426f20e818f5e1973b0c3fee2d14628eb5ad67a8215c5ca9730e072680aa8c5d9d464efdf616255247ccecafdf3fb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299171, "uuid": "1389cee6-a3be-4b5b-b09f-0eb0e726febd", "value": "T199152286EBDC84B2C9B9473468FA13D319367CA1687403273785689A1D7B7C8D4B237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299171, "uuid": "e1f775df-6944-47be-9c3f-579b086faa8c", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299171, "uuid": "593c0cdc-59b2-4c0e-98c7-06e5a230b92d", "value": "24576:uyORQtsdF5FILP1ft8wo8+Tv5HN/8qTp+tl9bZ:9Ri1QWJ5NUGGb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696299171, "uuid": "b163fad3-f995-450d-be61-d2cb31766d3a", "value": 898560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696299171, "uuid": "a142cc85-c41c-40e7-9730-638b9e2d3b4c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299171, "uuid": "72c17106-3c41-4204-926d-2a1d87b57df4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3b9f2ec-6231-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696367610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367610, "uuid": "31f14afe-58e0-4ac0-b4a5-470fe3286c03", "comment": "Malware payload", "value": "ab029af4e4b7d2dde4e43b156dd3750e", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367610, "uuid": "55abc039-6ef4-4648-9221-ffd848245e48", "comment": "Malware payload", "value": "4d6b193dd9cdb60b14d686f73a3df173c9af2968ddf51d1cf11fbacc20e147bc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367610, "uuid": "12a4da13-1953-4e8b-bcbd-2cc45afcc57c", "comment": "Malware payload", "value": "bee3b52cc7d5c457498594f523f9b741e5ebf5e2", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367610, "uuid": "86e27c63-c1e2-4a79-8ce7-10c748aa6d75", "comment": "Malware payload", "value": "fa19b775993260ef2c73362732c5ecca86bc8717c67970d3588d002813fb1b801b4ea7230cb4e43e6d31ef7260101cc2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367610, "uuid": "8bb96660-09d8-4305-9c8f-3f356566f338", "value": "T1DEB6082F61B48329C15EC23AC1B78F40A93B74B91732C1EF57A413AD1FA29C55E7E660", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367610, "uuid": "3c44cfb7-9aff-4107-baf3-980158057559", "value": "49152:KHf4O17jizoL5laI3x9lAMJQChq91XrQxsHcFTSalJ+GbBV67lj6dJ538yAVVU6m:00ylRTqbpcJ5wVVXH1jsyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696367610, "uuid": "d88cbd34-7108-473d-80df-fff93101263d", "value": 10791424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696367610, "uuid": "abe09e77-ef8d-46db-94df-58993ed6338d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367610, "uuid": "2fdb92f8-81f4-4f8d-be3a-e5feb62b4c04", "value": "blah@thisdoesnotexist.com.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a125c3a2-6203-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696347822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347822, "uuid": "6ce1a893-44e0-4bb9-b8f9-0b410655200d", "comment": "Malware payload (RedLineStealer)", "value": "43527c61aac8aefb2efa2109aa37190a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347822, "uuid": "e532f4ea-e377-443a-b489-3d640c8f4edd", "comment": "Malware payload (RedLineStealer)", "value": "4d7e863742ac8167ec9f6d83ade46c04c3d70c802dd1e64721324f52c6afd9a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347822, "uuid": "df0f82fd-1c15-428e-8886-235f5dd9eec3", "comment": "Malware payload (RedLineStealer)", "value": "4f9fab1c5e1bb4aa139f701a9d68566acdb975a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347822, "uuid": "aff34127-0faf-4294-b2f0-dcc64c365d94", "comment": "Malware payload (RedLineStealer)", "value": "90852c6e2995375a19f9a5074dc5734e012e1150ba796c0ea8fe84b4f9fe88a8a1d74a9f9aa10fc0f676b3e7e091c981", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347822, "uuid": "c49b1ab4-228c-45eb-9fa3-4068220e6254", "value": "T17D652303EBD9C533E67637B148B722430A7A7C65197892EB234DD9CB1D30289A43937B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347822, "uuid": "10a53744-1638-457a-86f1-ef6e5558a382", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347822, "uuid": "fe0b9388-a98a-49d3-ae2e-b87b0acc0c59", "value": "24576:vyRf2yeobj1MIv3PtVRzAiIW0SSNHqR3tNcCG4XhEx+qTb4O1Q+A4SOKW9dvl9fG:6x2EbxP3PtTsiV03U3hNe4YbNS+lyW/R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347822, "uuid": "2da4a147-6978-4d2f-9bcc-396e284a57a9", "value": 1495040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347822, "uuid": "e7cd8299-14c6-4286-ab50-c6dd0152a69e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347822, "uuid": "19b77855-b07d-4ca2-bfde-ea1ad1fd1bfa", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0514f62e-61e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696332528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332528, "uuid": "65cac9e5-52ef-427b-898d-8d2f6e4e0a29", "comment": "Malware payload (Smoke Loader)", "value": "c5f0671c5e8c786ef0cfe71b4d738808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332528, "uuid": "de6e5d0a-e9a1-488b-99ce-7ec87507650b", "comment": "Malware payload (Smoke Loader)", "value": "4e1e7978279a0ae65856db0180a0fde56b17572d1483f15bf56a6875ac0c045a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332528, "uuid": "44653b4e-ab7a-44b8-b81d-acc489549ef0", "comment": "Malware payload (Smoke Loader)", "value": "8e2efd13ce2a23dfe714fd10e12337f1c0a07fcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332528, "uuid": "e0cf709b-666f-4e83-8b68-5ee64089ea4d", "comment": "Malware payload (Smoke Loader)", "value": "134f6954bd257be626c5b0119e1cfd292aa958e30d75a6c5117bcb003cd0b01820969b96242382d95c332698475751ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332528, "uuid": "f2208e10-c7ea-4f58-a7be-9475969cf365", "value": "T164549E037391AC31D4665A314E3AC6E43B2EFCA09E69579B73583F2B59702E19772B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332528, "uuid": "71097815-4461-4703-828b-0a7de9ab6173", "value": "e9df9444a99e49eb51fccc88bae85d1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332528, "uuid": "e81cfebb-3822-4cdb-9a29-c3f990cd28d7", "value": "3072:9PGHeLSvdw5a6ogbRR90NUNuWqqPcE1ElLwIBekNwdpS:IHemvW5a6ogbz2kvPDupV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696332528, "uuid": "6d67d2af-43e4-4531-af5a-66a2077ccc3e", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696332528, "uuid": "ac151798-0437-4209-97f9-530209acbd9a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332528, "uuid": "81a5b841-c5c6-49f3-9e21-119ff984ff97", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5af6fe5e-622a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696364454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364454, "uuid": "236f478d-7d36-47c3-aa4f-586c23af5d49", "comment": "Malware payload", "value": "4ea614d30b1c829f418d0ddca5336bcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364454, "uuid": "0b49e7aa-2540-4e31-883f-bae431854e32", "comment": "Malware payload", "value": "4ea02cfc5dee244e50128bd84562f0356b8b58ad3bb1410a8d4d924a3a3e310f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364454, "uuid": "3784b40c-6b07-4730-acce-9172e7ff8eb0", "comment": "Malware payload", "value": "b03fe6254cbdfc868d3dfd489cb77a7cd7e939d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364454, "uuid": "54b2b248-fea8-4eb6-9d75-2d33b5ce0541", "comment": "Malware payload", "value": "41133bec41de52ab5970e384cd1dc32071bbd0e4201abd746bc30dcbf5074e455ed96c77c1c6903b692735ce0d9bf2fb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364454, "uuid": "a82832b8-2fea-49da-a24c-9190936a9351", "value": "T190549E13B3E0AC61D4725A329D29C5E53B2EFCA19E6857DB33583F3B59701E09662B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364454, "uuid": "3414e4e1-7838-40ec-865e-423a9cbca747", "value": "4a68060be2303bc791c841045bc41876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364454, "uuid": "32d5642f-21d6-4c4c-ba10-205f0d547f6b", "value": "3072:nvjNePudFbPL/sHe08qYO8O05oBNEdWQfY:vjNyurbPLSe08qY1O0ibEs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696364454, "uuid": "42069635-53ba-4904-8279-88bb28167154", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696364454, "uuid": "4aff9613-dbb1-4674-b07e-74e2e2e5bc0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364454, "uuid": "f9c02a36-08f3-44f8-b9dc-58b2a4f23299", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "036aaeb2-61d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696329518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329518, "uuid": "fbdfa510-6a00-486b-a774-017b8bf855d2", "comment": "Malware payload (Mirai)", "value": "2728fbc662d225f839aaf980d6cb4dea", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329518, "uuid": "93e0f045-9be9-4838-9dc9-19e9c43f993f", "comment": "Malware payload (Mirai)", "value": "4f94918009326b543c80d72e07497eda9a11142c7f29db7f590468e432fd4440", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329518, "uuid": "f4c71ed2-ab26-4286-98b1-09874deafcb4", "comment": "Malware payload (Mirai)", "value": "3f9d7a45b94fd86c31b29571552abd48bd2dd709", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329518, "uuid": "a351dd0d-8077-4329-b6f7-67548f0808b9", "comment": "Malware payload (Mirai)", "value": "1b39d68b8b6c454fe78b5ba636f137f8dd1be7c8b5356f3ee48bfee7684147c7b4ea509c37349e715ba0938994011401", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329518, "uuid": "cbc9d1fd-08a2-42a3-8034-001c6327cf2f", "value": "T184D2D07CB0503E82CC68ADF968DD5FB2C51171C172576BC84B290DE8EA92DCBFC494A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329518, "uuid": "851b634e-fb05-4b40-b6cb-0a5ce04fdb21", "value": "768:Enbucl/U7t0ydGV/Lu9g3eOXVPnuhU/HvGfzWa:ObuCNydMKzOhuhUfvGfr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696329518, "uuid": "e6a69357-fcf8-43c2-92c9-f64e404c4dbd", "value": 30480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696329518, "uuid": "7c2cc4b6-e8af-4a49-b996-6a734c07d351", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329518, "uuid": "87a4a8c5-a206-4e1c-9821-20a872d007e3", "value": "SecuriteInfo.com.Linux.Siggen.9999.21437.14247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61af4901-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347286, "uuid": "6e84a6d0-e24c-45ff-a0e7-8ee0f65a93a5", "comment": "Malware payload", "value": "bc15498ac7d5181e302b94f98aed8e81", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347286, "uuid": "fcf3b21a-1580-4c11-90eb-9b302cfaab02", "comment": "Malware payload", "value": "508c0fd9ef87709bf45b5bc039102acfc3f5e2f2184541a81bc09aca79b60fe1", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347286, "uuid": "e085cb13-e272-4553-95e4-8132e721ab12", "comment": "Malware payload", "value": "14bf449d8e3be9af73c0834671340b651d7ba1f2", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347286, "uuid": "5e531aac-60e7-469d-ba77-5dc206b248f4", "comment": "Malware payload", "value": "9623f6cec0fee3e7740c5def106031411263a6a61492710a14e551a63aacf384c6aef6aca79bd7490d703acf38744eee", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347286, "uuid": "3fe7d8e2-c648-4b3c-85be-fae77265347d", "value": "T15BB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347286, "uuid": "c5427405-abc7-4b70-91c7-057947f27f57", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347286, "uuid": "79fff7ed-0754-4cb1-afab-88c956e5ba3d", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347286, "uuid": "b47c6a8b-4b66-457d-89fd-d7cb1a4cbf4c", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347286, "uuid": "325150c4-b07c-413f-a4da-6eacbcdada30", "value": "AppleApp(216).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa75c3f-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696340974, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340974, "uuid": "33567bf8-b92b-4139-9cc6-dbfe00cd47b7", "comment": "Malware payload (AgentTesla)", "value": "914f310ad18ec0e1c0269a1f8078ce06", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340974, "uuid": "33509074-a376-4b99-8bb1-d70b8734d53f", "comment": "Malware payload (AgentTesla)", "value": "50fab7e7c50e5cded050887693996292a8e546064e8e69c8826ca8f8f7b03242", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340974, "uuid": "ed12a941-28b0-4c9c-a3a0-30db65fa8375", "comment": "Malware payload (AgentTesla)", "value": "20e1c3567b023f801f048be999d92d7596fc3e10", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340974, "uuid": "f1978eb0-6de5-4d69-8fbd-d520af57b61b", "comment": "Malware payload (AgentTesla)", "value": "1d9a8f219b4a3674bf137d31fe09fc6a978554a6d7a14a93331cf3b5c46f7c88ef9f02ac7b6f800ca2ec7ecb2298a6ab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340974, "uuid": "2e772af2-e3d5-49ae-a92d-055d8a85961e", "value": "T16ED4AD08278855A6C35F5334C4AAA34DEEF0CE2F834A979E9E507EB99C133C5D9531A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340974, "uuid": "3e978acb-9d93-4b8e-aa0e-9f23fc7957ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340974, "uuid": "26e33595-4ddb-44a1-bc08-3ffe34fbcf4a", "value": "12288:QHE50g5oQe6NaASFo/zZQcXeNRaAStlqmO0fOa83i:Ew0BQJNkYyh/aBqqdA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340974, "uuid": "56b50262-e992-4da4-8d87-54e36ea0ee9a", "value": 642048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340974, "uuid": "a0639ee1-8ea4-42d2-b2dc-733b9b6f8daa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340974, "uuid": "4b9f5d8f-4262-483f-aac8-7100bdfe615a", "value": "584961.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcc5fb65-61f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696340620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340620, "uuid": "0ac469a9-0e34-4946-a065-d9b5979bb6a7", "comment": "Malware payload (RedLineStealer)", "value": "361d8c3644fac450f33671e8cbfd30b9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340620, "uuid": "670398fa-1ec8-4cd9-b920-167a3d7a466f", "comment": "Malware payload (RedLineStealer)", "value": "514a65194f2b3277eb8c0f66338e00d01484c96c58f486f73c761ac0e3a67e01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340620, "uuid": "1990c9ca-6788-465b-abfb-6d31cab582a3", "comment": "Malware payload (RedLineStealer)", "value": "6baf746078964ae467aac9c955b9c555084d79a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340620, "uuid": "6c6c1eec-d554-48fd-956d-c2eaf93a8b3d", "comment": "Malware payload (RedLineStealer)", "value": "2b74e7b4112fec8f76522371e16821c9de7605ea88083e5e16fafd0a46f328e481af2fb496beb96c266cebc8ef2bbc99", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340620, "uuid": "3d01d741-65f3-4d5b-bd9a-912c2f34d5bd", "value": "T1AC65239779F8C063EAB807756CFF43A32A397CA16D7543BB53806E061C701846936B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340620, "uuid": "3c53da87-33fd-418d-8a82-6732d3e2f1aa", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340620, "uuid": "e18cce40-c5b1-4156-834c-c783c7236f5f", "value": "24576:Wy3BCMPPkNBUEtU9tu8FwknCq6Oo3p3OxOeP2ErWLabacLfxlyRrCcWDaJN6z6y4:l30MWU+8FwMCqVoZOmrLabacwOcWDbzn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340620, "uuid": "c69ce03b-2e08-4c19-93ec-0a0cd3d9f035", "value": 1494528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340620, "uuid": "9f4c5afb-7dcd-4872-ba12-fcbede71f6ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340620, "uuid": "b294bf40-3389-4276-8c55-9e11d0580c9c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e1ce9dc-61f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342126, "uuid": "2aa1d179-427a-4067-8baa-a74c9a9ff801", "comment": "Malware payload", "value": "ba5761c7f088daf85d8bb7f849072344", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342126, "uuid": "f434fb4b-fec4-404a-94cf-b65cb1b6c09b", "comment": "Malware payload", "value": "5195d849ba9a5d6137742db773c983539c0a21f11bf02e96f3b38008c69d393c", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342126, "uuid": "a77409ef-758e-4a13-9549-7ffe0ecacdca", "comment": "Malware payload", "value": "3b0863e5b43e0229b1a758126464e849ec99c8a3", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342126, "uuid": "612da66e-9815-4828-8f1b-cd6af46022c7", "comment": "Malware payload", "value": "3bb22a4ec733ff0784a6a8c04eb1df3b8ec0debbd827bb755556edf483637120adc5ebcba5226b8938d3ade7d105931d", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342126, "uuid": "ecf365e8-2934-46b2-b329-5e3f89325e34", "value": "T11FB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342126, "uuid": "94026c5d-0c17-43b5-9ddd-ab47ff306b43", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342126, "uuid": "08c54b34-e259-48eb-8eb5-ee32411be69a", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342126, "uuid": "7015738f-289c-47a1-96bb-8f1c396254f0", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342126, "uuid": "d4ed3c98-f373-4300-80e4-28c1a1c0459e", "value": "AppleApp(59).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33cf3c6f-622b-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696364818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364818, "uuid": "c167d3a0-3d7d-42df-8d99-f625b7f451c6", "comment": "Malware payload", "value": "01e891943a8dba30dc78411b01c94de6", "object_relation": "md5", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364818, "uuid": "4f8f0d45-273f-4d2e-8851-d40afbd5673d", "comment": "Malware payload", "value": "51b41346135774c8c7170cdef7901c79e1c58432765c06296245eb1b199e5ee0", "object_relation": "sha256", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364818, "uuid": "fb55d2ed-d32e-4894-9110-bd258a59b613", "comment": "Malware payload", "value": "bf279ee1c0202945ab302468adf7fbd16024411a", "object_relation": "sha1", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364818, "uuid": "b9170c07-f43a-4aea-ae5a-027f55601497", "comment": "Malware payload", "value": "29a7aaf83cb4e7dddb0a3b98b1f030d023d182d9201fbc644415bc70c71e1d45aa84128454c672e5d9e80932f0e71ed4", "object_relation": "sha3-384", "Tag": [ { "name": ".bat", "colour": "#A7A183", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364818, "uuid": "cd9e10fe-a413-43ca-93f7-d6ec52e5993a", "value": "T1CE1148140C13812633DBD174CB21231AE05FF2017E1D48D1F16391E194CD658DF7DEAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364818, "uuid": "86bde673-51c2-4757-b1c8-721ab67c86af", "value": "24:OcpzHO1eeI8CVGfprQyRMaekVvuSLNLuvj/xC6:OcpAeeI8YSTeSbLNej/c6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696364818, "uuid": "b5ee8ce1-cfa4-4a6e-8eda-b0c9b633d73b", "value": 982, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696364818, "uuid": "ebfec86e-7f04-49f1-ab66-890163ac0bd3", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364818, "uuid": "d4dd032e-b5bf-4c7c-bfee-bfa66567161d", "value": "ruhsat_skodafavorit .bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b43d573-61fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343705, "uuid": "f798106c-cec7-481f-8bd1-b034d34fe3ad", "comment": "Malware payload", "value": "83b3c829063e1a2ea86c76c20575c9ba", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343705, "uuid": "40ddc6c3-adb0-4d33-9ebf-119a5895ecf7", "comment": "Malware payload", "value": "521647311b34ff0676164ba9bc0837a55eec7de4662caea16d654e5135eb7e97", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343705, "uuid": "b69c8681-1e91-4c55-b0f0-aeaadff82773", "comment": "Malware payload", "value": "a96b4667b18f80083828c44046b2208a03259a15", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343705, "uuid": "8149c379-f051-4b07-a6f7-af8ded56a13b", "comment": "Malware payload", "value": "6084ae36f2e8fe87ef59a94e0792620931080ccefcc7a323a0e190c5a5c04abf53d3bcc2ff543245fe818dc9559d3b33", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343705, "uuid": "2ee4fa6e-4b1d-4021-989b-81423e5ecc48", "value": "T1DAB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343705, "uuid": "5c7c5de1-3a0d-439e-ad98-06c99b8f2c83", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343705, "uuid": "5efc67b9-1694-4122-939d-6c49cc3dd7b8", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343705, "uuid": "e1374044-c6b6-453e-ba55-57454b145b62", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343705, "uuid": "5c414748-6234-4dff-ad4d-7655ac09f977", "value": "AppleApp(112).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091d53cb-61de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696331675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331675, "uuid": "0b84b52a-1506-4d1a-b5c1-dbdd4eec87b0", "comment": "Malware payload (Mirai)", "value": "42a5c50c9baf14b2798fcccfe561d4ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331675, "uuid": "0e9b7799-8b3d-4eed-983e-890929a4d712", "comment": "Malware payload (Mirai)", "value": "527e62f3d73cbb4824f7959ab3b232d825774c2b0bb8a2872b7e593a9306f39e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331675, "uuid": "eaf2ec90-08ba-4385-bf63-bb480efa271b", "comment": "Malware payload (Mirai)", "value": "cf7a7c50e48c9eac938d37237406eb97ea4ca3b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331675, "uuid": "72368f4d-7bb2-484e-a2a7-955e884e621a", "comment": "Malware payload (Mirai)", "value": "d668375ba9ee30a3f754559f1d142eb625af1c5d564fdddc137c4c7a4c5f7e13a889658426c46ceed296fbf068b5f4b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331675, "uuid": "ede269a8-46c3-4609-8e79-28d891badffd", "value": "T113E26B76E47A1E64C1464274B4288E742F23A5C1D3532EF716E682B09467D8EFD09FF8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331675, "uuid": "f002ef3b-992e-4eb2-8f73-5f8e7b4a6d14", "value": "768:G1SLr5JLxGnyffFwvkVCaGok4Z/dKC08:G1QNJ4nQdwcVhZk4LKC08", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331675, "uuid": "3d59936a-7df1-4970-aee9-45ddf0c8f72c", "value": 33788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331675, "uuid": "f8aeb022-d5bd-4b19-a4e4-c22043692a72", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331675, "uuid": "05a29f29-4898-4033-b4d8-245d159b7415", "value": "42a5c50c9baf14b2798fcccfe561d4ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76fac403-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374380, "uuid": "b903ca84-85e2-4cf6-a574-72895601a4d6", "comment": "Malware payload (Mirai)", "value": "b232e795b6e149e3bf577deb6b34aa86", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374380, "uuid": "79d4f284-2aa1-4aa7-9f56-aa6cf24eef7f", "comment": "Malware payload (Mirai)", "value": "52cd1cfd83d3aa49f197b59711c23ea29d917aae843937d8200d8d4057bae22a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374380, "uuid": "1d1e2040-4f35-4f8a-bf38-a6ce6ba83298", "comment": "Malware payload (Mirai)", "value": "0608d7d92fec948bb0e229398a5fed80de237a57", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374380, "uuid": "9c37861d-dc14-4770-8400-dc77c0b514b4", "comment": "Malware payload (Mirai)", "value": "f131b038ec98422573592ebfe31e5ab527387446fa90f2d1910427265c4159be723140e0f17ff2cac053360f039c51c3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374380, "uuid": "b97aec5a-216e-438d-9601-29c93d81ab7a", "value": "T17863F756BC918E11C5D412BAFA2E118D332367B8E3DFB213DD106F24778A82B0E7B955", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374380, "uuid": "4adbc980-8f69-48c2-89aa-bfab7d4ee9b5", "value": "1536:KmnOPQ7raicvUN105CmchRKlNHwgf06jHAV3WdMKi5pZBiga:z7Wi505CmchRiQgXrIpZBig", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374380, "uuid": "e3f48b75-5d0c-4038-bfcc-c826bc9d9a9d", "value": 67264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374380, "uuid": "092cddb5-da2a-44d4-b540-ce514843b9c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374380, "uuid": "0ef6e1e6-93c0-422e-9be2-e2c560ca5b75", "value": "b232e795b6e149e3bf577deb6b34aa86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "174a77ec-6248-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696377226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377226, "uuid": "c5022242-c14c-4b1a-b8e3-11ccd8d32b97", "comment": "Malware payload", "value": "ef3b2f26f86df5a44c526e29b51128d0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377226, "uuid": "042a2b57-91e9-4ce5-8727-4752bcae4fac", "comment": "Malware payload", "value": "5397ccdd490dc61f64a07968c283d21b76f87ad4c58cd19481f215fdf6aeeaa1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377226, "uuid": "83f4ca44-3120-4675-8afb-ff3e158e319e", "comment": "Malware payload", "value": "618b65e5ac837a773ea37782e4bf476d6a8a450e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377226, "uuid": "2243d4e4-8366-4c61-8c9e-abfa799f7ea9", "comment": "Malware payload", "value": "1b63ec58d0a62a342733709098505193b869ceb6e6e7f4b82e8680b60ba6ac0e7bb53b60a61f8df44ee2ced18be808b6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377226, "uuid": "eada9f63-d923-4d3e-acdf-dcb235a23e4c", "value": "T193433921A9792E17C0E4A8BA21F30724F2F6670E25B4C71D7D720E8EFF6564022176F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377226, "uuid": "923fb1f7-c4f9-475c-a188-01ec8d9c89c6", "value": "768:FloIq9P4cMnI8PMlmTosZedSqo8fJjYW3C/24FO+t2gL76E:FlJSP4cMnI8PMlmosZedXf56/VFtT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696377226, "uuid": "05e9b1aa-6ac8-43fd-8872-a78b0685d207", "value": 59200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696377226, "uuid": "53959b2d-b778-496f-b836-fa77e6383ab5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377226, "uuid": "2d0fe388-ff42-42f4-a50f-56adbfad2bea", "value": "ef3b2f26f86df5a44c526e29b51128d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5039e8dd-61fe-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696345539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345539, "uuid": "88407e9e-456a-44ff-997a-49e25e1a5e6f", "comment": "Malware payload (AgentTesla)", "value": "65e0f14b01b2508fed95a90721d548d6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345539, "uuid": "cc67fb7e-5969-4774-82e2-fe81fc071a86", "comment": "Malware payload (AgentTesla)", "value": "53adecc01775047c7456f6a02f11ffaa6e9addaf2bbf718c3aef0cbcc2b135aa", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345539, "uuid": "5fff6892-cf59-48ca-b424-ac9cc81d191b", "comment": "Malware payload (AgentTesla)", "value": "c2d3b361df71699ffde4074e9576303fcecb30af", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345539, "uuid": "91bb2139-1314-46f8-b317-7ec1199c2c46", "comment": "Malware payload (AgentTesla)", "value": "88ba2dbe7044b2036b06a7ec1643317fe91dae938a1ef31937144ea635709186c75406213c580c8c088e4573fb8edbac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345539, "uuid": "b824e0ee-0c9b-4b48-9b68-2168453d999b", "value": "T1DE75D6012BF95B49F5F31EF866FA6611087ABC6A9B12C7DF0154984E0D22ED0C970BB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345539, "uuid": "b2260826-f6ca-46b9-8a81-31791e936838", "value": "0019c5cc9dc02122ed11385f5bfdf094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345539, "uuid": "e2f9ba80-498c-4a70-8039-3162b64f843e", "value": "24576:hqMa57sJaGuq6a9DhvhUDpprRmM0scMUuIy+A+:hpsF5q6a3v+DpprRmM0sDUuIH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696345539, "uuid": "87d6631b-afa8-41ed-815c-7a367a57e1bb", "value": 1643976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696345539, "uuid": "db646bce-7aaa-4c7b-b762-d62b487d860c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345539, "uuid": "4e03658e-2d11-4670-b84a-90f09024f78f", "value": "Pedido de snorkel88793001.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aab3be8-61de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696331732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331732, "uuid": "8406bbd7-b645-4b22-a673-4c6d5d4aa2a9", "comment": "Malware payload (Tofsee)", "value": "c8242a877927a04d679eb790147cff7e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331732, "uuid": "0b167ce8-9d4b-4f45-aa39-7fc3949d19fd", "comment": "Malware payload (Tofsee)", "value": "53b125ce63cb17baee9c49fd3d7ae834ecac6168313ef7a92e46639262d96be3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331732, "uuid": "fe2450d7-a49d-4cc4-948d-788b05116e25", "comment": "Malware payload (Tofsee)", "value": "3bd6034107c0ad636d2d3f9d130dc890c2ac5519", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331732, "uuid": "9bd16810-4c7f-4549-a41b-03e1fa1ec682", "comment": "Malware payload (Tofsee)", "value": "ead8d78594e17b555393e1689c56411c19fee9605883bc9d50c10970331ebac1ead1b6dbce0c2cb4476c0b2305bb0691", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331732, "uuid": "5973a611-e9ce-44c5-b175-f365da042811", "value": "T17354AF1277A0FC21D4625A318D29C6A53B2EFCA19E6857EB33583F3F58701E19672B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331732, "uuid": "1fd44678-ce47-4b75-b44d-bc14969ce252", "value": "e9df9444a99e49eb51fccc88bae85d1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331732, "uuid": "613aaa0a-b708-4c21-acfb-becdfdd15443", "value": "3072:5/SGUDCSvM8fayhBZ9wOZh6/a5KnS+W9DQIEOf2NUW4gKE/dNxS:5/fUDXvHfayhOxW9DDEO+NUjVE/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331732, "uuid": "55554dcb-db68-4eae-ab18-a6f4154da422", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331732, "uuid": "08ff4067-2e4e-488a-a3f9-765e44bde754", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331732, "uuid": "113d980c-7c09-4681-ac7b-0b64fc769c72", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24c39e6-61ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696316605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316605, "uuid": "18076920-a411-4526-b0a2-b979b781891e", "comment": "Malware payload (Formbook)", "value": "68fa6c054b7a55d1943b2449ff295dab", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316605, "uuid": "4c16ae41-3188-4f83-94d0-b9f42b76af09", "comment": "Malware payload (Formbook)", "value": "53f8211db510203634da93d5f2616ead5784031d1fd9d1ad245e25719fa974a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316605, "uuid": "ea076e0d-347f-4693-b463-f2655c663c2e", "comment": "Malware payload (Formbook)", "value": "9e58a4e2c460ad9454a1ab0b5839bbb20dd34fe5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316605, "uuid": "1ea08763-4af0-4064-9b6e-d325812bc73c", "comment": "Malware payload (Formbook)", "value": "243571491f66ba4451f838f25cdbbad335e660b198dadd96f199586beb89f30cd06fa45b9d2e155110485f624f9efd21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316605, "uuid": "3159ba18-6aa6-4d4a-aab3-c24546c8a962", "value": "T1008423612F61ECB3C51681725EBBB95A7BB5581402588B0F1F00AACEE872691FF4EDC4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316605, "uuid": "bea8ad65-61c7-4e27-95a3-1e853dada2f6", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316605, "uuid": "42ce3e0d-fc7d-4720-9b7c-7c2c81222412", "value": "12288:BnPdwRimRrvKyHLy+xm3wGRiagRIlbSGx:9PdwRHRjKyrdoDqux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316605, "uuid": "87b2b3ed-a84e-4fd0-bd0e-025481bb127f", "value": 401929, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316605, "uuid": "81d72262-a5b6-4ee8-8897-7364a5826fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316605, "uuid": "420ca5fd-6ea9-455a-9fe5-bffa527f4628", "value": "SCAN DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fb80266-61f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1696340276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340276, "uuid": "cc7eb17e-8f6d-4983-bf76-a6988fad1d59", "comment": "Malware payload (MarsStealer)", "value": "eb1db87fd96125f94a1b3ffd0952e287", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340276, "uuid": "ca0e8e38-bc01-4f3e-ab70-931f84135bdb", "comment": "Malware payload (MarsStealer)", "value": "547aa3afffb1c692c296484c1d1225abc67a95baa4f5e46da81c5939b6d137e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340276, "uuid": "f3e66f98-3646-4c15-a32f-a87678fdf708", "comment": "Malware payload (MarsStealer)", "value": "fbb001fb2eeb8ce04c4eacbca3c0b6806f5dcbbd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340276, "uuid": "a59c3f29-f79b-4525-af24-1e3e7373d5de", "comment": "Malware payload (MarsStealer)", "value": "3c20d3789c4c64b203374ea9fd31f0c37f2c7a852c1e0a28c8fe0305ae0e4367ba3efaf6546c3142070a2e3d2130f85a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340276, "uuid": "b9a55e42-84e3-4c41-9d2e-304f1644a3ad", "value": "T1B4549E12B7D0FC21E4265A315D29C6A53F2EBCA19E6953DB33583F3F58701E19A62B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340276, "uuid": "1c6f6949-1986-4b39-8a3a-affbe0682346", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340276, "uuid": "f186282b-7f1a-4be4-8740-9f3a54636efa", "value": "3072:jqne2mv67iaCESTpyCmUh1IX17LDHVNbSLnvxxR5BNR2Y:mneXviiaCESgvUh1IFLDH/2LvzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340276, "uuid": "a11688d8-3394-465b-8685-0dc0e025ad0a", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340276, "uuid": "2bf3f2e8-42a9-4c74-96b2-30365497ec6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340276, "uuid": "be0cfcee-429e-46d9-a428-f2d338a99935", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19de3f89-622c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696365204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365204, "uuid": "7860bc84-5e68-4762-9ca3-a1e0747e79fa", "comment": "Malware payload (AgentTesla)", "value": "a34306375ccfabab8f506d4dc5dea1a2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365204, "uuid": "67f2f372-cbf5-4aa0-b28e-ad3c096559bc", "comment": "Malware payload (AgentTesla)", "value": "5498127f11928bb91062949e7f2d2a140164036490563db5fcfb85c29e4d3e1f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365204, "uuid": "c64812c9-3344-44de-aaea-1fd2ff054744", "comment": "Malware payload (AgentTesla)", "value": "68b1480d083ae8ffb9e56f8467eaee6a3d0ec84c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365204, "uuid": "df74016c-8be4-45b6-b7ab-b39834ceb9d5", "comment": "Malware payload (AgentTesla)", "value": "36bae11085e8a4ff9df651e542dfa136c8d7643cc03f080d2cbc149e46efc6d960ea6a070114e97a3eb59c2ee9daa840", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365204, "uuid": "7e526e4b-6e5b-4fad-9498-1b3c91c11389", "value": "T1A7B438343DFA501AB173EFAA8BE4799ADA6FB7333B06645D1091034A4723D81EDC153A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365204, "uuid": "4ab9013a-5a5a-4396-a27c-0e21eaa30b16", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365204, "uuid": "5b711975-9b3d-43b1-8b8f-8fa0a677ecff", "value": "12288:V/WviUitfukYrERxWnAzpjsl6miNjDp6SEsAm83F6foHWla:9WEGTIo4jk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696365204, "uuid": "676ce227-8c36-455e-9412-4eb816f7f663", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696365204, "uuid": "579e68db-ba3c-43e3-899a-965b5616898d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365204, "uuid": "65cc3462-ea64-49d8-a071-6ba889ea7447", "value": "update.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b51aeb-6210-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696353485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353485, "uuid": "fe1b022c-1049-402b-a14e-48c4e32f93c9", "comment": "Malware payload", "value": "e40cd8ca7bae16964bbe2690cc90f9a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353485, "uuid": "ca412351-a8d3-4bf4-a6e6-e1044a27ad97", "comment": "Malware payload", "value": "55c7da2f4d95013b4e729edb54cfe78213bbcf01aec9c70357ff3f4d36cc871f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353485, "uuid": "98662ac1-4950-4af3-9f2e-e1e12969b21e", "comment": "Malware payload", "value": "f41d7e27e5f702b43ef3ab8b26a8705999393054", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353485, "uuid": "f96bc4ce-4d51-417e-a448-5fb79696bc32", "comment": "Malware payload", "value": "c031d1f51181348e2fcab6ac1b829b29d5a2419dab5222d327f79929b6005076279c16ecfd5f1c79f6d50ae6c7df3b05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353485, "uuid": "952d02d9-e956-4060-b08d-313cbc03e1ea", "value": "T1E1C6239A752B6F6BFE009430D1C876F46AFC9D437AF9425FDFA21C864840ABD2198335", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353485, "uuid": "a0849a9d-1def-479b-832b-881b6ebbf208", "value": "e74c8ae3503a17604f2a2d84ae3389c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353485, "uuid": "f4bfe240-44b9-4996-9adc-0bf59864dcc5", "value": "24576:dOMOT1vy3oOCJPMar4/oe2hVR6dxDECxpM89IjVjPy5CH:dOMI1vyJC9d0/Z4cuC+hby0H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696353485, "uuid": "5e4cfe32-1c91-4e95-a257-41c98026e23f", "value": 11760864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696353485, "uuid": "01f2ba06-f53c-4fff-9c3d-490ec4f9abeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353485, "uuid": "dc110070-8159-49ff-8c7a-c078e969da80", "value": "8g2GzeU5WvnV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15bc0ba-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1696344413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344413, "uuid": "fae4ce28-e6d5-41e7-a329-39d00a297748", "comment": "Malware payload (MarsStealer)", "value": "8830f7efe68fddb04c438f9aa1de2dba", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344413, "uuid": "eb14f112-93cf-4330-8d75-1112a215708d", "comment": "Malware payload (MarsStealer)", "value": "55e8777df222fc3d6fccd14c60d1aa21ebfb7d91a50b8959e5b54e10fdf8a9fd", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344413, "uuid": "71ef9abd-ba60-4e9a-a717-fb5eeba9abb4", "comment": "Malware payload (MarsStealer)", "value": "301615452ba34c930b9d134ca4e3b8082f15cb1b", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344413, "uuid": "56026300-c452-4b86-a8be-39d532e60b06", "comment": "Malware payload (MarsStealer)", "value": "8cff6dd61f22cd7a739f0b82082e00a223c92d53b2d6a54082dc293bcf5dd22b535280c12629e08d38ab0f043865ad6e", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344413, "uuid": "b08f14a9-b66e-4af5-82f2-71afc9c0417c", "value": "T1B69633213DFF109DB3A3AA5D4BD8B8BF495AF663270E30F9207157464722E818D92B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344413, "uuid": "ce9ce8c6-834b-44ab-98ca-9125a8c691e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344413, "uuid": "db91aec7-6303-4e4b-9a50-57e7f9820978", "value": "49152:lluK1ytb+UC8AcqHag6tUDGBJseZHonFZbBZSGJv5pRGzO8KRi6hZSpm4/HScWnr:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344413, "uuid": "a978dddc-ae7c-4c6e-8086-f7943fa5355a", "value": 8767488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344413, "uuid": "587338f0-5b93-4220-adb3-799994fc9531", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344413, "uuid": "e05c0740-38f3-4513-93a3-f76b8cf33a1f", "value": "proccexp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8f1140b-61fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1696344882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344882, "uuid": "92ac2ede-6c82-4c62-a731-772244c6ec79", "comment": "Malware payload (MarsStealer)", "value": "5d735b58f9fe896247dfd619893b830c", "object_relation": "md5", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344882, "uuid": "ce874b76-4001-411a-9143-a236034435a4", "comment": "Malware payload (MarsStealer)", "value": "566a36b032dc9b2547ca992342151ca1b1d7673e727358f1316c8c67a62ca8a6", "object_relation": "sha256", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344882, "uuid": "3c996dde-cb5c-4e8c-a587-28771a1ec53c", "comment": "Malware payload (MarsStealer)", "value": "8fa7c334c12112a61af7177c47e3b824d44e1963", "object_relation": "sha1", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344882, "uuid": "05ca3ea0-bc03-45e7-ae94-20a64365563f", "comment": "Malware payload (MarsStealer)", "value": "dc334cd8bef6def94e7e272e8018080f0c07d66bb2bc28917066b35646559bf544463c61e3a5522cfc2397efba070b8a", "object_relation": "sha3-384", "Tag": [ { "name": "Arkei", "colour": "#82123D", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344882, "uuid": "559bc367-6dc5-4cf9-820b-f5dc2928c7a9", "value": "T13A56BA202CFF109DB373AF695FD8B8FF995EF663260A60B9206143464722D81DD92739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344882, "uuid": "3a7ee7ae-cc41-4dc6-ac66-ee31cff07c35", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344882, "uuid": "4a40eacf-ccc7-4e13-9a1c-778f15e246cc", "value": "49152:SuUT9ho5s6WlsNgoJSFLu2xbpju1rvK1dfZXwPsaYwwZQlF2whluVg8GxNrgnWJk:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344882, "uuid": "d1149c33-bb86-4f64-8a40-54254c14c4f4", "value": 5966336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344882, "uuid": "34b8af62-8435-4315-a829-12779a67f75f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344882, "uuid": "50ec12bf-a807-4861-89c0-1aaa6a5fbe0f", "value": "utweb_installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea709d7-61cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696325242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325242, "uuid": "4f99854d-877d-46cf-9a88-cf7c3de4dbb7", "comment": "Malware payload (RedLineStealer)", "value": "2cb1b3c81752a22e37bebb0584e3ff12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325242, "uuid": "ca8a1964-df8f-4916-9dc0-3b4ba6028b4d", "comment": "Malware payload (RedLineStealer)", "value": "567eed6ecf2cdd673cc71e91a376110eb2736239fe7bd70214277e2c5c78a9dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325242, "uuid": "cf8dc367-bff4-4013-9f48-83e09ddc6179", "comment": "Malware payload (RedLineStealer)", "value": "778f7a932004c9aff7d26b98ff1cc3dd746e00d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325242, "uuid": "aae90d3b-98f4-43bf-8bac-5ee50baa780f", "comment": "Malware payload (RedLineStealer)", "value": "f3ab7ca2782448e1907b89fc04dc7361fb2d646227b2e88e3e83d439d9c4e47e75d873a651f458ac594476050ce95821", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325242, "uuid": "9b76b533-06e3-4c7e-9ebf-b44c55fbfb8e", "value": "T15B047D54731C82BEC1FB5BB210118424271B438942E8FA9D76E396E93FF8BD2659D70B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325242, "uuid": "b7d1005a-005a-455f-bc02-bdca8d7d841a", "value": "f707ada0aac189999ec6eb4a5a71dfbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325242, "uuid": "c8a24359-8571-4c5f-a1c5-be319ac487b5", "value": "3072:DoXsPUOyi55lyjlmG5gJVX/2jyfvFkRzC2Tbj6lpaippjIQHPWGLC8eZk1SGj2vv:Dom55lyjlL5gj/2TilpVpjIQHPWGLCpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696325242, "uuid": "2424872e-0121-4730-8645-42660320d390", "value": 187904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696325242, "uuid": "ca4f6d02-bc69-4665-a2d8-2f88b9148738", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325242, "uuid": "6b6ce668-2183-4202-966a-3e3eda5e7fe1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19774c1f-6248-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696377229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377229, "uuid": "814122b5-d1a4-4d93-aa86-9a29ef4815db", "comment": "Malware payload (Mirai)", "value": "859a692af107149222b0d86e1dc15265", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377229, "uuid": "30ba7643-716c-40e7-834e-7b596ea93ff6", "comment": "Malware payload (Mirai)", "value": "56cf02d40e43f9d95110fdb9849b64154c6ec2ea027250678aefa7ba9ad72040", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377229, "uuid": "0837b205-e341-4e0b-a30c-f6de8c3e9223", "comment": "Malware payload (Mirai)", "value": "0c81cec993cac7185d219bbfab84ebe49120ecb3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377229, "uuid": "d1008872-1a57-40c7-a4c5-8f0b99918fe9", "comment": "Malware payload (Mirai)", "value": "e9b772176d558053a157bf7eaded799d9487b7725e0e36f771dbba7338695e2f2d7e86bebe123b381bbd301f36ac12b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377229, "uuid": "07b11671-7c90-409d-b5ef-afdc3a2614a9", "value": "T140D31886B8819B21C6C516BBFE1E018D331357BCE3EE32128D145F64778A96B0E3B656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377229, "uuid": "60345c67-0af7-4d09-8891-ed24840abd2a", "value": "3072:DYLH/H6u2WGX+tmA799zPrs8OANYahb2rKodgvRpzGGWpKw:DYLPx2fX+17Lr3OAyahb0PgJpzWpKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696377229, "uuid": "8d18d062-c425-449d-9b92-4863dfdaaffa", "value": 132632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696377229, "uuid": "dff0d006-b71e-427b-9b89-1e8edd26e129", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377229, "uuid": "31222188-7de1-4779-812b-4d7ea8be3541", "value": "859a692af107149222b0d86e1dc15265", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024ea089-61d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696329516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329516, "uuid": "c35575c6-1822-4d3d-9127-6542f54955f2", "comment": "Malware payload (Mirai)", "value": "9cfdd73aa68ead64e351955a92db35cb", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329516, "uuid": "8d4d5764-07c6-43df-badc-6b2241ffc097", "comment": "Malware payload (Mirai)", "value": "56f585aa7ebbb9fec286f1d02ebc6ba591a94d7d5a6adf800860bf371821325c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329516, "uuid": "8a4695ee-34fb-471d-af4d-007c5c7c977b", "comment": "Malware payload (Mirai)", "value": "a66eafa37648cbea575d32b9c2617d0dfb326665", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329516, "uuid": "1134b704-db5c-44f9-96db-c92dc1321565", "comment": "Malware payload (Mirai)", "value": "5c7a72f39fc4fce797c3ad49b0ac8fe118cbe016aa6602c50d9799deb4189c4013dd15ae8fe99a7ffd82d38c24ac3fac", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329516, "uuid": "406d52fb-a20e-4149-b049-f1fa068b93b3", "value": "T1E0D2E1EBAB6AF2F4D87D7830168E4160A5B97205BD40056F25AF00BD4CBFECAA115E52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329516, "uuid": "c00aa368-18e3-47bc-b445-95064bb7b246", "value": "768:v055W9Q/Dk45FcckyVb7q+2JZfj0nVQtx0eS:c55yWgIFJXqZftfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696329516, "uuid": "c16e81cd-2d21-428f-87a8-5ba69d0da9bd", "value": 29528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696329516, "uuid": "5957cfc0-23fc-45b4-864a-fe174a47a19f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329516, "uuid": "cedfc753-4846-4fa5-8a2d-c162d1d70230", "value": "SecuriteInfo.com.Linux.Siggen.9999.23213.9301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c3f6b51-61e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334338, "uuid": "4b553ce2-5a95-4578-8f96-285050456667", "comment": "Malware payload (Mirai)", "value": "2b3531bca1b7c5ecab148df09cc8b76d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334338, "uuid": "fdb0d51e-9eea-4e95-957c-effba54c73cd", "comment": "Malware payload (Mirai)", "value": "57885d21223d3be5a09601b0143a9016f3752b11138234b5ff0b0b4680ba311f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334338, "uuid": "ff5b2767-6d20-46c9-a320-bd5e1306da1f", "comment": "Malware payload (Mirai)", "value": "4a2d03c100cd227cc3194a054689579c7b95de63", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334338, "uuid": "1a69b6f6-8ddf-451f-8b40-55e567fcb5cf", "comment": "Malware payload (Mirai)", "value": "ec7320a0fab9dbf1da57ee2d3ac55c4dfec06ef0d7671cf5178a1b8e75948b115ed289ad8d988e3f4287901e62d7e0f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334338, "uuid": "35a9a06e-4b55-4d19-b123-dbfe785ea232", "value": "T1EA63F887F901DEBBF40BE3B645D709167130FBA60D931B727263B8A7AA351D41422F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334338, "uuid": "d631fc4d-7c4d-449b-8978-e541a2b9370b", "value": "1536:/kfk3I4s3EcsiElTX18oygkM7A8Vizg4AjHMFXePasN0dDyr:/kfk3I49iEl7HygkaVag5xPasKdDyr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334338, "uuid": "4935660b-6c36-438b-926e-1c6dc17c67be", "value": 72424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334338, "uuid": "43722120-5275-48a3-a619-914a42f54b91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334338, "uuid": "47a344ab-8136-4417-8d62-f0c4ffbe4e3f", "value": "2b3531bca1b7c5ecab148df09cc8b76d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad6f598d-61f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696341829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341829, "uuid": "5ba7fbaf-7020-42df-b61a-3f73a7b8d431", "comment": "Malware payload", "value": "ade8657dc39e6078c7b0bfb7ce9cf138", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341829, "uuid": "0876807e-cb1f-4350-8054-78a0f6c4d7ef", "comment": "Malware payload", "value": "579b0544fb3ab18f7384df17157a80fcefe4e7d0d75550175ee5ebc5045cac39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341829, "uuid": "45bda61d-3e6a-4ca0-ac11-a43d0b2b3084", "comment": "Malware payload", "value": "79673c820018267a0720e71122cbccd745fb5497", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341829, "uuid": "66c0fbd0-de76-47ce-a679-786661337497", "comment": "Malware payload", "value": "0bf62a8feee4613d5f38df7e61833b4558e36b6b7d8fc999e978dc3240d6e0925459161f5a3668a308ffe44c12cbb6fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341829, "uuid": "8c5dabd3-b1e3-444b-8d8e-6ddf4c6e198e", "value": "T18137372439FA501AB173EFAA8BE478EADA6FB7733B07645D105103864723981DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341829, "uuid": "b5238c82-b4c2-41ef-8e93-fd3f28e52b13", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341829, "uuid": "d6b4edf9-bb4a-42f0-8c32-896f50855863", "value": "49152:1sFo1D95BCNgIjZ7kt3VYzASHGtXy5VhRjFZR5zWQmAaIo2JZ3u0myRd7hCHPPDy:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341829, "uuid": "7f07856d-bfc6-460e-a93b-b919fc9a94e1", "value": 22518272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341829, "uuid": "ec4603bc-f84e-4130-974c-7a1b1e684fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341829, "uuid": "40667328-813f-45f6-9dbf-16b6f8201bbc", "value": "SpotifySetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "005501b9-618e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696297301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297301, "uuid": "9704e319-b078-431b-a01e-8f6ee2d52da7", "comment": "Malware payload (Mirai)", "value": "5f3f4a7052651807be1798e34fcd3d7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297301, "uuid": "1b4584ec-7f90-47be-8b81-65606d9e94a7", "comment": "Malware payload (Mirai)", "value": "57ac6edb2512e1d0082184a8c0ddecd9fb2ada218e81617d13b2fc00a355dc60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297301, "uuid": "e02dd416-75b2-45df-90c3-35d55c439751", "comment": "Malware payload (Mirai)", "value": "d80451bc0e75d8fc3af2eb6ede004c5e54935e95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297301, "uuid": "b560b0f9-770c-4ae9-a4ee-b60d68a42a13", "comment": "Malware payload (Mirai)", "value": "96415f8793f8829729989367ceceaf3878e27d151a51c3210e3f0ef775abd05587faf15b9438f8399d8283bc4962a686", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696297301, "uuid": "93c526c4-2429-4267-844e-6844a515cfb4", "value": "T143635BC2A542CCB6F95382F0016BDB35BB77A0776026D697F3951A3AE874EC0C58236D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696297301, "uuid": "3456189d-8011-4b36-93fe-fd9f65f264ed", "value": "1536:LtRgifNILcpJZS9YP/ur4R1Tbuoc1CMeMOXL2wxOIBNcpYzJkWRNSLJqSgb:xSifqDmMg2jIcpWSWvcJEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696297301, "uuid": "46194f18-ad73-428b-abb8-69ce9ae43f88", "value": 71036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696297301, "uuid": "ad6c4b39-7e6f-4c04-88f8-35cd604fb26a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696297301, "uuid": "ce53fffa-132a-4269-960c-2ab147ffd596", "value": "5f3f4a7052651807be1798e34fcd3d7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d40f638-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696374337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374337, "uuid": "f4a421c3-dd01-4a25-a7c2-b342cb70a049", "comment": "Malware payload", "value": "f3637904f12b2a5bc9c1a4510fe5be0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374337, "uuid": "db6fad06-a169-40c4-8ea5-b05516f98ad9", "comment": "Malware payload", "value": "58f3df49c36d59a8374339ef09c5e3ecbbd2d346c2dd892389159f710d13b252", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374337, "uuid": "acbf292c-8eeb-4c89-b712-cfecb26bbfc5", "comment": "Malware payload", "value": "f4e694a55d36fe87b1e5a7c218c839a520fdc3ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374337, "uuid": "ee9aec7c-dd90-4a27-9afc-ae418f44ece0", "comment": "Malware payload", "value": "4d94077f621de9984cd8638b2f3668be9c3e5377ca8398ba86170adc80519baefa59cb3db8f99f099c27f69b6d17be5a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374337, "uuid": "0199c695-9989-43b1-a753-0ed4ac005747", "value": "T1AB73B609BF654FFBDCAFCC3749A91B0625CC551A22A83B757A34C818F64B64F05E38A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374337, "uuid": "bf15b69b-8df9-4c12-be71-0eb0c8b14192", "value": "1536:89s6AWScAM1mHWfroZlVbhuw1slQBS7jWnd6erD:8qYScAM1mfzVVVd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374337, "uuid": "8b5e3f37-40e1-49a4-987c-a9d96092cab0", "value": 76044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374337, "uuid": "65135ab3-3628-48ba-8b9b-06e969828484", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374337, "uuid": "92d93325-705e-4787-bead-f9cf4b63b5fd", "value": "f3637904f12b2a5bc9c1a4510fe5be0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "412048fd-61a4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696306859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306859, "uuid": "64354210-078c-487d-b6b8-925d2d540fa5", "comment": "Malware payload (Gozi)", "value": "c6c6f5a3d3e0444820d2865c7f1a07bc", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306859, "uuid": "95ea5188-65af-4c8d-86b8-581b58451b0b", "comment": "Malware payload (Gozi)", "value": "59944e8c11bfc2d065ef88fca0a033313361ae424962c34573755da99badbf3f", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306859, "uuid": "bfe098dc-caa1-4640-a967-1d10bd8a9f41", "comment": "Malware payload (Gozi)", "value": "5f9c9620e315b09802e8e532f48195a9e60f2d2c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306859, "uuid": "5a9ca0c8-ed1e-431b-8057-2d0328cb068f", "comment": "Malware payload (Gozi)", "value": "7737b61d3880daf1bfcb5bb5a11b6f6eda3ffdc6700d44de46d0b4aa7099f457f68147391bc5cf86a38a347d03a5670d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306859, "uuid": "dcd1299e-ad32-4dd5-8da1-e3bf6b363be5", "value": "T19EC022184E4DC162C002580A8068FC98AC0EB0442DE6E8981280DA8A9C810D4DE08EBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306859, "uuid": "da06c0e6-4cba-43cf-b84f-54447c639e48", "value": "3:HRAbABGQEb/5sQaOUlQ1AAM7ovQvycAI9RyJ25YdimVVG/VClAWHn:HRYFJb/5sZO9NwovQvyc1yc54vVG/4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696306859, "uuid": "a8ff09ca-0d53-40dc-ac37-b2d1a8116fcf", "value": 192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696306859, "uuid": "a405edde-1cb2-4449-8586-f84d773aaa0a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306859, "uuid": "614b8ddb-0af9-4505-9a1a-68938d22d7b1", "value": "Documenti.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74a01efb-6181-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291913, "uuid": "0082b4fc-ca8a-4205-8cd0-4efac7e25828", "comment": "Malware payload (Mirai)", "value": "34918c2958fcef2f73ae210a98cd6705", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291913, "uuid": "5bb8da9e-1966-4b40-a836-652de8c0ce1f", "comment": "Malware payload (Mirai)", "value": "59c0995a2827ba84497e1e099441763c8018aa0c8ba3889d35766947249e40d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291913, "uuid": "31945952-c3d4-42e7-bc4a-8866ec5cf2b2", "comment": "Malware payload (Mirai)", "value": "7ca846148798f366d79e451384adb194b4155bb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291913, "uuid": "bc4ef0c1-548e-4f4e-ae62-b459a35fd271", "comment": "Malware payload (Mirai)", "value": "a6270f8367dd3e010a7e818507cedd851be941b9e0d2ef29a1cc4f59b41f5ef90d8704cd896f261e8d3dc47d1c31782c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291913, "uuid": "7466bbb1-9bea-48e9-be19-2b1640571855", "value": "T18CD2E12CD85D7E09CA9D3EB964CE96B5398C70C0A35EE68E17274448B717B9BBC070B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291913, "uuid": "b2df6a7b-fe22-4b04-9557-c710a329a6c4", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNzJbiWUY:1bDs06t4BEub4sU/MbUzmY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291913, "uuid": "49db2768-8000-4711-a2da-6d458ae1a005", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291913, "uuid": "d2eeef0c-c4a1-42b1-803c-540b4dd3d3b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291913, "uuid": "fb1d5601-c264-4c29-b288-eda6d4570dd2", "value": "34918c2958fcef2f73ae210a98cd6705", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "955dee79-61d4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696327616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327616, "uuid": "4eeef0cd-9195-4777-b184-89ca7a1c2a72", "comment": "Malware payload", "value": "761be047c0f1bdfbf5208e01770e3a8c", "object_relation": "md5", "Tag": [ { "name": "citrixupgrade-blob-core-windows-net", "colour": "#3E9139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327616, "uuid": "62919022-707f-4344-b039-5d97bf9643ce", "comment": "Malware payload", "value": "5aa09ebf243b16621943fcb32eb161e6d61e3018829c7687c051d785104d5777", "object_relation": "sha256", "Tag": [ { "name": "citrixupgrade-blob-core-windows-net", "colour": "#3E9139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327616, "uuid": "ac1228de-6ab2-4aa2-9b8e-d08f299e9eeb", "comment": "Malware payload", "value": "981e337e3f9070f3018079b3a1be4620f0ba217a", "object_relation": "sha1", "Tag": [ { "name": "citrixupgrade-blob-core-windows-net", "colour": "#3E9139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327616, "uuid": "a3447e3b-e760-4e16-b4b4-e0187626079a", "comment": "Malware payload", "value": "f5bba85df7b4595e3863c720b7cfd5ff26d6703ec782eb63cc5ecc1befb251672975a805fb70bf0d144f4974f2a4c366", "object_relation": "sha3-384", "Tag": [ { "name": "citrixupgrade-blob-core-windows-net", "colour": "#3E9139", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327616, "uuid": "35ebf11c-c0ca-4ea3-ab8e-deb1d7312f02", "value": "T12C95330192E377F9F3365AB0B453370E4B8B8518AAEDF1E59FB8910B4D90F6C49AC905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327616, "uuid": "66258909-6ad3-4397-aa82-c1aaeefe0228", "value": "49152:2k40lRoowMH6/TlrJgHmRx8/nGy8D5fwBMXJCCR+HhHqKxy2RD2UQee4rgVJ:2kbsIa/vPIurftXJCe+pOee4rM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696327616, "uuid": "d728ea5d-c9b2-40b4-aaff-a9d274b8101a", "value": 2041195, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696327616, "uuid": "770107aa-18ac-4803-8f32-2ef07ebde81a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327616, "uuid": "751911da-6952-40d0-b0ca-33ef4079542d", "value": "selfservice-package.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f6cafda-6228-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696363469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363469, "uuid": "b10e9fdf-9043-4444-a934-38b2096c197e", "comment": "Malware payload (Amadey)", "value": "dbfac1fcd826ac84ccecd1e358c40989", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363469, "uuid": "8f6ec1a2-d365-4056-a067-5bddc118cdf3", "comment": "Malware payload (Amadey)", "value": "5b333ffb18361963d4546ef43e7e0bcba46a996bac0fb52d0062d739fe226295", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363469, "uuid": "d401a804-8909-47a4-b079-67718375dfed", "comment": "Malware payload (Amadey)", "value": "d7520783ca77b247308faf861ec235075437c0ba", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363469, "uuid": "a321e10f-8bd9-4978-835e-1fca0c8da607", "comment": "Malware payload (Amadey)", "value": "38169563c4c9b30fb1ac62abba52d3607c4856edb79a20554f30d321538616600d78a0de965049fa8e959e931b8470dc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363469, "uuid": "c7ed4342-8479-4d8b-8cb6-f9b2e9489f2b", "value": "T18C652312A7EA8137D8F33378A6F723D30E39BC669AA8461A1746791D5C727C4307532B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363469, "uuid": "47ae4715-4fd9-47c0-a8f4-4c2a702efafd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363469, "uuid": "aa200008-31cb-4c66-ac82-d22e10006ff2", "value": "24576:XybWs7JkCNt/d/jKO1DtHZUEmNu1VrPaab3vGcQ98GNKxZ2O:iKzgkOZFZUEmNubrl3A9SxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696363469, "uuid": "259b35a4-7f9a-4d7e-8a42-728ee32ddc6e", "value": 1494528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696363469, "uuid": "4c3321e2-b1ce-4e81-952b-c56e2c5b0dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363469, "uuid": "84176f6d-7269-4e75-83e4-76a051da0fee", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa0c321-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344544, "uuid": "a37b53a7-2c76-4ed3-b9b3-6c12f8586a2a", "comment": "Malware payload", "value": "fd1637176652e393d77962c5c75659e5", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344544, "uuid": "8109ca6c-b0b6-431f-9832-ae063a612386", "comment": "Malware payload", "value": "5ba30060aeccecaaa279629b70ab9bbeb037465755a084accf2ea12be1a8e4cd", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344544, "uuid": "16052df5-340e-4ebb-9e92-bb448664444b", "comment": "Malware payload", "value": "d65490e5b2330d96a8221907653ba203f982605c", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344544, "uuid": "49be9a08-42be-4993-8bf3-1c86c67080c5", "comment": "Malware payload", "value": "2d4a1e1096b8bc125c86d145fd5e98a91e5343a0c241cd22c431c947f6b4912f7a429f1151fe5635c0622c6fcc263991", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344544, "uuid": "10a05850-1599-4cde-b54d-e2484b528001", "value": "T1B2B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344544, "uuid": "6d3baaeb-916e-43cf-94ad-6ae0f44e8ae0", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344544, "uuid": "ed2422df-ec58-47e1-9a42-fd5cb7facdaa", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344544, "uuid": "30a56e3a-1d9d-4441-814a-87ae37cf8d8b", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344544, "uuid": "c574e02a-8f2e-40d5-990c-8fe55ffcb862", "value": "AppleApp(114).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0011cfa9-61e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1696333808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333808, "uuid": "89dc19ef-1a21-48c4-9559-8f50088c4f01", "comment": "Malware payload (Gafgyt)", "value": "7a665b15f306601ad402d7bc8abe7b3a", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333808, "uuid": "f958278b-9187-41bd-bb92-f03c3d96309c", "comment": "Malware payload (Gafgyt)", "value": "5c2e99962cc15af6082b087be574df63e99d64480c125ff5104cf8230c950f18", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333808, "uuid": "2674e380-c3b9-424b-aca6-fc2cd1b9ecd5", "comment": "Malware payload (Gafgyt)", "value": "d5e29530684d57fd4e2340d9c4d794469106bc3e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333808, "uuid": "0a6e671d-142a-4c3d-8cfc-8a6a93ca24fb", "comment": "Malware payload (Gafgyt)", "value": "0ac2cf2f1a3b8f58684a4d4cb24a9e1947cfb801ff4106158dbc48b041eae284a7d4f9728117caaa9bee6af88d1c2809", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333808, "uuid": "9cd8ebd5-cdee-4f07-ad1b-950f27873539", "value": "T1F7730745B9819613C6C11B77FA0F438977334308E3EB33029A2AAFB1AF4771E4E6A151", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333808, "uuid": "7b3c392c-7dae-4b48-8bf8-d0210bccdf3c", "value": "1536:grwlW/BXKK2+dlxOkDj+rEfYbJL7vypPu6rYXOqJ2+oxBMy:EwCBX/JarOyypeXOqJNoxBMy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696333808, "uuid": "844b08ba-7851-4ae8-b3fb-d4ef4430cefa", "value": 76384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696333808, "uuid": "892c288c-3ca4-424f-a4f9-72487605d78e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333808, "uuid": "5925bb56-9f3d-429e-8ab5-ebb57db23678", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110c987e-6199-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696302053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302053, "uuid": "19fa269d-2434-4c9c-bed6-82048103ee74", "comment": "Malware payload", "value": "fd7e95582b2fffaac9cb676c9855142e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302053, "uuid": "d01d8678-5948-4228-8b5e-e16d1b7f92f4", "comment": "Malware payload", "value": "5c42db76ac40a7d4299b8255d854f7ec78635d1c248d5576adcc1f812e42f16b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302053, "uuid": "aaa17a59-8158-49fc-bc99-1e310390ce53", "comment": "Malware payload", "value": "bf2768aa953e1e67db4e00968c2f2eb53a62d3bc", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302053, "uuid": "b8847e36-70ec-4144-94d9-47221eda8926", "comment": "Malware payload", "value": "21c9786dd7f848954f1ffd7b4abf685579cc884d738b39ed08ab8afa36ed7e55f5b10986751659ac66d3d249b38b77c8", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302053, "uuid": "d853b461-39db-4d3e-8c43-9605a7f2f0af", "value": "T155E0C6C442210B92C222C8FF88E851A0A3234406C8E278F39626B42B0C10AC82F0EACC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302053, "uuid": "8fbffc72-9574-489f-beb4-b6dc9f3ae7eb", "value": "6:5j9W00kTg5gJbexpqGTxV5X+sjzWpv4c/2rRn0JPiaSQpd0kZnY9pau+l5:5j9HDTg5gJaKGTxV5X+sjzg4e60JKirj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696302053, "uuid": "8b11c7d8-c5a1-4ff5-8344-5e79be8747ed", "value": 349, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696302053, "uuid": "44b0ab1c-80f0-4fa3-b439-5d4c14fded5c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302053, "uuid": "77c5d0a3-c733-4193-8627-4d8afa8c3c96", "value": "Agenzia_Entrate336.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f13876b-61e3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696334074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334074, "uuid": "c90356c3-1249-43e2-b2ed-70bd16a9a430", "comment": "Malware payload (Gozi)", "value": "bb35f8c1a3236ad31c754cdfe795d57f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334074, "uuid": "6e79939b-e9e8-479e-ad21-0e9d800af013", "comment": "Malware payload (Gozi)", "value": "5cd96f6b1e6a4a172d852a7bcf5ad10bf029e135061f0ae5105f45a9920089a2", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334074, "uuid": "a8e929a5-23c1-45b7-8b08-181e936a6d28", "comment": "Malware payload (Gozi)", "value": "b744f8ae31e2b3f7c3b72b9615823a3a3ad02989", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334074, "uuid": "b0c52d25-b4b3-4423-879d-869f42eab778", "comment": "Malware payload (Gozi)", "value": "fa7a17239a2a9d137f876ad0e5880b47c31a710e534a41ad0168cd36529a5a8115eeccc75e29701ce8383c5265591922", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334074, "uuid": "df47cf3e-26ea-4401-95e5-513bc1df86cc", "value": "T19B549E1273E0BC21D4721A319D29C6F47A6EBCA19E6957DB33583F3F59701E19A22B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334074, "uuid": "a3ff89ea-4eb2-424f-b967-1540d471a926", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334074, "uuid": "4c8747e5-5fb5-462e-a980-995e5320014b", "value": "3072:4e6lIjmvg7aaCIg0JHk8D8uNhUqHAMMQKL2H/NHIS:4blIavYaaCIg6h/NhUDAHlH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334074, "uuid": "8bfc49da-6c15-480e-b1f5-f1dd84233ed3", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334074, "uuid": "7d3c79c7-2eab-461b-898f-fa2c9221bc80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334074, "uuid": "2eb542ab-6273-4e3f-bd09-40f2d50191c2", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea45da1-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1696313324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313324, "uuid": "d4a10d8c-4d30-4297-972d-dc8c0fe290dd", "comment": "Malware payload (SnakeKeylogger)", "value": "291dde9ddb602ad8d101533e359018f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313324, "uuid": "918bba7a-7096-4c78-bdfd-c244ce3b5920", "comment": "Malware payload (SnakeKeylogger)", "value": "5d1f88680c9b30e8c325de60fd875b0d7f5de7941e555e44176a215205fec641", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313324, "uuid": "faa56bc6-c682-47f6-a1c5-9b03a4d10464", "comment": "Malware payload (SnakeKeylogger)", "value": "5792144c35cec5a382552055bb68d0045c65ccc4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313324, "uuid": "8cf5b457-8e86-4e41-9843-e938a526e51e", "comment": "Malware payload (SnakeKeylogger)", "value": "5b3e9455f3c8dbb9c438f970d7fd5bf8522da496355f647c21f59cd715bb618b54de15ceb7c8a93d543d6032b6a7ad59", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313324, "uuid": "cb191757-79d6-4949-a0b6-9a015bc3f361", "value": "T12EE4120A2AFC46BDCB6D8A7E0671448203FE6119BF65D7C71D8A60DE3DD23626105F93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313324, "uuid": "381f487a-bcd8-4167-8203-64c4ba2f3ca9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313324, "uuid": "6983cfd7-8ec9-477d-8d7a-f7bef4d68d37", "value": "12288:EpxLiSAx5PWPQtt3IwpIuKBCQPB/u+IbRFur8ott29gR/dxEXvuspmly3XfMEN9o:EpV7Ax5uPZwiu7QPB27RFu42oWRmvwl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313324, "uuid": "b3551b81-6335-4ea9-a9c4-b5abe8c24206", "value": 698368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313324, "uuid": "184ed476-87dc-42af-95cf-c970b479dd4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313324, "uuid": "b5629771-c798-4ebd-bc77-88f0eb6401ed", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "931e62ee-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346080, "uuid": "1536980b-e7d6-4b13-9fd1-9ec4df6011f5", "comment": "Malware payload", "value": "08719675c8912b31b5defe3752b49810", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346080, "uuid": "bf5893fd-84e6-4db4-8d18-173c8e730ad1", "comment": "Malware payload", "value": "5e23ca9c577857712188f57053935c8a2eca83e94bb190b4110d38b994d68af2", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346080, "uuid": "3914d735-664c-4442-bc4f-99749b64a49e", "comment": "Malware payload", "value": "7c78886da80ccf11f8dfcba252f59ceac41ebde5", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346080, "uuid": "01275e63-2442-43a2-9d95-820bde34a5ee", "comment": "Malware payload", "value": "7c3cdf0c1b833d81b6bf18222a699de184172dc5287864f919805fa7ed7346a3ab119e52905cdb33f9956f187839c2af", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346080, "uuid": "d631ffbd-0450-4a5c-b483-ea81f6f522ba", "value": "T1B6B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346080, "uuid": "59c628a3-e83d-4cec-8960-6f93c8b47e90", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346080, "uuid": "d05c0a3f-b38b-42be-abec-83571dd48f0d", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346080, "uuid": "b545984a-947b-4bdc-990e-54348d73640d", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346080, "uuid": "371102a6-69ec-44bb-9266-bd1e929e89e6", "value": "AppleApp(167).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00d02935-61f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696340251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340251, "uuid": "03c98db5-4158-451f-9902-d9a99c3f3243", "comment": "Malware payload", "value": "c1e053b6de17e8ce2f379b8f9f5cd5d3", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340251, "uuid": "8cf15957-d22d-443d-942c-51c8fc257be0", "comment": "Malware payload", "value": "5e2f12ec578ace38e74d270e094a2855c77d98ce422be035cd8455cc7c021dbb", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340251, "uuid": "d48f56cf-090a-42b4-8603-1ae73a10ddbc", "comment": "Malware payload", "value": "cd16acc9658415f68b75b9f0356133cde4d0a690", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340251, "uuid": "f0ac14cc-1c53-46cb-9598-7b75639b9e75", "comment": "Malware payload", "value": "fe3619df4fdbfc85a1d14f3208a37ecff7d47e1d233fa7b0bc41ff6d013b1bff51d0d0db41426a59f0b44e404379a1c0", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340251, "uuid": "1bcbab9d-55d9-4cc4-89ec-be1a3c0b1b93", "value": "T15AD16D0FF31A0429C7ECF8B9E4055983BADE8027ED8C3949F923921811D3FD8EA59470", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340251, "uuid": "a08144cb-b75c-4d2f-8b71-4ff438dd38c4", "value": "192:L2UcUjnR5zc+w4rHd425u2Q0LbbprkZgYQCNscpJh04eK:LzxjRtcL4rC202QEpNoNsmJh04eK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340251, "uuid": "3485550a-2628-467c-88c9-9118541a4bf3", "value": 6656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340251, "uuid": "2df559f1-8f02-4b12-ac50-d988c8f90cec", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340251, "uuid": "cbfb7756-c296-4664-8812-672cf3409bfc", "value": "Braemar MTM Report.xlsx.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557774b6-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1696313335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313335, "uuid": "6fda56bd-d650-4ff3-9628-547eb211fa6f", "comment": "Malware payload (SnakeKeylogger)", "value": "fe87c4e3c089316d0222db4965fde5dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313335, "uuid": "6ed52c90-d847-4c4e-9670-daedd4859510", "comment": "Malware payload (SnakeKeylogger)", "value": "5e437cb4a253b31df25cd406127f1d6be2e1e6eadbe1bc90a8438c674d6c3240", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313335, "uuid": "ef433458-f91a-40e2-92a7-9a3bca4ec585", "comment": "Malware payload (SnakeKeylogger)", "value": "0a66f5477620ecef41dd14322359a468c7ceba3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313335, "uuid": "e2a76d5d-07de-40c1-97d9-f2131645efd5", "comment": "Malware payload (SnakeKeylogger)", "value": "43744e0eb333ea1cfcbfd83e30194c77c01ee99e869785b727332d0986c1ee610825a11f347e2236416f486f4fc66dac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313335, "uuid": "56c8e60f-3bc2-4918-a679-5fbf09a0ac78", "value": "T182C4010071792B6BEAB6A7F92872251007B1FA6920A1E31C6DC670DF9D72F408F54F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313335, "uuid": "7ef6e41f-9815-4a7f-a016-0c6524ef720c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313335, "uuid": "85d26ce9-563e-4678-8ae3-a9b52da3ab4a", "value": "12288:4nexQNumB0ldv1XWG/dm5EniOqJt7MAhx7NpckoiOLIZ7c:Vfykdv1XRF9nSM+jCU1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313335, "uuid": "4fc5ec70-8c3a-4b47-a7b7-b2b022b54810", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313335, "uuid": "98db1b78-04c9-46f4-b6d0-1b966e12f606", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313335, "uuid": "a9e508c4-071b-49ff-a4d8-ed0fff890c83", "value": "AEAT - Aviso de Notificaci\u00f3n.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038dbd25-61cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1696323506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323506, "uuid": "4fb7dc78-d5eb-45f5-b646-82b712fa5bef", "comment": "Malware payload (SnakeKeylogger)", "value": "bbe4ed27d95620b9cc5ccd8ff22c23ee", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323506, "uuid": "c5cfcc95-9f1f-4d2c-9b15-a95e43383012", "comment": "Malware payload (SnakeKeylogger)", "value": "5fa9f7e6d31ba4ba152a524a9834b4eaeb32a88e1bb48ed0e86b5d65b903ed14", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323506, "uuid": "0b7bc826-b286-4a95-bbab-dcff365b257b", "comment": "Malware payload (SnakeKeylogger)", "value": "1b547abf053a03dee69aa0ca7dd8e28dd2fd6427", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323506, "uuid": "8244e75f-4888-43a9-8410-025d22d185e8", "comment": "Malware payload (SnakeKeylogger)", "value": "872c4110baa4d9ff6bd163bf3fa8466f290ae835f78b93955eb87175c9d960360aa6825d547856d13be0b2a56621bcc8", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323506, "uuid": "ea45a030-7f15-4664-ac22-1c31ad9757be", "value": "T1A1C312E48BE762484D04CFDC2F1AB396635062A4FC2542EB14DEF1DCB2BE91C9925B94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323506, "uuid": "2fcfd051-3f20-4754-93b6-30732da64171", "value": "3072:Dkn70nDxqiwAYavcar0Ub3TKvZMy2RX9cE:Dk72Dxtwovc4D6uyWiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696323506, "uuid": "3cdce27b-9ce5-4e87-91cd-07c2d5287ef8", "value": 123666, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696323506, "uuid": "3ee26bea-51d6-45c2-813c-43a8b661005e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323506, "uuid": "fa9a34a4-5ad8-4550-928e-079f2b44d2b3", "value": "VSL Q88.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1d1f9d5-61c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696321677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321677, "uuid": "9cfb727b-3934-450b-bf7f-118c1d3d8143", "comment": "Malware payload (AgentTesla)", "value": "f112f9f94afaa8cefb40f29940e774d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321677, "uuid": "a5a1ef92-80dd-4125-a391-705cf93e91bc", "comment": "Malware payload (AgentTesla)", "value": "600cb7ae30ae443aa665bdf75816739fdf916e62f848cd53194e1a71b9559fc0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321677, "uuid": "bab4505e-601e-42df-aded-3024a0198c16", "comment": "Malware payload (AgentTesla)", "value": "b320bef8a8e43a51ae273339ae942ea45eb9ad4f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321677, "uuid": "56cc1e78-341e-4c05-a228-de409b8d06c3", "comment": "Malware payload (AgentTesla)", "value": "2fa0ba2cf7b293810bebfec203cca08efc9a7c2d359f2cf5a6467fb63aeab5580044b0fe11f7f1aed5652ce47856771b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321677, "uuid": "f7f7bdb1-1f8d-4389-918e-6b00061168ed", "value": "T101C312E1F5840AA71ED3E527342B7035F2F248D860CEDC5AFB8764D2C91E874472299B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321677, "uuid": "eb1d0c06-22a2-4b8c-807f-8a378f18f41c", "value": "3072:cIZ5B65NEKoK5q6PocPhRIooFi/LMzzFzfCR5xlYjV7:RqE8A6V0hML0oYh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696321677, "uuid": "50621013-9847-45b2-97b1-f0831c384818", "value": 122954, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696321677, "uuid": "ff68e769-626f-48d8-bc8c-c09bb31e53ff", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321677, "uuid": "c30295de-4ad8-41ef-b760-a36213e94e2a", "value": "TT COPY.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6b994c-61bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696317157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317157, "uuid": "680de709-ac23-43f8-b44d-20fb21147290", "comment": "Malware payload (AgentTesla)", "value": "61d3b0268ab312ad7183a693041e5566", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317157, "uuid": "633669fc-0856-4013-94fc-b096bb47a5ef", "comment": "Malware payload (AgentTesla)", "value": "60d963ad6d64ed53b4ef360e0fb04cbd0ca8c17d8de0fa29263daa531fb572a6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317157, "uuid": "5412a845-252f-4afe-9946-4fa660fb8487", "comment": "Malware payload (AgentTesla)", "value": "daf1c38ca56a0b8163aee55735cc1c34fa53de2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317157, "uuid": "10546d93-24e1-47c3-9af0-5a9cdae8b300", "comment": "Malware payload (AgentTesla)", "value": "5b09950595a8927c9a5f23a9f643b534ae89869fc1bfc325d2efb4775280b14097220605864e069e62ea2d7ad89f163b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317157, "uuid": "721a82c3-fa62-41f3-95d6-77978b4a84e3", "value": "T18D842306A9D0DABBE47383B00D7B95E3FADAF8305498CE4BEB840D55FC33641894DA65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317157, "uuid": "b219d502-c829-497b-a860-9e402c5d03be", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317157, "uuid": "37864419-28c5-4db7-9811-7a79023e1a11", "value": "6144:BnPdudwDsbeDOZX9lCmKb7x2Du6Exoa4Kb73KxyxOEf0hLynPbZyvXNvWeAzFPrU:BnPdwbeDmt0r2D/E7PUy0BLyTZGNbqrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696317157, "uuid": "95b9f42c-fa1b-484e-831b-1f793c98c07c", "value": 374434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696317157, "uuid": "7b00e5d2-1d80-4c44-8eeb-5778a3e34174", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317157, "uuid": "534b84e4-1cbf-4314-98b5-730609d1c79b", "value": "RFQ-000112030687.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "134efb97-61e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334699, "uuid": "a41aa31c-2abd-451b-ba30-21658c192cc9", "comment": "Malware payload (Mirai)", "value": "e7bb977700d2cc940028acf9cde40254", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334699, "uuid": "18bfa9fc-2e01-43eb-95a1-93d22ca8a169", "comment": "Malware payload (Mirai)", "value": "6152ac21273acb9f28e42d19b4bc6d9aae73ce3ed9fd12f2ce066253bf702029", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334699, "uuid": "50130812-b0df-403b-bec0-3da990ad7b99", "comment": "Malware payload (Mirai)", "value": "716362488c9fccbb046f62186b95c59c97cc8e21", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334699, "uuid": "8f0ebfc0-9fc3-4d26-96b6-2dfdf2be719c", "comment": "Malware payload (Mirai)", "value": "cbbb501ab7053993fbde9ee5d4a8cdbcbb4b84f95dba00640e7ee6920c9caa7aa5da5bb9caeb1440e8868d6c77c3959d", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334699, "uuid": "cc9ecd67-4f91-423e-8e87-ed86113d0b7f", "value": "T178D2D0EB58BFF276C0766874206011D4FA383517E22D571B0CAAADAC69F66D43620A51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334699, "uuid": "3fa0fe58-e15a-410b-bcb6-36e3ca83b6f1", "value": "768:DYSoXdJZ5U05VxmHSSc+H2c+lPY6OdSx0sT:DYJdJZ5UQVH/+KY4tT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334699, "uuid": "4fdf34f1-d304-4346-89c7-a2888e957a7a", "value": 29432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334699, "uuid": "26e5d5b0-11d1-4019-a2a2-5cfbb8c357cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334699, "uuid": "623c4512-717e-4a44-9532-a084cb7ef377", "value": "e7bb977700d2cc940028acf9cde40254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb2ee122-61ce-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1696325129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325129, "uuid": "e1ed8f76-ddd2-4a56-83e3-2b5a678be4b3", "comment": "Malware payload (Loki)", "value": "6a7033f14b1e8160994193dc7bd2004d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325129, "uuid": "5aa9f1a0-88f6-42e1-95b5-8ebe2a33c76f", "comment": "Malware payload (Loki)", "value": "616936befc6956ed76300f793de7f3954a102733b534b020060168cf711e53a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325129, "uuid": "b06856b9-a171-45e0-9150-46c7e97f2cf4", "comment": "Malware payload (Loki)", "value": "1438692aa2c983667aec0edaf679396925d7f0b4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325129, "uuid": "e83802c2-9570-4a21-8823-b4859b640b34", "comment": "Malware payload (Loki)", "value": "583407f3cfa0353a4c9b7907ae6ba36625bd3346586ad0f4930c376f495f796b3f4f047de030066f919d2201c42e7668", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325129, "uuid": "093ea93f-6245-4722-9447-d699ca89bf53", "value": "T113C4F10A23BC45BCD75ECA3E1372544203FE61197F65E78A2E4A68C93DD63639200FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325129, "uuid": "48dea00e-c478-4294-b28a-f91e714e1583", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325129, "uuid": "ae09c935-a1a5-4937-9ab4-1e895e3b6c15", "value": "12288:snP2iSAx5PWPQCkzqi29HSoVo3FwQRRKejkrsGTEKR:snO7Ax5uPKX29HhyXuemsME", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696325129, "uuid": "eb492e1d-7d24-4312-b0dd-7f9fae3375cd", "value": 553472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696325129, "uuid": "aabf2fec-503e-4abb-a5c8-3d24cc504e21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325129, "uuid": "8a70d7e7-258f-4416-827b-e5f7134311fa", "value": "HAESU KOREA PAYMENT 20231003pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca4e2997-61df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696332429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332429, "uuid": "d2f08706-57de-4e41-a739-71a3e6c147f0", "comment": "Malware payload (Gozi)", "value": "1e4a7b79f273ee339403720850f9d034", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332429, "uuid": "1b69b6f1-ddee-4e24-bc0b-14ebedc74ac5", "comment": "Malware payload (Gozi)", "value": "6192a4330bfb0117d71982482bb31f6a04936ad827db57d38b4d52ad3f3d78e1", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332429, "uuid": "44d90a58-4d45-434b-805c-6d5fbbe2d5e2", "comment": "Malware payload (Gozi)", "value": "d8aeb3e58d24d29680d2b3dc1a92cba996d62a5c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332429, "uuid": "51d97454-9286-40a1-b0b6-da572638bcab", "comment": "Malware payload (Gozi)", "value": "e96f737c725d6ed41287a5aa9ac2541b1108bff6ca801a6509b03a37c9befc1758212bfb1e8e05b999f5649ff74db4d5", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332429, "uuid": "4b35d587-401d-4f1c-8f36-a410a390b2fb", "value": "T12024AF0C73D2AC31E5AF1937085087F92A3DF9A10F215D6F6B88D7661F50193866CEA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332429, "uuid": "63747495-e791-47f8-8fad-885ea879c9b4", "value": "b708bc91029a5428d40eddd35d2240ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332429, "uuid": "ed0ea6f2-d809-4d13-8e95-ae98a5f19e73", "value": "3072:AXV8MV3C77qRKKUSz3yTg/txvxo1Ry6ZN6rG+bZmobGAZHlCR8uUlB/961C03Mzp:c8Ms7IKIVS1w6ZNw08PL/k53Mzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696332429, "uuid": "1bd03697-d183-4600-9412-03cb8b336544", "value": 212992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696332429, "uuid": "69320177-6340-4040-994c-039ab11c1769", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332429, "uuid": "f30be576-6d9b-40d9-9f72-df810b1be8ba", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "958fa699-6227-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696363264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363264, "uuid": "73cca5e9-023a-4088-bade-9325d85744c1", "comment": "Malware payload (AgentTesla)", "value": "86cb5cd760baeedab92f1fa74a7ee566", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363264, "uuid": "a19f2db3-5a75-4498-b95e-e046719815fb", "comment": "Malware payload (AgentTesla)", "value": "630c670e2a7d49cba82a68aa324da4ea80e0cba429f2da39e52375aac154a283", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363264, "uuid": "19685ebd-d780-4df9-910a-a143a53e93cc", "comment": "Malware payload (AgentTesla)", "value": "5365de4454a2002c2aa5e00c6a500bcc4dc8e961", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363264, "uuid": "8dc863fa-e1b3-41cf-af77-03cc4bb8c930", "comment": "Malware payload (AgentTesla)", "value": "d6a3a8964fd2ee6b47f224984de6e962204736e4d6541476ed4160944c5df4c2e5565975af84a39cee47e706dfda40de", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363264, "uuid": "62549268-ffcc-44c4-b829-1e4a4f8e2a91", "value": "T1CAD664252CFF201EB3B3AE9C5BD8B9AE996EF773270A24B9107103464712D41DD92739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363264, "uuid": "e8a9f07b-7f16-418b-aad1-6a7fbc6b571e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363264, "uuid": "3b1ce5cf-2c38-46d7-b482-593fc5c473df", "value": "49152:O/JIw+KI/ZVtR+70DJ8QdvU5puqfZhjAY7e6YsVO/tk9X2b3oI3wiefo4k1vrIlH:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696363264, "uuid": "ddd6a243-f4e1-46d3-bdc1-4e57103bec70", "value": 13752832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696363264, "uuid": "db8f186f-5b26-40ba-a275-aa54f44b6e40", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363264, "uuid": "7ae738de-4ee5-4291-b9e6-408e4a0eb60b", "value": "Overwatch-Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fef488c-6203-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347793, "uuid": "876702e6-4308-4fdf-b6a3-06f46f48ae22", "comment": "Malware payload", "value": "92e89f123080ac4619b88b29d9055dda", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347793, "uuid": "b5e8abea-309f-446b-ab81-39cac7d3ae15", "comment": "Malware payload", "value": "634926a66a10aab84ce8d2f61d11607d5962e0e9f3639c4575490c2111a330fd", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347793, "uuid": "8f736fbe-f9d5-41f8-91f2-0d409ff63cf2", "comment": "Malware payload", "value": "7f20468d946cca3960eda2592666133aa16db462", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347793, "uuid": "fdaff93e-e9dc-4561-be5e-38168b1a68f8", "comment": "Malware payload", "value": "72b120ef5bddd45815a335f80e4ea0f2bb1989ad07d7de3f8db4a2aa647354f4d30c398ae4f98835cd755c8f6dd73051", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347793, "uuid": "4dffd23e-f8b6-4b4e-b543-10bdba09ea94", "value": "T19CB42338112D3CDBCE5356F7AEA42B729CDB85E729B4129001B242658C6FB4AF9F444F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347793, "uuid": "2d2ab9df-bb4e-4923-bbe6-1af335827180", "value": "12288:JMGiNz/PUAg4Nq474U1ue65dRDwdFBg+3oEpVQaoKk:mNzkyqi4UQ7m3BRo5ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347793, "uuid": "2f0a1dd8-223b-43e4-8ebc-fb1d2597c4b3", "value": 500047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347793, "uuid": "adc1bf34-bc12-4fb0-ab0c-74c34acee7a7", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347793, "uuid": "8b3664ab-472c-43fc-ac02-116c67542eb9", "value": "Installer_v2.1(4).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "926041d0-61c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696320309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320309, "uuid": "ddbf8495-bb14-423c-a90b-7b5578e308ea", "comment": "Malware payload (Stealc)", "value": "7153af8adca8378a5c7bb538b26a5bd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320309, "uuid": "cb96e0ab-9abc-46d7-b35f-3962e1f145c3", "comment": "Malware payload (Stealc)", "value": "64270e557c83856508c910892d6079b45aa2d2f6a2bde4b7e6d6180d174d90bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320309, "uuid": "2a36afc2-4b70-4ec4-8b92-3f918e63603d", "comment": "Malware payload (Stealc)", "value": "b2b2f58d22c49c4a482333da6591e3a5d0d5be54", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320309, "uuid": "6f3138f9-43b0-4d5d-b921-5b89a4be823f", "comment": "Malware payload (Stealc)", "value": "f6df67d08230ecd67fa4b55365f70a675bf9cf0f8e0e410fd8ce146b40d4c84d9c7e2385b9d906790c4a394c6d5c8e9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320309, "uuid": "462f7488-bcc8-4a20-a6c9-979b4e49f640", "value": "T1F0549E12B3E0AC25D4231A319D2AC5E57B2EFCA19D3927DB33583F2B58701E19672B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320309, "uuid": "1bf653e1-2699-4412-9f1a-6e9f600d6f81", "value": "22101b09b25f37226d51fdc3f87abcff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320309, "uuid": "b1b861d8-72a7-4e5e-9931-6fe8751e282a", "value": "3072:4FpU98BC9BsPsjx7PHkXSUGO/n2czGnQH6JhiliiPy:+pU96CXsPsjx7mS0cnQHW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696320309, "uuid": "3a2b5dfc-0856-4930-a108-197f26abe6e5", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696320309, "uuid": "5647c451-fd31-4f8d-8932-97cd6db3cf7c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320309, "uuid": "34f84c3c-34c8-46b0-8b05-941da42ba94d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b290d5df-61f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696340120, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340120, "uuid": "9ff4e518-7868-4c64-9e63-2bf8e735bacd", "comment": "Malware payload (Mirai)", "value": "8bc15b9a7558a3d9f59306b49048fb3f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340120, "uuid": "5ca2fae1-e836-4def-a351-273b24ab6212", "comment": "Malware payload (Mirai)", "value": "645d1b07ce44b692a5db644af9efbdaf277dddf8b3e7884f07fbb210053eae5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340120, "uuid": "ad3bd81d-d90e-490d-83d7-3e4aac21873c", "comment": "Malware payload (Mirai)", "value": "b5aee16a4f62ced70b513bbc0b6b2737310b0c69", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340120, "uuid": "efa824b2-de9d-4d40-a2a2-333fef56df47", "comment": "Malware payload (Mirai)", "value": "ecc64a45f1d5de4201875ac990dc51b675f2f703365b9df6ab3f652ed15b1be3abc80d3d8a7a3771243ab34fffc9b8da", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340120, "uuid": "8b6bc25a-63ee-47f7-bbfd-92269546db36", "value": "T1F492D17B97F18AA5C6B251B61292736478A6D3802655C6EAF5B473E20110233E8CEE1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340120, "uuid": "d62de0a6-7fd5-48a1-b61f-e592670d766b", "value": "384:7OJP4A63wHt7zMJxAYXx7V42a0swJaiDlD:7OSranyACtVf1swJait", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340120, "uuid": "46a3ec8a-ad68-45c1-a921-8a7fafc3f2ea", "value": 20328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340120, "uuid": "7cc25f7d-8fbd-41bc-a623-19942e77f91c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340120, "uuid": "0f9b505a-a85b-4097-9e3f-6fe009dcff0a", "value": "SecuriteInfo.com.Linux.Siggen.9999.1558.88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "505edf14-61de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696331795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331795, "uuid": "edef73a7-8655-4525-a241-fc8c43472601", "comment": "Malware payload (AgentTesla)", "value": "f1785da3dad811e0db801c060ddba932", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331795, "uuid": "f4b3b2d1-857b-4e8d-82ff-5e3759e52197", "comment": "Malware payload (AgentTesla)", "value": "6490e5498bf6ca3c0b3cb40d581e019e8c4135fd8bc49580c30160f6b02450c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331795, "uuid": "5447f408-238e-4259-b4b0-b0f614acbfa7", "comment": "Malware payload (AgentTesla)", "value": "4799dadc29cad53b8b63323505909a8bd4664a99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331795, "uuid": "583429c0-4675-46ff-a0ca-c1177f2edce9", "comment": "Malware payload (AgentTesla)", "value": "b20f2da2bd0797d5541614743a2bb7abbe03b85dea00f9d2caa2c57a208a3b1eebf9bb0071a33a1a24ce57d959144c21", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331795, "uuid": "11a9a826-10be-4d99-be11-3f75f638817a", "value": "T1DC6438013F4E4653D19E6B779099154097B0C81AABCFEB4FAC0673F91867392FA0A787", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331795, "uuid": "85035382-f92f-4137-8d6b-4bb6da3f0fcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331795, "uuid": "dec099e0-5f3d-4fa3-b330-7e7c5c221f48", "value": "6144:SRgc2lOrSZPpLO+zZ67VskJZqLQFkPP5iU5+WOqzqH8JpmWV6/3gEQ7u+qdKQh5K:nY7VskJqQyPxiU5+WOqzqH8Jpy/33Q6g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331795, "uuid": "69a75bb3-b88f-4c07-8d8b-224f173617e2", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331795, "uuid": "71373ef7-5d61-499e-a266-7a69c37b0d1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331795, "uuid": "bd3e5819-250b-4f4b-afb7-72c2a02ea751", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "941dda95-6191-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696298837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696298837, "uuid": "f8fe3e54-c5a1-4d7f-9324-2d2cde6cae87", "comment": "Malware payload (RedLineStealer)", "value": "4b71e4742d6e98a8658957dff3737e06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696298837, "uuid": "4bbc03dd-e946-4f4e-ba87-c54fdc748623", "comment": "Malware payload (RedLineStealer)", "value": "64d209c2c8f82dc301e545086c159fd8a85dfbe6deb548f9bc492f3181b3d6a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696298837, "uuid": "cdeed2c9-adf3-4d11-87c3-b1d651ba9ab0", "comment": "Malware payload (RedLineStealer)", "value": "1d10e1bd53dd181459f9a61ea6bfa76e3baa6373", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696298837, "uuid": "197751cb-0eb6-43f5-acc8-aeb4653386f7", "comment": "Malware payload (RedLineStealer)", "value": "b5f1f3b8e67b31c1cd51f44f86999b865646b9ec4a13eb7849ea95f7a1e0b7a25ca2b06b0a91191f615fc726d2da3064", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696298837, "uuid": "56b66081-1f1d-487a-9af0-6384c9a02849", "value": "T104843B2768F25EB0D3ED51708A5CD2A1E0AAD97096331DFF12052B34BD24753A9D38BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696298837, "uuid": "e9a7cd28-dc8e-42c1-ae47-dd116e501f30", "value": "f206bf4934412e0139dfd76edfc7dab0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696298837, "uuid": "42021f76-1c80-4af0-b9d9-e0de6d7304a0", "value": "6144:5CSoZijwGP4v8mcucBUTWjDoQdHCNypKf9d/W8obwyIUY7YLNEIJdx:5CSoZTwmcucBfdHCcRbwyIUY7YLNEIHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696298837, "uuid": "0d5e12c6-6b74-4891-a80e-3e93521a2734", "value": 375296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696298837, "uuid": "4afc73c9-1ebd-42d8-8cf4-c9d404f07491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696298837, "uuid": "fbac0f1f-5fdc-4a5b-95ad-3d9cf21004d2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4cc65ad-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696356955, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356955, "uuid": "4a309c56-0370-4512-b9bd-12ee725f8e10", "comment": "Malware payload", "value": "e751bca658765dbb19e3462889198046", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356955, "uuid": "1624dc4e-d817-4d51-aca7-aba496df90c2", "comment": "Malware payload", "value": "6570c1b81338ab51776e821398c4761ddb7620c94d806d7932a496639efe0a39", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356955, "uuid": "fa7225eb-cdfc-42cb-a704-035cbeb88768", "comment": "Malware payload", "value": "d7baee4426430d6ac3c3a96c306e72be887239d7", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356955, "uuid": "13a85f8f-e5bf-469b-beb2-86ea34e50c86", "comment": "Malware payload", "value": "dfa5e6e86dee9ce70928beb85e47b6ef34177ddd9367924893ac198b9479efbd23c2b7aafb2f07665ebf60f5b0a5914a", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356955, "uuid": "0340f073-0398-4c93-b2e7-11f15e294768", "value": "T18CB4122AF1A1D92BCC029474CC91F0D7C375AC999E09E64F72C8B7AF0570AEAC157963", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356955, "uuid": "341b5a9e-47cf-4e9a-89e9-f53ec47f8f18", "value": "12288:8Ol0SFewOvqKjij4a3DjH6CFN9h6I58urBqSAE7w:V0SFewEezjaCFN9hI8Bl8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356955, "uuid": "352ec497-21bb-4805-8c0d-a9105aba2b81", "value": 515072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356955, "uuid": "9a392584-0c34-4f48-856f-8b86cadc4623", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356955, "uuid": "7372e55d-bb37-4a08-9fc8-bc57ff3e9454", "value": "Ord.For.N\ufffdGF2301820.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2428815a-61f2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696340311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340311, "uuid": "5c72c8fd-e9e9-404f-8aae-2890fd60395f", "comment": "Malware payload (AgentTesla)", "value": "6b927159982881a36520009cb8aa923d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340311, "uuid": "05fcc413-bb8e-4bf8-81f6-d353595f2073", "comment": "Malware payload (AgentTesla)", "value": "65c423ef88f86b07c5429ab4ebc8c89b7d6c39a032e8b7465f7b84bac91d3da9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340311, "uuid": "a69aa5fe-3936-49da-b690-4b5ab8e382d3", "comment": "Malware payload (AgentTesla)", "value": "806aaf5066dfc7b7d1261ff9b5155de23f45fb87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340311, "uuid": "2764f910-495f-4d5b-82f3-0a255e862f21", "comment": "Malware payload (AgentTesla)", "value": "ebb317a2bc18b2e20427d0a13966575b02fde9d1ee5fd46801ef0525f0324a4f14443a94dd19c89e25c717301a2bc324", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340311, "uuid": "c087403e-0c5c-4455-bc40-00148bbb6a90", "value": "T14A6418007F4E569BD09D17BB90822384A770D8916B8FEB4F984377F9187B301EA8A757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340311, "uuid": "9da463d2-8cb1-4bc9-90d2-6cb49cddc139", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340311, "uuid": "a3974c12-eb85-41a1-adab-3cd39458b144", "value": "6144:6Rgc2lOrSZPpLM3FZljVsiV3CNL+oP6+UJ+2TeFqtA4DaIt3kwObSC25C7H/c/d:EtjVsiQNKoy+UJ+2TeFqq4Da0YSC2efS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340311, "uuid": "a411a111-aca9-4c58-a850-a3f069cdfe02", "value": 328192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340311, "uuid": "ddf6481e-d3fd-444d-b8cb-37c1430b64cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340311, "uuid": "4575c925-7bf9-4ae2-8a84-e51bacb7af78", "value": "PRE ALERT NOTICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aff5fbf2-61b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696315634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315634, "uuid": "01613660-90ac-4045-8e72-ecdaa0998824", "comment": "Malware payload (AgentTesla)", "value": "607991fe610137de739ecac924bc8336", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315634, "uuid": "4a51d9eb-8894-4c20-9e97-982f28f364df", "comment": "Malware payload (AgentTesla)", "value": "662e508593a21882b6def763f941345fb7aafabfd87394176c66baf8ead79bde", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315634, "uuid": "ffc438ab-6757-4812-be87-478bbe3aeff3", "comment": "Malware payload (AgentTesla)", "value": "0006e5d3b590a156c04c3436c4665395431d6784", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315634, "uuid": "045046fa-8978-4dd5-b34e-f21f00cd9bbc", "comment": "Malware payload (AgentTesla)", "value": "6366490dca383695d6b658f37416a3af7f0798ccec0977f39aedb3aafd7b395a1905859fd609fa0568c8edf9458d3d2e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696315634, "uuid": "8b43990d-a731-4163-9c9b-31b361549f0a", "value": "T1EAD423A5B2357001068B1DB8C053821B63233AD732D6B66EF99F7358581DAC1AB737ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696315634, "uuid": "3f7f03a6-2f3f-44af-84c1-bf1add3ba551", "value": "12288:bhaVONVCwgFtY0pJZJ6596Bnaymxot/ACZNrWq4CCo/TkZERUy:bhgDtRJ6dx4IorVbLkZ4Uy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696315634, "uuid": "2a373366-04fd-4a91-889b-51a34df9c3fb", "value": 609395, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696315634, "uuid": "9baa797d-292c-47b1-b50a-a93b889aad47", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696315634, "uuid": "2bde56d9-f9d8-44be-9458-26d9bcd8f785", "value": "Swift Copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1437762e-6210-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696353169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353169, "uuid": "db0a0b9c-5ce5-4823-8abd-ecbfe2b87577", "comment": "Malware payload (AgentTesla)", "value": "e43fe9fdf49c838a15488a812e3ec014", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353169, "uuid": "23c50d84-a871-4491-86bc-00d94d9761d1", "comment": "Malware payload (AgentTesla)", "value": "664ff9845b735443417d7b32feb4ec87eb735f7166a3a53f888669a9be871be9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353169, "uuid": "1f05100a-6c8c-4aa5-b9fd-0bb914e54377", "comment": "Malware payload (AgentTesla)", "value": "8294c92f4ffce616c052ac3771b0e60a91a1996d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353169, "uuid": "20a9f610-4616-464f-83c9-45a33eb4dac2", "comment": "Malware payload (AgentTesla)", "value": "8b55a54c2645ebcac521e9fa06b5b6699bd0e33489a1458d951f0b37a80233edea5d7f3adefbd611c2aaf56551ef839d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353169, "uuid": "1a3aadb2-74e2-490d-80c1-e0a11c724275", "value": "T1239423551C53CBC8AA8B2B4C7147512D107843A296BCAFD2AA0B76F4C5B0BED26ED34C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353169, "uuid": "2c9a054a-73b8-4c60-a1f2-a8507a30cfa8", "value": "12288:hApOeDhT+AVPl9SL3ch0xufZnkJKZvoq1T08U97LhNWTE:+ptDhT+A1QMzh20wuFU93WTE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696353169, "uuid": "9b03632c-5cc1-4765-8585-ef595497f6fb", "value": 410956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696353169, "uuid": "3d09cb0d-cd9e-43f3-9184-549f1bef97fa", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353169, "uuid": "ddf781a5-f9af-4973-839a-cfab8d236c38", "value": "Wrong Payment Information.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9870c7-61c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696322954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322954, "uuid": "c332a366-a9a5-4ea9-bc9e-eed31b8f391f", "comment": "Malware payload (Mirai)", "value": "0d3608c4e5a95c773563b2a9a730ba71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322954, "uuid": "ff29cedf-1b63-43c5-af6c-8d6a28eef0e7", "comment": "Malware payload (Mirai)", "value": "66658df99938cd0cb71fd59ccf22230d38e1c94f460d778bc90ee195b1a93ca0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322954, "uuid": "26101e40-f96d-4cbf-a2ed-9a283e76a261", "comment": "Malware payload (Mirai)", "value": "3dec5bde9ea092a536d37cee5325f7a4751a185d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322954, "uuid": "f163f06d-bff6-4a83-964d-18f90d0016cb", "comment": "Malware payload (Mirai)", "value": "9b66e9dbd312cefec04fde8ffff9d41faca7c16269e562ad9b4963320d94d66b21a012d7f67dddd50d9de3d8e35786a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322954, "uuid": "3a37434d-f48e-46c8-bdec-f516e135dc74", "value": "T1AA735D24AD392E22C0D4A17B61FB8361F2F6230E25B4965E7C760F8FFF1464468562B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322954, "uuid": "b769d6d3-7514-4b1a-af12-984a3327a094", "value": "1536:pH6hhAQzX3jpSzQelAbcmklUGAvFmHR6UXqgsnm:h4zFTzbcXIvFQ8MRAm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322954, "uuid": "9fb1aaf4-afbf-411b-aab8-de10ad9917da", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322954, "uuid": "cdae1d1d-73c8-40d9-97b3-ad36cbeca67a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322954, "uuid": "2172a8c7-7f3d-4332-958b-512216514335", "value": "0d3608c4e5a95c773563b2a9a730ba71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7760d0b3-61c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696319405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319405, "uuid": "c2425de8-03c3-449f-bfc9-18005714dacd", "comment": "Malware payload (Mirai)", "value": "87f0ca8fa0ff1db8e90a3c9e9cd7a606", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319405, "uuid": "2c6138e9-002f-4012-a47f-3664e0604356", "comment": "Malware payload (Mirai)", "value": "66d06f0a8723357cdcc248502fd77f9d6fabeadd67f37b42d15f24ddf8dc47e0", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319405, "uuid": "8584e4b9-c15e-4a89-aec6-9e1b675de502", "comment": "Malware payload (Mirai)", "value": "543abea566ccdab540a4d06cb8a3cb2fbef1798f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319405, "uuid": "89a60a79-a9aa-493d-8261-44fd5456fbbd", "comment": "Malware payload (Mirai)", "value": "d5d5049aadbf6e2fc03b5a55fb717faa8e1d19c67e8c09d7afbf2e6b0c3c0bdd0239903e6ee1ae00f775089fedcff258", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319405, "uuid": "0bb34e92-bd4f-40e9-9216-81225c29057b", "value": "T19EC2E1F0789377DAFA21B136E2F18D53C7F9C89583889772E6758486262333D6E608D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319405, "uuid": "16a8f937-aceb-4cfd-97f1-661256b5e5a0", "value": "384:M+HlrP0j5NYP9mTIhxa8aR0apzk+mk81ZYEsP8Wz06HjAGWMj9W/4l46rppje9kR:eYP9mMhk8jN+rrLDLBXVpe9g4Tbx6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696319405, "uuid": "ba46c1d6-62a7-4cfa-a77c-9d4a9f212a42", "value": 28132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696319405, "uuid": "edbefea1-0973-4a4f-b49f-5481bb35d1e5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319405, "uuid": "1c5feed0-d947-42b8-9682-ee57d4a80781", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e650cfd-61c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696322799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322799, "uuid": "dc8d56be-e531-4f6f-bed1-40fb896d10d2", "comment": "Malware payload (IRATA)", "value": "ef98a185b442632e92794408386f8c1e", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322799, "uuid": "ca2a5af8-7b06-4633-8dd2-2de541548547", "comment": "Malware payload (IRATA)", "value": "675378259a72ba94b4379a206e1a782655ac553fd2cb083a8a34044c90258299", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322799, "uuid": "051aa357-e43c-48a1-bd8b-bafb6245ca15", "comment": "Malware payload (IRATA)", "value": "5aed3b3bf3ac05896e768df743e5909bceb84dac", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322799, "uuid": "1fdfa1ba-754e-4585-b740-03861388976c", "comment": "Malware payload (IRATA)", "value": "c5ef85db3e519c7905e6189098dc28418487bafe376e6ef992ca7f50d372e89ff732a8bf13ffa8eb39e24a63b270fbbc", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322799, "uuid": "f6002976-79df-4067-b501-eaca9efc345c", "value": "T1EAE5BECBF7A8592FC87750B289AE52B1665B4D028E839F436C44371C297B6D81F4DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322799, "uuid": "73869f0a-528f-4fca-b09c-5a817406db57", "value": "49152:uQBCb1RZV4srLznsEKoz6MLv2nkpXKkZNjU9aBn3ej9p+ugLCrgpWt5g:uHbjxvsEKoz6MLwktKyNU9al3wgLCrg7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322799, "uuid": "ac9d801e-10f7-4eb0-b407-d12aeac9a910", "value": 3051906, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322799, "uuid": "da018698-a415-4dcb-b2bb-91daf2ef2ab2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322799, "uuid": "66b6f8bc-e5c6-4a67-9ebc-3efd2b0ca748", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86d75972-61ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696338329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338329, "uuid": "dd6fb31e-0ce6-44de-89fd-bb9d875a860f", "comment": "Malware payload", "value": "77fba581a37fcf93e03466dd6b3d9a26", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338329, "uuid": "500c188a-cbbe-4eeb-ab61-4810a158dd75", "comment": "Malware payload", "value": "67cec62e6db4b4ec851a826ee8f59ed5051a9b71edff9b0aabddc2ecd0e3b264", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338329, "uuid": "2fc7f1b0-ced3-4156-baf9-737f9ce48960", "comment": "Malware payload", "value": "0458079683517c0e9a20fbf7b29156a1c8dbf379", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338329, "uuid": "8763333d-974f-423b-bafa-d01d85f3c12a", "comment": "Malware payload", "value": "5b79e16b9e73add86594124d59a5a5b0e88d10b04283c0bd7167d616e012f9730f9a6376767592ac93bf6b308712b507", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338329, "uuid": "dfbdce74-ae36-464e-a133-ba9a3e01e5b8", "value": "T1ECB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338329, "uuid": "bb4f2fed-2c76-46f0-96ba-9e25dd62ca73", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338329, "uuid": "64f02901-0c2e-4f0b-9166-84f644923648", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338329, "uuid": "c5d28861-e76f-4342-9e40-78af54f48d4f", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338329, "uuid": "6f40707d-a1d3-48cf-a70a-a9068bfdf36d", "value": "AppleApp(12).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bf3a4f0-61ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696338310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338310, "uuid": "8e14b47d-b4e3-4a88-a0e6-19a1e4f810bf", "comment": "Malware payload", "value": "58c290ec89d1b44e98302228b14ffd38", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338310, "uuid": "a021bff4-1d63-491e-a4d8-7081ccb8a88f", "comment": "Malware payload", "value": "6932f1f72790d71dbc461cff3c6fedef8c137a6ec1d808ad25dd2eefe53d9dd7", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338310, "uuid": "2f01dd7c-d01e-4b80-9c22-8d6dbff70b64", "comment": "Malware payload", "value": "7a31337764486f7513b2378be0154253cef3b47f", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338310, "uuid": "0ac46a82-4d03-4880-8539-b7a3c2efcd92", "comment": "Malware payload", "value": "64a82c57ec8010d59464f774c949363dcde84ef14c4fc78ce301988a47ec7b65ea6d4ff9fb2f608c3c8a520a32b3fe0b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338310, "uuid": "3aea5ec6-1d7d-4c59-8be5-303b9b036cae", "value": "T163B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338310, "uuid": "7afd81c4-6b48-4a69-ba24-04847a1faec8", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338310, "uuid": "aa124133-53a1-412c-997c-b093c5bd6be2", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338310, "uuid": "34842e0e-a61f-4576-a3ea-1c5b99216492", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338310, "uuid": "6b0c9260-90eb-464d-81ed-9274370e91b6", "value": "AppleApp(56).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4be8159a-61d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696328781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328781, "uuid": "6726cf69-89c6-4461-aae3-18676af81879", "comment": "Malware payload (Gozi)", "value": "d8fb6e2fc8efc75796dd2d9afb40fca3", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328781, "uuid": "e840be8b-ce54-433f-b9c7-54eca23e203b", "comment": "Malware payload (Gozi)", "value": "6a33b9576d33c195a7b09f9416e5360098f5064ff9ead9a476598cffe1fc1c09", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328781, "uuid": "8ec882a9-ed98-4895-ae7e-863f503720d2", "comment": "Malware payload (Gozi)", "value": "0fe99824a62ded8d8c28b3af6673411eebaeed9f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328781, "uuid": "89d71260-735d-4e8b-aa49-ac6eeae83981", "comment": "Malware payload (Gozi)", "value": "4c42a0652e20688c2528ef0992273df19250c1ed321bdbb4ac774498be8b920557302264f4894f3a47af227bedf150a1", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328781, "uuid": "b79f4d3e-5f75-4b06-9aea-1ebc598e3d69", "value": "T16E14AE0CB3D29832E66F05370030A7F56A3DF5700BB19AAF5B94D1A64E244D3563EBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328781, "uuid": "6eedd7e8-5dff-4687-bd3d-2db0237a5df4", "value": "b708bc91029a5428d40eddd35d2240ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328781, "uuid": "186fdced-e89a-4aa1-9868-cdf4b8ad1f09", "value": "3072:SHl8sl3SL91KRqK0Sz3yTBKw0z88wMsRZAwfzYs5Hb7T3aW/ZulhCEX8zp:288M91IqwumUOwfzYsBZc1X8zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328781, "uuid": "3dbf9727-a42b-4f1c-a932-1c2c1a940fa5", "value": 199680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328781, "uuid": "97e9a0ff-0e5d-49fd-8afb-0ab0fce2db18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328781, "uuid": "245ba019-a0ed-45e0-9d8a-7d156e54d2bd", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a038b8-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696343269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343269, "uuid": "8a7dd808-3ca8-432b-a2f3-909beb1bb1ba", "comment": "Malware payload (RedLineStealer)", "value": "be8258b2750145ffcec24681d506d1e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343269, "uuid": "7bdca028-6b56-4acd-beb8-4411ae64211e", "comment": "Malware payload (RedLineStealer)", "value": "6a5acd40cfa74bba26a6fbedd82499bc5b1eac27a7deeba5775d36379d108862", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343269, "uuid": "8d922fb2-71ba-49da-8586-9404038b2875", "comment": "Malware payload (RedLineStealer)", "value": "4abfde19c1ce63c57ac596b85d80ffc58ff16c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343269, "uuid": "9947af29-200b-4f3a-a6be-a1dfa8a6c74b", "comment": "Malware payload (RedLineStealer)", "value": "34779a86776f8318aa3cb590a61c5e5cc1820bc013baf9acb6722410a79690ddaaec53e08b42927bdfe993c9154fc88c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343269, "uuid": "849199e2-7d47-4b72-80ff-4e0ce8dc7dd5", "value": "T13F75C80166F90B59F6F74FB86A7AA611087AFC69DFD1C6DF1164948E0820BD0B870B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343269, "uuid": "3b05d849-6e2f-4b76-984f-568f455497d1", "value": "0019c5cc9dc02122ed11385f5bfdf094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343269, "uuid": "37dc41a3-6f5d-43e8-b990-ad6dafd28dff", "value": "12288:JruH7lpvsJws5ZcmuLVc9X6a9Dhvh/DGH0q1K/fbk4pdNy8T0NiXbhbj:JrGldsJwh46a9DhvhPZFT0krh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343269, "uuid": "c675f566-f790-4969-a951-1d5cbe989bc3", "value": 1609728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343269, "uuid": "1ed268a8-788c-487c-b22e-9f657006c066", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343269, "uuid": "641abbd2-511c-425b-80d6-23c99576b5e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dabb31a8-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696313988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313988, "uuid": "7e3d9997-eb54-4147-a84e-b99d862eae5b", "comment": "Malware payload (Gozi)", "value": "a79e4eb10421a51f959dbfab392085fa", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313988, "uuid": "c96f3cd9-15c4-44fe-9388-e968278a1055", "comment": "Malware payload (Gozi)", "value": "6ac7ce03310cde657eec90facfa67bc6c878a413c462858fc671c1e8acc670f3", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313988, "uuid": "2c52bab5-69ba-44ed-9efb-7c58a5b42419", "comment": "Malware payload (Gozi)", "value": "315a5353b418a066ea5c6c44faf25eac55c81be6", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313988, "uuid": "76987103-894c-438b-be9d-3c404ca974df", "comment": "Malware payload (Gozi)", "value": "1dc1f5145d63cb4397176ddb227a55342af09c80c8ebf5446958863a098c6bcc388cca4dcc81cbfd49db131be530ad73", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313988, "uuid": "8d2cd7cd-dd86-4b86-a52f-7714655bc13c", "value": "T16134AE1EB7E29C22E9FF193704269FF64A3DE8258F71981F6354D7740E2A293123C825", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313988, "uuid": "159686e7-939e-4635-a53e-b37007e721b3", "value": "b708bc91029a5428d40eddd35d2240ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313988, "uuid": "ce6d7340-3eb2-4c40-bf6d-fad0d5b56e33", "value": "3072:JtFok3nTwth5eKvu+95JG3D9TcUonLpq1/xE02WKteBczMCLVIr4upCe7CelPg9:3FjnEtHe8ubzbWdOGWKtNVmX/Zg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313988, "uuid": "f2de26b2-5cd9-4a61-9746-5607a6b0187b", "value": 236032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313988, "uuid": "6d7f9c2a-abd8-49f0-bb4f-3c2cafcecdb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313988, "uuid": "c5dd344a-1c27-4cf3-a39b-a71c5b5efc55", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3e8be8-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696374333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374333, "uuid": "9f352762-e105-489e-baec-5e8a8a84a68a", "comment": "Malware payload", "value": "a84ab08e8d430010afb7af8ed63879d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374333, "uuid": "b5dae4e8-a16a-4708-a48b-d2a086318367", "comment": "Malware payload", "value": "6ad243126bd9f2ba49d1a8384009f03edfedffcde6d5d21b44e7744949d0e8d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374333, "uuid": "953cc4e8-0583-4f8b-9035-25e64e101e07", "comment": "Malware payload", "value": "d29d5665159d6cd39b2773d68fbb785e90d14511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374333, "uuid": "fc9be558-18bd-4ac8-b138-7a948faf02ab", "comment": "Malware payload", "value": "d20308dd62a48e6d4a1b2935eceb3cbab42fc846dc440415235aec9410908bb6e82c419af951d682d35c11ec5db8304d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374333, "uuid": "d2dc42ad-bc34-4848-8bd7-63f77927e785", "value": "T1FE338D76D8699DD4C90842B4A92ACE792753E514C3923FFA9B5DC6228003EACF64D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374333, "uuid": "63637a07-9914-4f7a-8468-1fafa33c8f72", "value": "768:oaYwt2nnmFGqyUsRJ9MxY8SL4a/RfUJo1iCsg52AovSXCV4:oaYwt2JnTXGY8+6Jo1ik52v6XCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374333, "uuid": "2de81e22-0b87-4d45-adbb-a371328ff036", "value": 51832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374333, "uuid": "2a28d140-42a9-4120-9a04-fde73171884f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374333, "uuid": "d406feb0-4f86-4cd8-9066-0914d8ca96c2", "value": "a84ab08e8d430010afb7af8ed63879d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "083b9048-61e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334680, "uuid": "a8a55b82-2abd-42e2-b130-4f28f8dcb88a", "comment": "Malware payload (Mirai)", "value": "ac5791cac0923c6994ad4cabb6bdaa97", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334680, "uuid": "7b9c41ec-da27-43cf-b4c2-23a9ecbb05c3", "comment": "Malware payload (Mirai)", "value": "6b4519482d925f822183fe71d9069eeb5c0a5278f1828dd4cecf4774ae0e19f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334680, "uuid": "168a0367-016d-4526-8f88-84dadfdf3a46", "comment": "Malware payload (Mirai)", "value": "f71ba6c1b6d439467f9c1a03ec566061c4787093", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334680, "uuid": "1b903c77-c8f6-42a0-bb20-1704b0496728", "comment": "Malware payload (Mirai)", "value": "e4adefd6538233300b80487831143c2f14533f1bdd2613006c3f91469ff395200e9f45bef176bdc0bcb8b039ccfc601e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334680, "uuid": "47295f1e-8dfe-4d52-9af1-258ef5bb2127", "value": "T1AFB2D1648B905703C2B0B435A3788F825E3B15E4D2F639262B21D3FC965146633FC5C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334680, "uuid": "3b3df607-bd71-48d9-b9ab-8eadf87ac4c9", "value": "384:4C9KXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BK1xXsebhymdGUop5hu73:4C9KQFH0rs3zWoDDRsjt7LB9U+BGxXs4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334680, "uuid": "7b0272eb-d3f7-42ba-b03b-e44b8c96b80c", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334680, "uuid": "aeeb8b9c-c1a7-4bb9-b753-16fd8d92ff74", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334680, "uuid": "6e23be4b-4e42-4d00-9a90-3708f137982c", "value": "ac5791cac0923c6994ad4cabb6bdaa97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd3c24c-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696336626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336626, "uuid": "64e2f6b9-cf7d-4581-9c1e-aa655dc3a9fd", "comment": "Malware payload", "value": "257f7cd06065aa5853805bce6ab583a8", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336626, "uuid": "901faa5a-5416-433b-88e7-b49e65b7bac9", "comment": "Malware payload", "value": "6c8532b6b1a5f08ef08af2f8b441dfab899aba7064c288ff57e9938f68f6ba2b", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336626, "uuid": "9744c15b-31b4-4aa2-a665-11421718001f", "comment": "Malware payload", "value": "a7312cef5ecc2cb05a298698627ac944f6c67179", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336626, "uuid": "efe3a619-43d6-4092-ae34-820f52af2610", "comment": "Malware payload", "value": "3c0f884bafbdade6bb54fbca481af184c52bea46bf9fb40ff55232c1f3642ee0f7a8929e8f2549147221cb477520eeae", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336626, "uuid": "b48b5c68-5b93-4e37-8b94-ab32b630c115", "value": "T185B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336626, "uuid": "6d91fe54-7891-4e98-8dc4-b9b7f9f2261a", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336626, "uuid": "a2e87089-e00f-4be9-9571-8dfc30f2632a", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336626, "uuid": "6b078e09-3306-4579-a05a-e67fe48be327", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336626, "uuid": "2c3548c3-b219-4155-ba07-5a38bd157253", "value": "AppleApp(98).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b774f4-61c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696319156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319156, "uuid": "749c012c-5aff-430f-a833-e3f895ce10dd", "comment": "Malware payload (CoinMiner)", "value": "6957a5f3d470c118331c9782ba0f7e25", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319156, "uuid": "636a258b-a68c-4131-b92a-26fd888934ef", "comment": "Malware payload (CoinMiner)", "value": "6caf5622f61890f6a0e50dba5d080f23b76e80ecb0265884310fec0fb8f0e9f6", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319156, "uuid": "79c1007c-924f-49e8-b47d-7efd6bf37b94", "comment": "Malware payload (CoinMiner)", "value": "b7bfb58c14356659b5921667855878cdce8f9704", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319156, "uuid": "baca11a3-60f0-4df5-8670-e242982ed5c1", "comment": "Malware payload (CoinMiner)", "value": "2aa9b2dd7472f14434594b91db986410a4006285b49b3da04d52e8d7bcef44a317426113098b095b1528a20ca5ca869d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319156, "uuid": "7f1c1925-55c2-4c6e-86a1-d8cd1d4874ff", "value": "T1E254AE1373E2AC21E4761A319D39C2A43B2EFCA19E6957DB73583F2B58701E19672703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319156, "uuid": "1ca63457-dfda-467a-8f51-16098b749af6", "value": "22101b09b25f37226d51fdc3f87abcff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319156, "uuid": "eb39ec8b-5842-4d74-9b88-f9c6d1a2c5f1", "value": "3072:uFdUUuBC9ByFs7APAk39ttWZys1LuYtRHohiTy:8dUUoCXyFs7MwYstuMHG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696319156, "uuid": "c7c3f723-0aeb-48c5-b7cc-f99b95264975", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696319156, "uuid": "8b4481a1-e879-43de-b194-d7781d3e808b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319156, "uuid": "b2c54fba-82a0-4fe9-81e0-11cee511c99d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e57dd1b0-621e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696359533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359533, "uuid": "802c4623-b84d-41dc-a2a1-50346e546b48", "comment": "Malware payload", "value": "dc65ca757e5da28bc723c56c6232dae0", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359533, "uuid": "2ec8f68a-f2e4-42bf-b140-9ee66b98dd15", "comment": "Malware payload", "value": "6cbd5be8bd2a00eab497e6752fcfc6829ddfdf8c8770330a0233a396887187b8", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359533, "uuid": "891f1577-e9a0-4728-b838-e198362fc0f5", "comment": "Malware payload", "value": "b358f384a83192e42d50294f7652fc707c23504d", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359533, "uuid": "bd7f19b5-9659-4f96-a6e7-feef49891900", "comment": "Malware payload", "value": "cf2191d2003a88458b099c56fa02c42d0462ba1deb097cbf6de0fab6360f62b785b3cdc27a6dfe071cf5c848851ebcf0", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359533, "uuid": "45afe77d-7210-488a-a93c-6b20b0fcf618", "value": "T1288456801941B58767D26741D3AFFEC096A1029E6B2836785FF4212333B5677F82B8ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359533, "uuid": "b4075bb6-f567-4297-9f7a-4968b731cefa", "value": "3072:9r+Wr+Wr+Wr+Wr+Wr+Wr+Wr+Wr+Wr+Wr+Wr+aAAAAAAAAAAAOAAAAAAAAAAAy:gTTTTTTTTTTTe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696359533, "uuid": "554d0e2d-d8fa-4c6d-b97f-d7fd1fe8581c", "value": 391759, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696359533, "uuid": "c85b40d4-8a66-462a-a18c-218d373bba82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359533, "uuid": "a1b5b811-8c2e-4fec-8beb-1867a488b63d", "value": "tt.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8deae95-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696356988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356988, "uuid": "e2e5d30f-a261-442c-8bdc-c325b6b64a39", "comment": "Malware payload (AgentTesla)", "value": "826ff38ec54dc344e3d75ce5f5c916c1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356988, "uuid": "a188a878-c446-4949-adb7-d9437bbef9e5", "comment": "Malware payload (AgentTesla)", "value": "6d8070624c9a9acdd20093644d4baa5481bb5a3e9ccc113e6a140bd721808585", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356988, "uuid": "c1b3d46a-1c14-4084-8cc4-1ecbc86d8d51", "comment": "Malware payload (AgentTesla)", "value": "86f8167060920fff05a335d8c2cd9171d50d84b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356988, "uuid": "3696bf92-5e5f-4b42-94c6-f373b6ca8fef", "comment": "Malware payload (AgentTesla)", "value": "eca62c3f23be94a419d620fe9d9364aa51bdd77e7acef04b88e74096c0979ecf0f385bd82de3d21070e2c6d34a5ea5af", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356988, "uuid": "3b0952db-b317-4ba7-949f-66519c405ab5", "value": "T1E1D412C636791B7AE0399FFF46B0642437B2A91E2E20D24D4CC023DF6A91B171656F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356988, "uuid": "54ac0bf2-22b9-45e8-82d9-3006c725185a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356988, "uuid": "f4906679-42ef-4d53-bd9d-e0cde1635bdc", "value": "12288:2QiiSAx5PWPQPGHhFnY2kcfk1ROJL/gnSAU7KmpwdWYMG:2Qi7Ax5uP/BFQ9OJYLU7DpzYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356988, "uuid": "0e09cd01-7036-45a6-bc4d-e2dfdc1a5c56", "value": 619008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356988, "uuid": "7e3a1435-dea8-4d80-b5b5-ab41b36f6cc5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356988, "uuid": "5751f576-1ad0-4e01-88f8-53231672f71e", "value": "DHL_AWB_907853880911.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5736d291-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374327, "uuid": "4238abce-a271-4ec1-827f-6d291de1c6d0", "comment": "Malware payload (Mirai)", "value": "f1ad3bcfd760a5a0845de99c7ac64554", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374327, "uuid": "21485a28-1791-4b38-9368-518c7a6f1b60", "comment": "Malware payload (Mirai)", "value": "6d9d1157f1602154026c6459a4cd8dd182cdaf28c53a98842bd6cb0f2cbec7e5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374327, "uuid": "9ab8a427-be2c-4b32-bcd8-c31da857abc8", "comment": "Malware payload (Mirai)", "value": "6df718e6587964087b4a769c00be4d1e05ba45ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374327, "uuid": "c912ea06-4719-4e47-804e-cc79380fc83a", "comment": "Malware payload (Mirai)", "value": "be02343624a302077ea669af56693aab1f215fb43ae988db7c3b162ec328df74fef3be0d003b01ba2f66bfe26fc1107c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374327, "uuid": "aa00b9ed-b7f2-492e-9407-8a9744edb396", "value": "T159D33B46FA808B13C4D5177ABAEF41453323AB64E3DB73069918AFB43F8669F0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374327, "uuid": "e8cd3196-47b5-4662-9124-9d1ab14ec956", "value": "3072:ZzEUrTLDJhINxOYJQdGi2xNRixvMO7aJsM/9aD:ZEUrXDJwD6dGi2xNgx37aCM/9aD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374327, "uuid": "456089b7-6ace-4f60-a4e1-a48a078c4617", "value": 131250, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374327, "uuid": "ae197341-f484-446f-8b19-3177ae8981a4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374327, "uuid": "90bba067-50b1-46f2-93f7-20b5671ae312", "value": "f1ad3bcfd760a5a0845de99c7ac64554", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa3b9cd-6229-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696364105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364105, "uuid": "548ca332-b3e3-4282-a28a-f458b071eef5", "comment": "Malware payload (Stealc)", "value": "2cd2fe9cdc8d0007e549863d15c70385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364105, "uuid": "61768fbd-47f0-4aec-a4f2-3305dc6c3fb2", "comment": "Malware payload (Stealc)", "value": "6e75be092dacc4f00da72baf4ea2d7fcc84220ec04f213e0b14eed89004f4ae0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364105, "uuid": "2146fdd1-f1dd-4a9b-986e-1c13a82d83fd", "comment": "Malware payload (Stealc)", "value": "c9a07c6904d4bdd5b41a02dfcf9465a69df9fbb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364105, "uuid": "d6d4a54c-49ef-423d-adf7-745b19ea121a", "comment": "Malware payload (Stealc)", "value": "010042f0f4ec38008799a1e82faa937d035df2c626249e974be025a1b49521c06ba39ed06a52641d1d3f0ec39790c5ed", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364105, "uuid": "5ab4faff-43ee-4d1b-8340-574d98c980db", "value": "T1EA84B012A390F821D5725A318E3AC7A57B2EFC918E6957DB33583F3B19702E1D662703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364105, "uuid": "d0d030a6-8693-441d-8ae0-d01ae32be03a", "value": "775c7d434cffd499e537a34db4132a29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364105, "uuid": "e83dce2d-df7d-4ebf-ad1a-1af5573526f8", "value": "6144:oF2FIvTpXb975SmaZyydUd2o95J9K8G/mV7QthCa+E:oFMElX575SmdooTJWmqjCa+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696364105, "uuid": "64f1253f-94ff-4c1a-a9db-3217137b1f05", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696364105, "uuid": "b935078e-c4bf-40b7-bed2-df630e2919f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364105, "uuid": "5b965353-3ad1-47fc-b36e-ddccf314e623", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e4bcf8-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696341008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341008, "uuid": "663d506a-6299-4cf1-803d-dc1cf6ba1162", "comment": "Malware payload (GuLoader)", "value": "f7e8f57930c0d1fc31ebcfd9d1aef81b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341008, "uuid": "daaaf1e7-a86d-4daa-b88b-26fd1fc74f6c", "comment": "Malware payload (GuLoader)", "value": "6eeeb05646dc1c6db8f8fb818a3148548100334ec73108506e5434e5f18b8888", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341008, "uuid": "14444d0f-a10b-4f51-9172-399a6a413e50", "comment": "Malware payload (GuLoader)", "value": "0080df12b526a8ac89af085eeda23f6a290ef1d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341008, "uuid": "07222a36-8ba1-49b4-9723-f76d45f28cb1", "comment": "Malware payload (GuLoader)", "value": "280518e8dc4662efb99e5c4d220e82d3af9d73ace3e360035b75c838e43cc110bf22ec840e41e1cf787f8d94fac5daee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341008, "uuid": "917df04d-8cd5-4fcb-9b49-f4d3fd40451e", "value": "T1BC1523A462F0D99BC67B117495EB471CDAF4ED22E096634BCF113D6CADB3B4192322C8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341008, "uuid": "ba414756-74e1-473a-a283-385d640c285d", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341008, "uuid": "242dc864-394a-46b6-bde5-1365a01612a7", "value": "24576:INPx3TpyRc/t1WG9XgdJpSz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTgRcLWfnSz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341008, "uuid": "39c70622-bd06-4829-b146-6257f47f818d", "value": 887750, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341008, "uuid": "414afb85-6d7c-4850-b0ed-c40c5d139b13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341008, "uuid": "01175b9e-5aab-45ed-9105-7d6e133b7774", "value": "Vikariere.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d1a233c-6231-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696367384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367384, "uuid": "ab3a2fcb-add5-4353-8e76-69f55869eec1", "comment": "Malware payload (AgentTesla)", "value": "49e57b251b2d34eac169761410937274", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367384, "uuid": "2f9fd80f-1d62-4c34-a5f1-b6a822d7626d", "comment": "Malware payload (AgentTesla)", "value": "6f7ca91ba97ef5763da989b082f5f48168ecd080d20867e90194759c5516f2c5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367384, "uuid": "f56d93f4-febd-487f-a6c0-bb0d7badcfd7", "comment": "Malware payload (AgentTesla)", "value": "d2e4cdee5edf7084271c4e0909ea881f8b6ba34e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367384, "uuid": "c10713e7-96e0-4433-9fc1-53bb3db039f1", "comment": "Malware payload (AgentTesla)", "value": "05a760fe88ca565c2c34661899b0c95786fec925996368342971140496493b35315c69cf8dfa23618f5539a4d72147a7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367384, "uuid": "a3eaa4f8-6445-4fe4-a95b-52b12ae7c982", "value": "T10BC4E3262DFB109D73A3ABA25FC8F8FF896AE573191E70F6214107468722D44CD52B36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367384, "uuid": "ab2cf01b-c2b3-42cf-a34e-678dc6f90083", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367384, "uuid": "8fed8f18-9202-428b-b9fa-77c584f26bb7", "value": "3072:rE2S5VE38gamKN7l+UGT5cu/S0COHqjuQdwqtDdo8c+XgiutF/sD28t6iNBIFT3:KI2l63COHqj584+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696367384, "uuid": "3d43716d-0736-402a-b091-94d0f86553c8", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696367384, "uuid": "283a15e8-83ab-4a1f-a627-7b835b2285bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367384, "uuid": "cea2236d-8d53-4a33-b68c-30cc6734c548", "value": "Wallpaper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69955fd4-61c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696320670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320670, "uuid": "30f83794-0c1e-4e91-9de6-cb044c7c16d1", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a4a8aa0a2d2c09721f7ed5a93282c4d3", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320670, "uuid": "9775ccb2-38bb-4dd3-8943-0591199889c4", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "707ef55097fb40cd4d05beabeca971364f9d964d03ed0683785ad1097e0b98e8", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320670, "uuid": "b6935fdd-9bcf-436f-abf2-b3683175f893", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "522af03211e0eb083435480ef2f96d4699e7c99b", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320670, "uuid": "56e57ebc-f6e8-410c-8017-b0d3ff485826", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "9291191cf8f0b2baf219d3577b1eae469c415a6f6304fdec1b55cb71d4d97e7e311eecd2603843979532c1fafe4d0efa", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320670, "uuid": "8adfaeb9-ce1c-49e3-9a94-9cd88958b2ac", "value": "T1F0152213EBE88563DAB5277099F703930A36BCB24D3403DF2785598F9971289987837B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320670, "uuid": "147135e8-70e6-4fb5-911b-6b8e9107d9cb", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320670, "uuid": "13f1f5d8-40d7-4933-8e1e-ba967c0c651b", "value": "12288:3MrZy90PGfTTRsiE7JQwjv3GiNnB1APRH7r8Vqe3Z7SLgYMuhX5qNAdnx:CynLTXopFnXW3y3Z2tqNAtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696320670, "uuid": "4eece363-aec8-4938-9fd3-b7f1a7ccb31f", "value": 898048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696320670, "uuid": "2a8fb13e-0280-4f1c-9814-f3d5e572511d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320670, "uuid": "411dfec0-c630-4d4a-8724-777487ad4105", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37fd61df-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696345927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345927, "uuid": "6f12130f-5af6-438d-bdad-d168123367ff", "comment": "Malware payload (Mirai)", "value": "e684a69dd5218809b85dd507aa5bd704", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345927, "uuid": "3fba8acc-ed88-4976-9a59-936219426ec5", "comment": "Malware payload (Mirai)", "value": "70c010cad39865ac05cb03556399bb291c0faac408a9a195cf2196e37c189e96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345927, "uuid": "601723a6-f1f4-41f6-b974-8c32809e878d", "comment": "Malware payload (Mirai)", "value": "b60a997241ebefa1456e640310e0c3b1a798c622", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345927, "uuid": "dda4f00c-22e4-4931-b2b8-92dc4f3ee5d8", "comment": "Malware payload (Mirai)", "value": "f4a5c316d4cab9886c3a9b3194060ec4a81001dd2964c3b5c70e474171e7aac91b5ad58e2a419d09bf26017414c39912", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345927, "uuid": "5b3eeca0-555f-408a-b979-2dbd8a8f67bf", "value": "T182539FA5C5ACAE58C71441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345927, "uuid": "3a62d861-b6f5-4706-81b3-aa754e49f772", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696345927, "uuid": "90d75c63-f1af-47cb-aa2a-3ccf8c78fbef", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696345927, "uuid": "296e51af-0df7-4c08-b30b-9b39b0ce8457", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345927, "uuid": "f1c134cd-15f5-4adf-8da4-d86c963716fe", "value": "e684a69dd5218809b85dd507aa5bd704", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e5fed71-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696336516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336516, "uuid": "87f7338f-8be0-490f-8c60-85e73d9de26e", "comment": "Malware payload (RedLineStealer)", "value": "772e9ba70aa089249f65539083c2260b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336516, "uuid": "7afaaad7-7ad4-4ee7-9bb8-9b2170ccbe0b", "comment": "Malware payload (RedLineStealer)", "value": "71e73af70babbb741fe9fca03a2d1b62c4ee75d8fd096ef35ce8a6bf8e22fc59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336516, "uuid": "ff2629be-3c71-477e-82b1-81dcf4bfc6d0", "comment": "Malware payload (RedLineStealer)", "value": "a861dc8a0bf9cfe80c90e2ee4555bfb39dbb2843", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336516, "uuid": "fd629157-3fc2-4346-b5cf-c4fab38cf410", "comment": "Malware payload (RedLineStealer)", "value": "2fdae709182f60b977bdf0affd15c8b6f78efd82ce6e6be820636b8e49be08c86cb0f06f56730e1a671c1da74910aacd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336516, "uuid": "403ca7ce-eed8-47f6-959e-319c6fb604e4", "value": "T18E652317FAE97A61FFBA27B0A8F909C31A757CA25C7CD2472B0409566D324C064B137B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336516, "uuid": "72b77e95-8500-428e-bc6d-a7a67301825b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336516, "uuid": "0e664dc5-6749-4817-85f5-fbb747a35231", "value": "24576:uyRawujAOSzphAcusk5VqfWVp3MWZ4hGYrUbs0r9ZfZGEkbPA:9R5j5zphAd1Vd8W6hGSUlZfQEkbP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336516, "uuid": "0858307f-54a0-4f13-a779-bd2381209c04", "value": 1496064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336516, "uuid": "5d8b9c58-1826-40f5-a0e3-70a536650eab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336516, "uuid": "84148e57-bf68-495d-a2e6-a69a1055c34b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01da83fa-6184-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696293008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696293008, "uuid": "ee78f326-73f3-4e87-9613-4d5ab2b6c2b5", "comment": "Malware payload (Smoke Loader)", "value": "f10d1b0dfee5fba7074c8bda75dc6999", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696293008, "uuid": "43fbbb60-ad6e-4eae-88f9-05d565e90f3b", "comment": "Malware payload (Smoke Loader)", "value": "7211f119a19a735056b60fd43deeebcb49354f3bf68b445938b301d61502c7e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696293008, "uuid": "6799b01d-5ac0-4a68-8c8e-acb0b46c9cd1", "comment": "Malware payload (Smoke Loader)", "value": "3f3679bc81bf0da1c74b074e0c12c43bc75270b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696293008, "uuid": "b5118b7e-bbc8-4f30-b326-f897333c787c", "comment": "Malware payload (Smoke Loader)", "value": "c9b8431a32408e0b4bc12232c96efe07bfc96a95940498bb777747f450b76595f0746ad1029c28c34976aa6420c20249", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696293008, "uuid": "fe67c210-280e-4ff7-961b-9150694094e0", "value": "T11D34D02275E0C033D6AB06B85471FA99BE7FB9225770C54F3B2816AE6F102D09B36353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696293008, "uuid": "f18428fd-3b0f-447d-8433-8d409dae0a56", "value": "a7960cb042304220b44306228fd698f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696293008, "uuid": "4e259143-532d-4886-94ac-a740c1dd58bd", "value": "3072:1PoWZyAT6fNA200jLF6vTNbFyN3wE79Z5k4F2n/Q:V45VAojZ6xW3wECS2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696293008, "uuid": "a50cb71b-49f5-4aca-93e8-f81999ef0989", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696293008, "uuid": "0c493a1e-9aa5-4297-a7ce-e924c29d03e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696293008, "uuid": "22c07be1-2635-46b6-a107-bfff3f36ce7e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15141e97-6220-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696360042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360042, "uuid": "60f4bde1-c3bc-4275-8863-797205048521", "comment": "Malware payload (AgentTesla)", "value": "78610b12f460bc002beb71104d51db3b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360042, "uuid": "c4cb2abd-c462-485c-90fe-81249aba37b0", "comment": "Malware payload (AgentTesla)", "value": "7266208dc8fb418f47fef760b7c35196336e8f2e3822108df59636d125d3568d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360042, "uuid": "42b1aced-16a2-4e2c-9d9c-7ddc0f3d038a", "comment": "Malware payload (AgentTesla)", "value": "80949a6602757626e07becc22b24d2b7856d5002", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360042, "uuid": "dbab22f6-0f97-434a-8b6d-9885f116c6aa", "comment": "Malware payload (AgentTesla)", "value": "516ff860f5145a8ef4c0d3152ab048f50aa6b5fe31505b2ee1223825d22fcb6ddcd82f1ae5be19af8b882de7d149b234", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360042, "uuid": "b9a24713-4432-4ba7-b055-834d41224ef3", "value": "T175D4230A33BA5FE0CA395BFA94B2084967B9661B1E10D38C6CC161FF5391762DF18B17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360042, "uuid": "ee75595c-cb62-4280-9af9-8c42c52b4b76", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360042, "uuid": "b444eb0a-eb06-4c80-9c12-714fe41995da", "value": "12288:GwiSAx5PWPQh6jOqatnSFk1NEA02+WlkyYGI65t58QdCJ48/y3lERC:Gw7Ax5uP46jOqKA2+WiGI6faQdCJ4uEi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696360042, "uuid": "1f02b8ac-a90a-4d86-bcfc-a9780003d845", "value": 621568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696360042, "uuid": "5c2521ef-7c0d-4d14-91b6-37e52abb0d94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360042, "uuid": "a274da42-f954-4f09-880f-329555199f43", "value": "78610b12f460bc002beb71104d51db3b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33911ab-6203-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696347825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347825, "uuid": "a2ee02f5-b51b-4646-b5ee-4657e5d1cd00", "comment": "Malware payload (Gozi)", "value": "de21fe50192a021dd37b67881fd332ba", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347825, "uuid": "22c6faf9-48e6-4d1a-a374-3c7d9edbe0b3", "comment": "Malware payload (Gozi)", "value": "729398faa8543e0a21d46b6881a4111d9c36c05e05f6efe669286f668ac97cab", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347825, "uuid": "1c5dd002-eb09-4845-b678-55dd4db689ac", "comment": "Malware payload (Gozi)", "value": "44c9c72bf5cd81a82ce7870dc765095f303c7fdf", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347825, "uuid": "4393ae3a-cbca-4e9c-8d98-a8c7994bfa05", "comment": "Malware payload (Gozi)", "value": "a51eabbce6f7a82dfa1e863d7c89f1421aac9fa966a9ec444f6a88817128badb7d51b68816313bdce1a2f8894e03dedf", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347825, "uuid": "9e482c09-c07d-4345-b5fe-7102e40c77e1", "value": "T132549F1373D0AC21D8665A319D39C2E53B2EFCA19E6957DB33583F2F58701E19A22B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347825, "uuid": "a7bf04ca-1f76-4798-ab3b-dd63529bc422", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347825, "uuid": "b402d0d1-67c4-49be-a026-e206bfcb644d", "value": "3072:F62X2mvtkAa8QoRzUA/nAUZSuJC/w3mA8FfbJ1fzodp/jhNGY:s2XXviAa8QontJF3b8NHfzodpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347825, "uuid": "1af2196b-0799-45cc-95a7-f9bc7107c1b3", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347825, "uuid": "8e3bc82c-ed5d-4f91-bc87-671e5b15545c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347825, "uuid": "8780a35a-4e60-4104-87a3-99325dd590b7", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380ad3fa-61bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696316722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316722, "uuid": "e26488d0-40c7-4667-9bc0-2c8e57145269", "comment": "Malware payload (Formbook)", "value": "d4ca2be4fd05ff8e64a606443144b0ee", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316722, "uuid": "5b075ace-7daa-4c28-a41f-6961be1146d7", "comment": "Malware payload (Formbook)", "value": "731884023aba6003836d2d19d064cb991b9e9cfe3c494fdb708ad30d32c4857b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316722, "uuid": "0f1a815a-660e-4272-ab5a-0610e91f1347", "comment": "Malware payload (Formbook)", "value": "99070557e40ee161ec1468ae147f601e1073994d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316722, "uuid": "0fdff79c-fcd8-4f1d-a52e-08aeb5597d9b", "comment": "Malware payload (Formbook)", "value": "94b619338b969a3cc4eb0b77c91be03e52f1685a7a8debf436ebb006ac150fe8679debdb623e32b31c9f303726478ad0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316722, "uuid": "9ba28939-7076-46e9-915d-5bea09268a07", "value": "T1DA7423A8B3D6CADBE5050A32BF7B3F6B8FD756610468DB1B0700964E78C58036826776", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316722, "uuid": "9978077e-9a36-4d89-adfa-cdc9d1e84593", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316722, "uuid": "947ef1b1-196d-4d2c-9a03-f6218bf73e80", "value": "6144:BnPdudwDsdEB9hw1R8pxWtNoYKGGzlBELCuwprGu+x6YxBCrmDcIPieyZApSvpaZ:BnPdwdAhwXhtNoYKGGhBELhwQX6DAKel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316722, "uuid": "b26beb5a-fdd8-4292-8897-394be308b77f", "value": 346350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316722, "uuid": "57cae924-d76c-417a-84e3-8799b0c4a81b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316722, "uuid": "8b01a995-4906-4b77-9f83-c965b5d280d4", "value": "ET2321000550.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b16a3f6e-6180-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291585, "uuid": "caa2325c-e0d9-4b02-8041-4afe2b7b3e35", "comment": "Malware payload (Mirai)", "value": "c29da23dc599c15fedab71b515d787dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291585, "uuid": "e3dd39f0-0311-4a4c-a848-dc735a6247e0", "comment": "Malware payload (Mirai)", "value": "7383efd10f473486650ff454bfd9353547bc83cce81975b38a75ef0e12747925", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291585, "uuid": "70dd21e8-d2fc-4334-92d0-55f721e3a424", "comment": "Malware payload (Mirai)", "value": "71e3c0541bff17fad0d0fbc41f1cd26e57862c41", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291585, "uuid": "c2d728c7-19af-4e4f-8a96-efff0c89fd61", "comment": "Malware payload (Mirai)", "value": "13d4c2f7c9a786316ea95ee546312547543b8ec6893e5ebd2afb1272be0066d5bf4aeb727ca0c7e3d77ee759c52ba4a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291585, "uuid": "83cd1724-7b1c-4aec-86f8-0eefacc77645", "value": "T107E2E17FEC28BCA9CCEC1CBD315872716D91B1E232ED4B49530708AE997944A745C678", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291585, "uuid": "81ea9d59-c5a6-4779-8921-83bc37431069", "value": "384:QnLn8G13IJ5c9ND915MpPzCiKCf3oQbcQ9UTPIf0raEui2Ll/2JP8XBz4mkZL3qE:+n8G1QSZ1g26oP/mEuiVcWreHKWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291585, "uuid": "4f579809-96b8-4641-9acd-cd929a20c3de", "value": 32732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291585, "uuid": "3ecd8620-a1eb-466e-bd3e-a0b7eeb18904", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291585, "uuid": "05ec6ee9-622e-4a13-875e-00d6170723dc", "value": "c29da23dc599c15fedab71b515d787dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb37adc-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696357132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357132, "uuid": "8a04585a-ca7e-4f42-b16d-9b3446316fb3", "comment": "Malware payload (GuLoader)", "value": "ff4325351f1f39959deebf867106d6d5", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357132, "uuid": "d31fcd9d-04c6-4180-a45e-1fc1f9cd6c62", "comment": "Malware payload (GuLoader)", "value": "73aea88dda8dfe0752d764a5635877bdf4d79faf5416798e378318846a976288", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357132, "uuid": "78729317-a797-440b-8c9b-7798108a3eeb", "comment": "Malware payload (GuLoader)", "value": "049c0efce8ec401693b87f734e00d9c118bce2b4", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357132, "uuid": "95523d1c-8405-479d-9c73-2dbac0a1451d", "comment": "Malware payload (GuLoader)", "value": "b375ac81d6e6c305e40450dd79d19ab94cec4a26807f876990d64787a596316f98a20e14ceb42972bf33f6da5cf324eb", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357132, "uuid": "1b842b94-b50d-4339-99e3-16a3399379e8", "value": "T10793D364EB051E150C3AB29EB4C718A5F5DB05FB063D742E6849A738DDC120C6AEF63E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357132, "uuid": "98716bfd-7b2c-4a98-b966-5ca9ee7a443e", "value": "1536:/C53toZGAbCm/L/eyZ0/tc4JGvWKgXjQlRSaVH+AG36AIGrvQG:K53OZGAHL/es0/tvJGeKAklRSPAjarYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357132, "uuid": "97d0f666-ed46-4ac9-9348-40a1d8c467ff", "value": 97629, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357132, "uuid": "fbf52545-92a6-4064-a7bb-3d9431f8befe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357132, "uuid": "5b9c0bac-9408-444e-932f-31c44a438611", "value": "Purchase Order 24567865.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff0d89e7-61e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696333806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333806, "uuid": "39605348-54af-4b0c-ae26-1080907913b1", "comment": "Malware payload (Mirai)", "value": "6d790fa3c010e39af2c876845449a3a5", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333806, "uuid": "12d51084-a3ca-4479-bcdd-0832805fb2f3", "comment": "Malware payload (Mirai)", "value": "73c2743d5e6332d4f22137cefeb0b7efe67a1b820f64df5c3c44d0f0af91462b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333806, "uuid": "ea0b0fd5-42c9-44cf-919e-5155970fa625", "comment": "Malware payload (Mirai)", "value": "a479d943f49556779dfd653d921a981c33eccc78", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333806, "uuid": "459c39fc-28c5-425e-a41c-241484bc9e82", "comment": "Malware payload (Mirai)", "value": "a6847c5a72a344d0be76a55ace9f7c29e0c19a9657d2bc35228406386d9f4edd824fb215c6d02daf39fd881736edcffc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333806, "uuid": "70efde8f-0a22-4f6e-908d-74129a55a76b", "value": "T19D33F1636B6D29E292B05737FC33AC1A669C17F99967309A28F0751977C18034FF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333806, "uuid": "afc66d01-4337-44fa-bdbb-bc0b92cff8a4", "value": "1536:d9O/ZMAXIxNUk0o+LcPqF1aBexo4opKZbm:d9O/ZNKydLGqFUFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696333806, "uuid": "82fa372f-d6f7-48da-86c5-67d9cf50feb9", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696333806, "uuid": "97829e2f-49d9-40ad-b1e0-52c19db78c7a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333806, "uuid": "27baa3cb-dafa-4df3-940f-64309874e30c", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f32f5cd-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346074, "uuid": "fb89d7f4-50c2-491f-a91e-c2860aac162e", "comment": "Malware payload", "value": "08bb11ea8b81675a0b2f5d1c533394a8", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346074, "uuid": "ff234cea-4e5c-41ce-b92a-5df79f7cc9eb", "comment": "Malware payload", "value": "7401d34d7bc93cf94e50cc5fc7c00cdc6f2e632063ea03f8f56df4af7bfa0c0b", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346074, "uuid": "d76953aa-ae82-4a12-8099-45e1f35c3a64", "comment": "Malware payload", "value": "c66932603d2955b99afccb50dba09cedb0212193", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346074, "uuid": "46165487-087c-4ba4-928a-aa17298a7922", "comment": "Malware payload", "value": "817524f774062fe8ac035e66ed3cbadd1d6309bb010728a18d32080c71d28386ff1d8bbfd527a5834057b2b9577a6416", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346074, "uuid": "92ed0858-3c7f-4fcd-a849-44dce27d3dd0", "value": "T1FBB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346074, "uuid": "c82c2956-e11f-4a69-b75e-ed450afef290", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346074, "uuid": "6af7af36-ad7f-481c-b452-e35521f9d5ea", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346074, "uuid": "1dd4b9fa-bad2-4f86-911f-49084bc9e66b", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346074, "uuid": "9f23cc20-08f3-4eb0-926d-ca36744dd2e4", "value": "AppleApp(197).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3707cead-61e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334329, "uuid": "4ec578b6-8e5c-42e4-835c-c5e395dea151", "comment": "Malware payload (Mirai)", "value": "3032fbcc3dd1f7d45c8cbe40db2edd85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334329, "uuid": "3c06ae23-be0a-4920-a3fd-c48246a7eaca", "comment": "Malware payload (Mirai)", "value": "746fb913472f1f26624e2c5666fe5483af770954125d1c200687d042beac7a33", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334329, "uuid": "76bd5b91-b6d2-4112-a0cc-1f1239c7c823", "comment": "Malware payload (Mirai)", "value": "10db7fca5cf556ea5c48929a32314dfad5eeddd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334329, "uuid": "4eb6d4d5-63ae-42f9-b56f-b7b75609242d", "comment": "Malware payload (Mirai)", "value": "d56e5b380f96ed1921928bfc5a565675b7994ab0a6131be35e6d455235b6736a09738ce1a8c5d622d45a9a7a7c513ef3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334329, "uuid": "0076214d-29ce-41db-9dd8-dc9a861aa7ef", "value": "T172E2F193D362A452CE782BB1F96985CB27BC4B5CD57730E31A1556183E9B0435F3C983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334329, "uuid": "db2475fc-633a-421e-bf27-f67cca6f65ac", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9X6W9q3UEL5Ib:Porm1vpALgUJ67Lo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334329, "uuid": "5a50cc32-d128-4ceb-954e-dea410e79d66", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334329, "uuid": "ab1c488f-105a-4f51-b245-fe2d6f06af04", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334329, "uuid": "4d96518b-e862-4bb2-a849-64c4e375d8d3", "value": "3032fbcc3dd1f7d45c8cbe40db2edd85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd35a18-620b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696351202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351202, "uuid": "863318bb-c789-47f8-a01a-4bf6446e1dfa", "comment": "Malware payload (AgentTesla)", "value": "ceb7360515aa7e471ab8d71d8db60ee4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351202, "uuid": "1c376d34-f265-4449-8424-703176667468", "comment": "Malware payload (AgentTesla)", "value": "747bda3ff9c92152209f373690f37337288a013504d676611041fe577877f898", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351202, "uuid": "f52c943d-0eea-4a2c-ab31-fc0570e79a41", "comment": "Malware payload (AgentTesla)", "value": "ebd58701a518b1144b3013b13a56249abc64a7db", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351202, "uuid": "47a21d37-6dc0-40be-a77e-734a76b08c48", "comment": "Malware payload (AgentTesla)", "value": "6117ca06a871100474d5647c2c95952804cd43daadc4327b2a23a73b9e490a3f6efc7443095996c294d8b6fbe802375a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696351202, "uuid": "9d19048b-df97-44ac-ba82-6c6d27e2b14a", "value": "T1CEA49D6531EB1E87F03AE7F247A82845C7EAF2F26F1BF6197DC107468422DC0DA52625", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696351202, "uuid": "bac38277-1265-4a91-be41-d86c969aee6c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696351202, "uuid": "e104e655-8728-473f-89df-521035b66402", "value": "6144:boVSWGOhF5wIohI84eGaSQy9C54yyi3uV9WvRXf7tgX/uPNLrDb2m/yzCSll9kHn:cUOhF5YvxSQy9j6uVU9OUrDF/yuH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696351202, "uuid": "b942de9d-15ac-4b91-8749-7d59bc29fc65", "value": 479232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696351202, "uuid": "5e5e9a56-3039-45c6-8798-dc810a40b2cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696351202, "uuid": "dbb4d072-1f2d-4283-aa86-c9d74075b9b0", "value": "SHIPPING DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5264cafc-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1696313330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313330, "uuid": "b7515593-c2a7-4315-a4ee-f8cefc6e7912", "comment": "Malware payload (SnakeKeylogger)", "value": "7bbadb55076fd343bed53fb839524c92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313330, "uuid": "01b7924a-1565-463b-a5fa-5fbb6b6a045f", "comment": "Malware payload (SnakeKeylogger)", "value": "74c687d2cbb8e93481530eba3ec627b5d9902901797e67fce58a949b8b50491c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313330, "uuid": "bc65d908-e21a-46b9-8c7d-b7729982e6e1", "comment": "Malware payload (SnakeKeylogger)", "value": "4bb956cda4ca089cbfdc80f913fb7a2cc5bcc45d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313330, "uuid": "2b17c44c-358f-41e5-81c5-dfca6d1765f4", "comment": "Malware payload (SnakeKeylogger)", "value": "70fb6fb4d521cf0848bfc2a5d50e52e6a0e0292f883a67d8b77c58a605931ee46d59a4aeaf11524d37e56b265fce732c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313330, "uuid": "d67d2df1-83da-4f0a-a80e-e767d6716c51", "value": "T1FAC4010132BD2B6AE6B5A3F82871151017F4BA6E2462F3486DC260EF9DB2F114F51F67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313330, "uuid": "4d7e3f12-a870-4185-bbeb-be33fefbd8ee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313330, "uuid": "86c074a3-f059-46ef-b9d0-46b1a2c398b8", "value": "12288:EneUsNumB0lMBIlD1WtyDROlTJNR0trAeuq28cZs9I11vg/5:sjyOD1Wt2ON5KLcZsyYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313330, "uuid": "a35ae519-8059-4a12-804c-e5f9f42aa2b6", "value": 561664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313330, "uuid": "d2cb5e58-a47c-4da6-b551-08fbd847fb27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313330, "uuid": "66560a79-ca1a-4803-a43b-16507f964f65", "value": "AEAT - Aviso de Notificaci\u00f3n (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7afec5a-61ab-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696310171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310171, "uuid": "f3388f01-636a-4647-a7a1-271f80f9efd3", "comment": "Malware payload (RedLineStealer)", "value": "40dd28a02c6e32002662c51df44c356a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310171, "uuid": "b274e0db-b244-4bcc-95ac-e62d4b5ef0c9", "comment": "Malware payload (RedLineStealer)", "value": "765de51b54a81acda1f893d4b6a0b4b308273451740175242bda4a4c7718eed5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310171, "uuid": "2fb4606f-3f11-4d0c-a7e8-fad7c60a5b16", "comment": "Malware payload (RedLineStealer)", "value": "fc80ec56bd5f39e7028169fb18c5b5b0252ece10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310171, "uuid": "cedd6f67-b4d9-4a5d-9acf-c6002ab93ec4", "comment": "Malware payload (RedLineStealer)", "value": "cf1a91ecc84b7ebb3ff832769e7cc8ab44356a28e01274866f7571e957734b58e29a3278c15e12c648c652878b488e23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310171, "uuid": "37d2f37f-7489-4cf3-8747-6c28f5edf799", "value": "T141152307FAE88035D8B56BB18CF707C70B25BDE11D74866E27619D0F0CA2680B876B67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310171, "uuid": "5eb6ae21-f79d-4f54-94d6-6ae541377a41", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310171, "uuid": "7ea58135-32fc-4e45-96b3-70b8ad3dc982", "value": "24576:UyvLIefZ2rdAn6JcOciadlBWfBFRlRdvvEvUekk:jz1ZMC62OvUl8fBFRzdv8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696310171, "uuid": "57cbd767-b623-4b53-bb95-b071c38c72fd", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696310171, "uuid": "426ad25c-7183-4a66-a57e-57a6fd6eb8c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310171, "uuid": "361a8f51-d6de-4c11-8c9c-0b038fc390dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebbaa407-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343652, "uuid": "44771c63-ebcf-4b54-9b18-331e996100f0", "comment": "Malware payload", "value": "2583ce7d9f4aa7844718eb87fd12100f", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343652, "uuid": "1865b6a5-4f26-4b31-a472-9231ae2c3e44", "comment": "Malware payload", "value": "7660aa523094f1b590453b9b8c469b3a852c9ec3a0bf14dc525324878f3596f1", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343652, "uuid": "314b8905-0b59-45d4-bf15-31405c30a8bc", "comment": "Malware payload", "value": "a514a374756aa3584848dc41f51e5fb5229cd352", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343652, "uuid": "ae8ec203-0e68-418f-bc5c-a71bd0e1f3d1", "comment": "Malware payload", "value": "3fbb494b089246e100d82e41e65c95deb5d905218c47ca41f3bee6eac5a34da2539b9bb11ea68fc19ca09d0e47f5b989", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343652, "uuid": "a429dbb4-3224-4eda-8b86-79649c2633e5", "value": "T1A2B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343652, "uuid": "0537050c-f7b9-456b-8571-7804b445dbdf", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343652, "uuid": "4e7500a0-d344-4a05-b19d-f4f589d8f188", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343652, "uuid": "26bed1f4-efdf-424d-b0e1-5aab75921eda", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343652, "uuid": "6ba0c747-ad8d-4827-8fc9-e5c85c803659", "value": "AppleApp(147).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766cab9a-61ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696338301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338301, "uuid": "a7fa8854-80a0-42e9-8c07-869b1a0b46a7", "comment": "Malware payload", "value": "50cc7ab1a39f5a6be18406cee720aab5", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338301, "uuid": "2ee81c84-76d8-468f-96a2-528d13717cb6", "comment": "Malware payload", "value": "7691db921f6b026646906e848df9a14d938e3bb23135ac707b924dee5805a1a4", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338301, "uuid": "d34bda36-a26e-4cb0-bd8e-5611b7f121dd", "comment": "Malware payload", "value": "a4682e1aacb10974c6df9ecfa2fa393eceda74b5", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338301, "uuid": "514ab033-dd2e-4f7c-bae8-41c66e34d031", "comment": "Malware payload", "value": "0cb70ee1e2a42f7a6808bab755b0ac12e99b3048d0c799f54849f98dcd435928a15463dd25898d1b9e049de7d58b2a4b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338301, "uuid": "645c9ad4-82f3-436a-86e3-1debcf7e1eb4", "value": "T17FB4237C993532C6DDB127B9AB5C90325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338301, "uuid": "35149a66-09dd-4336-9df7-5a1c19197f31", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338301, "uuid": "17e88ae6-0c55-4a60-993f-263197040d9c", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338301, "uuid": "b63c80e3-e16a-4ca2-a725-331b8b9c8887", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338301, "uuid": "9cdd9a53-3c93-4153-868d-188beeda78cd", "value": "AppleApp(17).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbcd154b-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696313614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313614, "uuid": "a834bc15-e079-4e48-b387-a547fec46c82", "comment": "Malware payload (AgentTesla)", "value": "ee946e93f18e575bcf3ff98e56bbe68a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313614, "uuid": "8df8f1e8-2e12-4783-859c-c925638c31f3", "comment": "Malware payload (AgentTesla)", "value": "77e5c0683c26d723d3b77057d3d871de78ac53791b9e0645c6cebe6382445367", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313614, "uuid": "9e2ab830-81fa-4457-ae6d-57b64c012861", "comment": "Malware payload (AgentTesla)", "value": "46311852176490aab500b4a6123d4bf3c3b8c7be", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313614, "uuid": "cc2b9a41-369c-4c54-a6d4-ab396b087a12", "comment": "Malware payload (AgentTesla)", "value": "dd60b2bf5f9c8bd90fb2cebee54389659929e794d1d3f81d690361c614ed4e667a08c2945cd28845e4a4171e74ec0dae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313614, "uuid": "53179cdb-e538-4d0e-ba98-2a65ea3d16ee", "value": "T1D11502375B47BC9B2FBE0F9030613D685E202E4381A1A5D8FBC44DD5B5E2A28DE5D8B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313614, "uuid": "7cd37280-2fdf-4a9c-9585-96fc6b5112b2", "value": "12288:+fzcnw77llR8xPUQ/trpUm+18+vuCkAtuYsJZRrcarBjqEiZRwyboFFMpY8wjJme:+fzc6Bb8xF/o1VqzjNeRjYMpYZdmYpj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313614, "uuid": "2b8183c1-e909-46d0-b98f-a7e8a1015bd0", "value": 941255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313614, "uuid": "a7480554-cc60-48cb-b337-c6f70cec2ec2", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313614, "uuid": "951575f2-5be3-4c68-9fa6-dbdf05f455e5", "value": "PO 2846DYK-NO #20485-2000PCS.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98d153fb-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696336641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336641, "uuid": "5db6a780-1145-4311-b644-010de4cab23b", "comment": "Malware payload", "value": "2ce624ac482568b6f758a63b25e2aaeb", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336641, "uuid": "5fd3ae0f-70d7-4ab1-b499-928346453699", "comment": "Malware payload", "value": "77f31cf6c33761eced9f2ddb4ff1045ba0402f5301df57a0748bce01581e62d1", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336641, "uuid": "fdc4ca73-fc95-4858-82ac-2d26d7bb893e", "comment": "Malware payload", "value": "0edf3f41e110f6f64823ce04cc631cbd9828f864", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336641, "uuid": "bb6e3b41-e92d-4028-ac8c-14cecd94487b", "comment": "Malware payload", "value": "26ad026a27e357c28c119cb66b9059c29d7e266a8f9ebca61c12b8ca09c5b99b823e074616ee8ddd837614eade44affb", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336641, "uuid": "9b971f9d-3305-442f-8310-d5615c7008bf", "value": "T16FB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336641, "uuid": "9ef45740-62c4-4c19-84bd-f60c03395f61", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336641, "uuid": "3f4c6d6c-97df-4241-96cb-87f715adb00f", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336641, "uuid": "9eba7404-ffc1-459f-a1bd-476cc452dce7", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336641, "uuid": "4dc901eb-f211-42d7-bdcf-234189e98703", "value": "AppleApp(72).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932555ae-61c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696319022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319022, "uuid": "1b778d96-60b2-41ac-98c5-9145ed0e1d99", "comment": "Malware payload", "value": "6cdc92be5a002c37b90536a91241126f", "object_relation": "md5", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319022, "uuid": "3fb7ad1a-aff1-4605-9f4c-b817468287fd", "comment": "Malware payload", "value": "785e71359928d2b4c50f96f1a0db5e36b37f1f68916a181dd8106f74bfa606b0", "object_relation": "sha256", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319022, "uuid": "f70d5f84-cc89-4d46-83da-5c94e53c7c8d", "comment": "Malware payload", "value": "e19e87fcc201998aca35c13e51ba7daffce8fc81", "object_relation": "sha1", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319022, "uuid": "dade4342-0a5a-4bb7-8a0c-5ebb2a976fbe", "comment": "Malware payload", "value": "4005c0f255a95541c8ae042c3ff57ed6152a1e2eb71d905eef27943af7e41e5801ace63c06bc1a02364af3fad11710ce", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "config", "colour": "#747DBB", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319022, "uuid": "b2b86e4d-9ce6-48be-be3c-31947965efb9", "value": "T16725335D9D6468B5CC87F705ACC9AEDFCB90241B9CB7C8247686FE322BB4205F584386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319022, "uuid": "1165e61f-6fa7-41b5-a931-9c4e558040c5", "value": "24576:J9xijMlR2EwuMKLxVkFenEBoI+iPBH//xtDRmYeCQmleq9qGXEWexuXQ9w:J9xij07wqtKenpIT1pBRRQq9jXEJYXaw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696319022, "uuid": "cc1e445e-dfdd-4458-8b67-cac83cf3d77b", "value": 1050632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696319022, "uuid": "9833f111-a410-4048-ab7a-0da57c4c29e2", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319022, "uuid": "9d611ea2-fb15-4019-ba42-0155d958c36e", "value": "Dzmkqskmp", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c4102c9-6216-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Phobos)", "timestamp": 1696355867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355867, "uuid": "2eca205d-0050-42a6-965b-ef377c40bef0", "comment": "Malware payload (Phobos)", "value": "9bb98f2989a73a1e3d8d490669462422", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355867, "uuid": "b39176c3-07d6-4b28-80e9-1ec60a301cbb", "comment": "Malware payload (Phobos)", "value": "790b64a5860a5069fedcb660efdffce2b5ab2195086100a6079697b662f0c198", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355867, "uuid": "4019f9aa-6784-47a3-baec-368b59af8da7", "comment": "Malware payload (Phobos)", "value": "480b65fe568acd420dacd4b935529f2505e94151", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355867, "uuid": "e95dd082-3f8f-4b31-bc8a-0da3a51a38b4", "comment": "Malware payload (Phobos)", "value": "3e5de27c9ac261bc9bc4c661a179c8f13141dbcc08bff714d41a9e0ee4182386682cdda908a301f25cf27be8d1bf09e8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Phobos", "colour": "#19849F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355867, "uuid": "52cf3c1e-b88b-48c0-a80c-561a8f329c7c", "value": "T1A9C4AE1827A85527C24F0E34D1F6554CEFB5CA378B4AEB9E5C807AB99C133C9D9834A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355867, "uuid": "6a1d320f-87cb-4eaf-97c5-32fed67e53d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355867, "uuid": "7f036669-87c0-47f2-bc4d-2d071fcf5de9", "value": "12288:MTQp8eHRevUGXTYJ0M8SbYrAwhLtaczsQc0TwmqyAAJtT:cc82RGFj80pwY5aczXTNqyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696355867, "uuid": "b5ae597f-dc01-42dc-b786-d26c17c0756e", "value": 584192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696355867, "uuid": "864affcf-2efa-49a3-ad49-33220c9269a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355867, "uuid": "566cf4dd-2ed5-4249-9877-22856f57ce11", "value": "9bb98f2989a73a1e3d8d490669462422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fea4b58-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (CoinMiner)", "timestamp": 1696346021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346021, "uuid": "f1df9521-f4dd-48b0-8d66-dae9cbe61b94", "comment": "Malware payload (CoinMiner)", "value": "c6f2d1c0bd4239f70b940cb763c337a3", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346021, "uuid": "09ad7fb3-6d68-4444-b826-d4fb4f8a7501", "comment": "Malware payload (CoinMiner)", "value": "790ef0e4d0ad3a6199ca163961dada0c9a9a78f22d43be0cc63cf0a507392c6c", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346021, "uuid": "2c155e08-33aa-4bde-9c91-cd1f9aab06be", "comment": "Malware payload (CoinMiner)", "value": "741d59f785a57a8227fcb145062aed8766929ec6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346021, "uuid": "d58c6ee4-79ef-40ff-8533-543ed83a0562", "comment": "Malware payload (CoinMiner)", "value": "99e58cd696f83b9ae7ce930511786f1c7a535517b83864d6ddb5f5f361a1e9e2c03c53bc98ebdf92eb1f8eb75c5ee60c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346021, "uuid": "883c580b-d70a-449e-8543-ca24081d2a00", "value": "T1EC549E1273E0EC61D4725A325D2AC1A53BAEFCA19E69579B33583F2F58702E1D632703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346021, "uuid": "439abc16-e0b7-48c9-8538-d5a154f21b1c", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346021, "uuid": "250e7859-6eb2-47cb-937b-cde2615c62df", "value": "3072:tRqDnRmvUhnayRuRGFxLvNnVCwZv9hoIXSN3auPqYN0Y:tYDn4v6nayRuexT1V5/buyS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346021, "uuid": "ecb7e832-07d2-4763-b20c-dbf0271d9379", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346021, "uuid": "41aa9957-57cb-4f47-a319-20cdca590ef8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346021, "uuid": "b4f60ce1-2a70-4ce6-8baf-a68acb211be7", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a4b8212-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347300, "uuid": "1f5100f8-043a-4cdd-b390-cb5496e2f2ae", "comment": "Malware payload", "value": "fb3d7163204732bdb4a5189adb255e6a", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347300, "uuid": "a30c71bf-7352-43a1-9a6f-5e3446c7e228", "comment": "Malware payload", "value": "79b832aa00d9fbb4581597c6772c528567391b637f6cfd4549d7bdee191bda07", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347300, "uuid": "f50ab03c-3d71-4d1f-8f14-76bf89abaabb", "comment": "Malware payload", "value": "1ba68a714d83df4802b5808ccc2edb50cc46b7f7", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347300, "uuid": "53ff58bc-f96c-4bba-9ae7-f7b010da55f8", "comment": "Malware payload", "value": "3f63c09361db6c63c83862f5034b34ba52e012a234263a19272a25895d214f16316236cdcfaf64a0da8b55dc2014417b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347300, "uuid": "c2eb77b6-11d8-4398-be9c-88d1705df8c8", "value": "T122B4237C993532C6DDB127B9AB5C80325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347300, "uuid": "493e984c-dd48-4f75-a4e2-698590ae7947", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347300, "uuid": "d5a13ec2-f6ff-461c-80ca-20e4aae51887", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347300, "uuid": "a0761b2d-2cfb-440f-9f49-69548f2e0ff3", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347300, "uuid": "95ba7d60-2cc9-4e28-82e4-cafde1a9f222", "value": "AppleApp(218).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "489e5295-6215-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696355404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355404, "uuid": "47a169c7-ee74-4847-9704-0f083c2d95e1", "comment": "Malware payload (Mirai)", "value": "1ef58e7e8c637ce36e804b46ac990fcd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355404, "uuid": "df65166e-2099-461e-9f09-59da50dfb635", "comment": "Malware payload (Mirai)", "value": "79f5331c37c4519233a2512adc6cfab4619de50ecdf37de631b578b002ea818e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355404, "uuid": "270012ce-22dc-4150-a55d-5be602f051bc", "comment": "Malware payload (Mirai)", "value": "d0ef6bec4e56e3a62a49ffc033577c6132a26fa0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355404, "uuid": "e4f84ef4-f1dd-4018-9f0d-5e3978b04d96", "comment": "Malware payload (Mirai)", "value": "d56fd29d45baf183ba0ba9362274e448d0914131a8641b2ecaeba667428da9894b48957959ff493307a14e8d2a9d4125", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355404, "uuid": "6b5cac81-c830-4539-9ef5-87196e399f11", "value": "T108533AC06583E9F6CC0112BD346BAF724E77E57B60B7EA86E3D8A937A54510251033AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355404, "uuid": "1a2a6f3b-4560-4513-b83a-d765cdc62387", "value": "1536:lDQUwOthA06okng+APz4e0QLukaK8xMxWVW72qVkcc:JRhA06okg+ArHLnp8xMxGwZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696355404, "uuid": "93086407-941a-4ecb-9040-5dc2d8eaf81d", "value": 66416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696355404, "uuid": "035c006f-ba23-4aa1-817a-a0b71f081687", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355404, "uuid": "d5398b1e-3fc9-4b22-a115-031bab63187c", "value": "rift.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "661bee91-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696374352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374352, "uuid": "9297d8da-8bbe-4967-b138-e6292531aece", "comment": "Malware payload", "value": "59478455a4bda846632beca06ea5c6eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374352, "uuid": "a5192eef-9bfb-4fc2-8d8b-52d5cdff4f0a", "comment": "Malware payload", "value": "7a9bad1a23b73aa40a93556860f568cbf6eb3b716ce9784087faf0ee5eb271bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374352, "uuid": "446a2169-21fc-4cb2-ac0f-5689cc53bf3b", "comment": "Malware payload", "value": "1e0236c32f5b59e49c84771f34c6954044249a31", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374352, "uuid": "88d84bb6-6f67-48ae-b7e8-8f89476f5b13", "comment": "Malware payload", "value": "50286cb8dac8517e7815878a43ec4753ff0c9983ccf32e72d12c3a3ed5c4ead1f041c6db2a3d557342150d28c0f3ef84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374352, "uuid": "325fa6ea-5f2f-49a2-9e98-58dbd3926f17", "value": "T1AD433A21B9792E17C0E4B4BA22F34328F2F5270E25B8C75EBD721E8DEF2164416166F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374352, "uuid": "08dae120-c359-48fc-97c9-d04e46a4bc4c", "value": "768:dIoKq9O91l0N7Lv0r2dZeDJ/4p/hseQk4lmI4BO+zCVGcs:dIjSO91l0N7Lvo2dZeDJ/2/hsel+mTxJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374352, "uuid": "a0db8232-933a-43fd-96c2-a31ef25cbf9c", "value": 58664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374352, "uuid": "9aaf4e66-d183-47f5-ae64-5913a40ce882", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374352, "uuid": "938b5ae8-761b-4db6-b949-d15a116a293f", "value": "59478455a4bda846632beca06ea5c6eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f5482f-619b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LimeRAT)", "timestamp": 1696303134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696303134, "uuid": "77fccd14-2de8-4ed5-a424-5de588aa01a3", "comment": "Malware payload (LimeRAT)", "value": "76599bf790a73e2b744baf9a32e85f68", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696303134, "uuid": "e1b10c90-0607-41c2-92d4-e899bb0492b4", "comment": "Malware payload (LimeRAT)", "value": "7ad4833a0a350da2896e61f57df12dd34e3f22c8e80e75184550b61176594eb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696303134, "uuid": "9c300a9b-8d5d-4a50-b02b-e57e8a92f961", "comment": "Malware payload (LimeRAT)", "value": "540189233d31135e0dfb448e66b6b04d6a18a5cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696303134, "uuid": "833b0c20-74d2-4a8c-ae4d-b1e3e71ef4c6", "comment": "Malware payload (LimeRAT)", "value": "9697478bfc6bac0f05cffa1e9b5636ee0ea5bc87919a99cfb3a802bac00ec044634303af680647b7883a4aa0c8e936eb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LimeRAT", "colour": "#53EF89", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696303134, "uuid": "b9f437b0-dd3a-4d1d-a57e-27c2af7ce761", "value": "T137A4BFA7F505A1E3D0218A718293C3700EBBED7FFBC11A566680732F79BA44B6137616", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696303134, "uuid": "e41896ea-540d-4f69-be25-0d5fbf2f45aa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696303134, "uuid": "0bcdf441-e6ab-4bdf-bb63-b9d730ca1b12", "value": "6144:UJCvLUCa8FDbtUhB8wNHVi2dpgaUIVdrjc:UwLFjFUhB1HVx1JVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696303134, "uuid": "70f075b1-7588-4a7d-84db-cd5795ebe683", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696303134, "uuid": "49d7b055-aebd-4b4f-a5fa-896566c37fc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696303134, "uuid": "caf5fed6-7429-4eb8-927c-036a3a178949", "value": "76599bf790a73e2b744baf9a32e85f68", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f032c200-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343659, "uuid": "cfde545a-dd01-4793-a27a-52495b72d6c6", "comment": "Malware payload", "value": "4e15de28f39ee654864cc98369ac1c6e", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343659, "uuid": "4e60c15b-fdc5-48e7-a1ac-3319a45463f9", "comment": "Malware payload", "value": "7b49583ead0e814ed790f50f29daf1f82871ebf771fdb312ef2c95082e5908cd", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343659, "uuid": "94ef702c-6381-445e-bdf7-206adf610286", "comment": "Malware payload", "value": "6a8e3391b534b7e3b13efc9fe5b1caf91d87eae9", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343659, "uuid": "b3ed9fab-62e3-4ae0-a5ed-c7c72e1165f0", "comment": "Malware payload", "value": "5026600c7f4ad1fcd1a81b7d8700e93d76bbf8ef1cc8f6a27f264aaced70a328360b17e342d1d428d444d9475ed02a03", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343659, "uuid": "dd2a8727-807f-42fb-9849-ca82e74e0953", "value": "T195B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343659, "uuid": "d02fd3c9-1cf2-473e-b2d0-2912f1cee61a", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343659, "uuid": "4bca63ce-9842-481b-b413-a9fb09bf9a47", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343659, "uuid": "2f909337-c8df-42bf-9a03-2bd59f98670b", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343659, "uuid": "e94f252a-5834-47df-8837-9ba01384607e", "value": "AppleApp(146).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0a6ff72-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696336654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336654, "uuid": "b527b384-faa3-4a81-be52-bd684fa61abf", "comment": "Malware payload (Formbook)", "value": "3c39628bc7fad5cd59e6256ae4db2054", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336654, "uuid": "d4d8ecbf-0595-4a15-8f30-975a4dfda285", "comment": "Malware payload (Formbook)", "value": "7b798cee09b1e65922731c0ac1ddc080ce0560fe68a01c70e19bcc1bb59cd047", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336654, "uuid": "8a46691d-29d9-4e53-aa7b-1ce28201b53a", "comment": "Malware payload (Formbook)", "value": "d5d4cef98d3b04a66376f1a00a5391fa1ca37414", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336654, "uuid": "89132903-42ca-4f20-aba6-e961459c74ce", "comment": "Malware payload (Formbook)", "value": "a3e2ebac1a40045d63c2dbe65fe7afeb08ee89d9e582942035787c9bc591ac299d01688d0a14d9781c025748109a8678", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336654, "uuid": "a17da131-c2a2-4e59-b312-2d1983c6512f", "value": "T198355B34B3B208B0F56A75B5C90A67F41DFF27A9AA442889D2793D1B1CB27817F1106F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336654, "uuid": "a136d0b7-4ee1-49ec-b51e-87d7e7377da2", "value": "fc431a28c58a1565c388a05232b2eadb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336654, "uuid": "5920e6f3-f5e3-4144-bd7a-30e7ec01afa6", "value": "12288:qE8C9kdWdEPv8zuVEdh9a6OLqvabdpmBkt1VEmA00P85Be2fgmv1qsM8HcZG3g5W:qEPudPPOuVsaoAjlD0P83H5M8OG3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336654, "uuid": "562dd50f-853a-484a-a575-c1a7db58f99d", "value": 1124352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336654, "uuid": "5afabd12-da3f-4e20-a6c0-c7b7aa7e1904", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336654, "uuid": "94605f29-5960-4ba8-bda8-14aef6c4e87c", "value": "3c39628bc7fad5cd59e6256ae4db2054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9be5305-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343675, "uuid": "ab5388d9-e924-4ef7-9d4a-635f4eca3511", "comment": "Malware payload", "value": "5cb94947bfe3a9946a8122f10fd4761d", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343675, "uuid": "2207031e-dbf3-43d2-9f9a-e611222791b9", "comment": "Malware payload", "value": "7b7a5c78b851d59e97d1121274e9b7706c7cdaaf0b13380bd050fc692ca99ce0", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343675, "uuid": "8e911707-64ce-4845-a8fe-cbd2a31e024a", "comment": "Malware payload", "value": "154359aaec45194a5cd9498209110bd11ef57fce", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343675, "uuid": "f8abf835-6365-4ef2-b5bc-277847194763", "comment": "Malware payload", "value": "86945bbc33279e1efb5498951a70f985207d0081afc55f594cfab8262a36fffe60ae4d7f14c332626ca6406e3d363de5", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343675, "uuid": "53ce7dea-9653-41ea-b99f-f653153fbfbb", "value": "T146B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343675, "uuid": "41e4929d-a3ab-4d6c-9032-96eac5c04721", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343675, "uuid": "3040bebb-ff11-4a23-870b-c2ebbbda6daa", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343675, "uuid": "21424eb2-1c79-4422-a4a1-4dc2c537d9b6", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343675, "uuid": "2fd9df2d-274f-4c43-8a51-bcc7529a34c3", "value": "AppleApp(106).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "408e1167-6208-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696349807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696349807, "uuid": "50229ceb-e000-4ee1-a82b-79d2d79913ab", "comment": "Malware payload (AgentTesla)", "value": "d7024c5e38f2b8f8dbfe07eda06c40d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696349807, "uuid": "72978d3a-2cda-43eb-981c-02d80efcab6e", "comment": "Malware payload (AgentTesla)", "value": "7bc03aa044db5904f6e72508762030b1dbcac537ba8903c567a6b853305409c7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696349807, "uuid": "8c398955-dc79-4da6-8ba9-61b505edd404", "comment": "Malware payload (AgentTesla)", "value": "6af4265e07634fcbfe7371de1bc4d74a199dc976", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696349807, "uuid": "babb8d67-4c96-4582-a5e7-eef25df6b625", "comment": "Malware payload (AgentTesla)", "value": "17d5d63e68114101170844d3da39fd9447e9e38786c231e7d29df6660ea6782f882cbd3bed235949b5ca37268cf193dd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696349807, "uuid": "6fef5c2b-96a1-4215-8023-e01da08813da", "value": "T1869423551C53CBC8BA8A6B4C7147512D107843A7D6BCAFD2AA0B76F4C1B0AED26ED34C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696349807, "uuid": "70e763a3-846d-48fb-87fe-9e6d3f255118", "value": "12288:KApOeDhT+AVPl9SL3ch0xufZnkJKZvoq1T08U97LhNWTt:vptDhT+A1QMzh20wuFU93WTt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696349807, "uuid": "b30ade51-d69f-4c4d-a180-028f3a86c583", "value": 410934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696349807, "uuid": "ac977a6e-fd33-415a-9cb0-c808063c6109", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696349807, "uuid": "a48ea96a-3e06-4c87-9c1a-524820064e2f", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "293df818-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696313690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313690, "uuid": "ab89186c-1b20-4136-9b0f-c633c27b1947", "comment": "Malware payload (AgentTesla)", "value": "711f22759352f71502ae383ab4cea435", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313690, "uuid": "1bd45a1a-d7a5-4c0a-b50c-ef474eb1e9ac", "comment": "Malware payload (AgentTesla)", "value": "7be0e7463275859563c266e5a7f0d02dd105458764ca49523d19c64811e1f0d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313690, "uuid": "fe7cd307-d5d3-4f81-8057-e69061a5090c", "comment": "Malware payload (AgentTesla)", "value": "2c766048391043b624a0d9713fa664ec5f151a0e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313690, "uuid": "aacd84a6-72d4-421d-8041-fbe03defab43", "comment": "Malware payload (AgentTesla)", "value": "234a6939908ad312bdea4cb37783bace11a40ac1155a56e307327193a653d555d1dca6fc075179cd5b9fce75dae450c8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313690, "uuid": "c5de63d0-faad-41ce-9200-4fc756c603c7", "value": "T1BDE423C967F0D932C7018FF01F14E9C828EEFB06C5DB486472AE2024C66E5F99ED6956", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313690, "uuid": "e02b1801-e05b-400b-8600-6bbd60e37db4", "value": "12288:k7kKAv0OQdL/SNqcpJJ/GO7ewecU9EnVrTw10qJdG+NWxkckgUk:k7kKaQJIJJ/Gs3lU+nhTqQ+8xTUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313690, "uuid": "c5ccf977-d0b2-47c0-b30d-8b25521adbae", "value": 667353, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313690, "uuid": "c3d0ff83-783b-4324-9f10-473cb6ab22b0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313690, "uuid": "eb0be1d3-c199-46b2-ad32-abae66e07c8c", "value": "Pre-Advice Report.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e828914-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696336597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336597, "uuid": "b9a60c26-d0d3-465e-9e1f-d7d18c270548", "comment": "Malware payload", "value": "20937233c0840cbd540ce86d1ad4df3c", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336597, "uuid": "00d64e18-2e78-421b-8474-23e8eaafe079", "comment": "Malware payload", "value": "7cca16a505d4d7235cd44dc953b8040d7823685695c0e9087597d7ed97584252", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336597, "uuid": "b93f64aa-33e2-412d-a42e-eddd380e2d47", "comment": "Malware payload", "value": "7d92919af9e048690d5a027309dc7dcb30580ace", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336597, "uuid": "d86b4296-b5f2-496f-8e16-f7ff5ed61828", "comment": "Malware payload", "value": "cb2dfac8b9c8340238dadb101359538e39afb491b178d88a5a1af2f80970f442e25840de8c3c737867bc7d2ddcb04053", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336597, "uuid": "90607b29-fa57-4f91-a4a6-8febe0619bae", "value": "T1EDB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336597, "uuid": "a362ac62-9e57-4057-a9ba-c09224648f65", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336597, "uuid": "50f88574-d391-45d1-b3ad-5298528f45ca", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336597, "uuid": "48f653a2-29f8-47d4-812c-5f3fc636a273", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336597, "uuid": "ab8a4c3b-b25b-4b82-945f-39757080074f", "value": "AppleApp(96).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d3d1fc-61c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696322243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322243, "uuid": "15551cec-ede3-40c7-a583-84afe48a2671", "comment": "Malware payload (Mirai)", "value": "5129c8fb94fe457ff588acd65d88cfef", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322243, "uuid": "291b1571-8132-4852-a684-c98df887429b", "comment": "Malware payload (Mirai)", "value": "7cd00fe8f9b8ea26f631710c6f60e159b5faefb3ff4955cb625b1585892095bb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322243, "uuid": "f96731b0-639c-48f3-9daa-99685496bc33", "comment": "Malware payload (Mirai)", "value": "24b219695d0eb67271361e181c846b3ee8904033", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322243, "uuid": "29e1552a-b096-4c76-9eb5-055eaa53472d", "comment": "Malware payload (Mirai)", "value": "6166e864f28e68dccd914488775fb435b22a028f06ce163b6e47a977dcff42771428df1b5f791f26982d5fc658d02def", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322243, "uuid": "dad83a90-6a83-4719-8c40-a9b46ac86b28", "value": "T1AAF2E1B84A6C1448C112C0BB8FBAEB005E9E1731AD514C1E8B5DBD8F7E8A5D53C4BED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322243, "uuid": "b98ed619-56da-42c8-b560-fadc04a074f4", "value": "768:jo2I2h/A5ZUwC7AT9rqyTJeke3AfC6zAz2z4mcR4t5vtnK0IJgGlzDpbuR1Jt:jg2h/A5mw8MeyeFwwsFPK0IVJu3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322243, "uuid": "d3173fbe-fd3c-4a9e-a6b4-e5cdff1a0731", "value": 34548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322243, "uuid": "60e1e66a-282e-4aab-92c4-bd986eac5a79", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322243, "uuid": "ab165a6c-39c6-4517-9b02-87c1d649b8c9", "value": "SecuriteInfo.com.Linux.Siggen.9999.17990.30754", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c66299e2-619b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1696303217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696303217, "uuid": "b84ce6ca-0a88-4653-94f5-aa4a446ddc7b", "comment": "Malware payload (DarkGate)", "value": "a19d814f720701a258a6e8b5a22b22c9", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "greadeaoptimalle-com", "colour": "#15D34A", "exportable": true, "hide_tag": false }, { "name": "searcherbigdealk-com", "colour": "#D048B3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696303217, "uuid": "11d2b76d-e294-4686-9b03-7fd89547ac6c", "comment": "Malware payload (DarkGate)", "value": "7d4115e88411e7bcac9ed622dbb6554ff4015c6f9fed98a5427970ceada526e6", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "greadeaoptimalle-com", "colour": "#15D34A", "exportable": true, "hide_tag": false }, { "name": "searcherbigdealk-com", "colour": "#D048B3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696303217, "uuid": "35bd5bd2-777d-41ab-a587-07724618f6ef", "comment": "Malware payload (DarkGate)", "value": "cbdcdefb3328f1473bb1da624ed2bf9515ffd2c3", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "greadeaoptimalle-com", "colour": "#15D34A", "exportable": true, "hide_tag": false }, { "name": "searcherbigdealk-com", "colour": "#D048B3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696303217, "uuid": "13c0a275-55fa-4ca7-b6c3-612b95e2cbe5", "comment": "Malware payload (DarkGate)", "value": "7597509bcbe82c4ce6c8e3e57fb01414acc65f554a6bb16593628722fa4a89a01cf8de909d390bed56635ead436809ca", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "greadeaoptimalle-com", "colour": "#15D34A", "exportable": true, "hide_tag": false }, { "name": "searcherbigdealk-com", "colour": "#D048B3", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696303217, "uuid": "c504d095-ec22-41da-a303-004d30e4b928", "value": "T1B7921917B184151745C24793F14AA2B3AEADC031878E13E1ECEED2297A8E4EDD20F2F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696303217, "uuid": "a3a0d192-2a53-41d8-b010-1a9b745ea78e", "value": "384:fwcem3DxZbJ6TZZfOEcMR/vuvP3RhbWbdVIIo+T6ncfzeQhs7h7:YcXZ16/+MRSbbaX9yp7h7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696303217, "uuid": "e0cbd24f-64a3-4725-b7a9-ad1717cdd75e", "value": 20013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696303217, "uuid": "060ebe51-2ab7-4b4c-bb47-218981954524", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696303217, "uuid": "9fb42c22-c52b-426f-bc34-b90eb8f57142", "value": "bye.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55130a90-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374323, "uuid": "500dd656-cc91-45c8-a458-89b9b9fcecaa", "comment": "Malware payload (Mirai)", "value": "78a61b93914954f6d9bceb3bb65ce7ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374323, "uuid": "0ce021fc-fcf3-4713-9041-c38bf11b80c8", "comment": "Malware payload (Mirai)", "value": "7d463b42749dc53c7682005e51f1e0754f91e8de95c6f3ff9b9b1bc368710e5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374323, "uuid": "f4e3a9ed-e7bf-4596-ab83-45faf310ec44", "comment": "Malware payload (Mirai)", "value": "7a998038f9a0664c7d1089dafe66f32efd9861f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374323, "uuid": "b77f5398-4252-42a6-ad24-7484dadb7704", "comment": "Malware payload (Mirai)", "value": "2cdf731b0aac8efc870ca7b082ecc5c90c96ad03e0345d8d188ab5efac7495d3ef416b8f8e35cf01d5a079cc0f2ddfc2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374323, "uuid": "77b3e7a1-919c-4d7b-b308-c5460a01a828", "value": "T11B431755BC918A12C5E422BBFB5E818C332523B8D2DF7207DD222F51779A81F0EBB651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374323, "uuid": "8c4a8609-6b63-44ed-a6ad-347afb106e49", "value": "1536:B+2aaefZLVheQJk+T6MBWW95cEwwVJto:k2aaitThWW95PXVJy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374323, "uuid": "a70de19a-3326-4e23-b054-68803d2ac486", "value": 56568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374323, "uuid": "b69c5bab-37dd-4967-ba05-cbc2a150d595", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374323, "uuid": "3ce8345e-8d14-48de-8df1-d11552433bf7", "value": "78a61b93914954f6d9bceb3bb65ce7ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6063af18-61fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696343848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343848, "uuid": "b68bc740-9f5b-4a99-932d-548a283e2d37", "comment": "Malware payload (AgentTesla)", "value": "f4901255335c2979acae5e47881f24e9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343848, "uuid": "8aea15a9-6a69-4a98-9c47-cdee082dca8e", "comment": "Malware payload (AgentTesla)", "value": "7d4e7b761d711d84fd851a1e50c092f750aa75ad6e83ffc27e2c582b49a69294", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343848, "uuid": "dd6c9b95-0553-47a6-948c-4520ff652ba4", "comment": "Malware payload (AgentTesla)", "value": "afaeec7941ad09e05e0562ef3bed762a3566cedf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343848, "uuid": "fc892658-5340-4fc7-91d5-2d9d7ff01174", "comment": "Malware payload (AgentTesla)", "value": "cefc154f0ef54f8ad2c9d9677b43304b33bd10d98ca9d15551194182cb3ea47fc82c20e049d0c1ae05f73921a7441789", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343848, "uuid": "72fc1e36-ff4b-4e10-adb5-fc9929338028", "value": "T1D72523504A3D9CED12AC730475276F3E29F4C492823AB4E293F1359A16EDF9FA807D49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343848, "uuid": "e6699e28-674b-4c06-9e9d-9fbd8f1387b9", "value": "24576:E5gY//f59B3BitiYcXeqCi1w8rgiP0hpf7Sf8:dQBB0+wCl4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343848, "uuid": "0356ed71-8eed-46a4-b27c-24ceca4f26ac", "value": 1040482, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343848, "uuid": "36dde965-1c80-44d2-b679-c578a5d01c9c", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343848, "uuid": "952ecc83-0d79-4ce5-9643-5f6a0fb1f839", "value": "Requirements.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e836ad5-6204-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696348140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348140, "uuid": "5b60b63f-8c92-4383-b3c8-e6d86e424cdd", "comment": "Malware payload (Tofsee)", "value": "c061a5c7cf35fbf53af1036ab6ac4844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348140, "uuid": "4ecff598-c073-4efd-9475-46a5d205d54f", "comment": "Malware payload (Tofsee)", "value": "7e654c708e7931db49453dd5d95b300f6c0f413d719d3386630acea29574b263", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348140, "uuid": "76bd25ca-2265-4b6d-95d7-958df10f3b38", "comment": "Malware payload (Tofsee)", "value": "fc4a5e5bed600fa83ec6a12acc8b1cb7bc66bbd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348140, "uuid": "bad586c8-e465-4b8f-9e01-cef0913dc134", "comment": "Malware payload (Tofsee)", "value": "5fd834e52b6f2a591aa5505c1c3d5b293f6cccbfc0f60c5a1ac492b71cd256413c4ed4111bd15a152c93647ab5c2f290", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348140, "uuid": "53eb96ad-c41d-44aa-a490-6dd2b3f06ff3", "value": "T13454AF1372E0AC21D5665A319D79C2E4BB2EFC619E6853DB33583F3B49701E19A62B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348140, "uuid": "8ab60837-ada0-45e0-a2ac-ea46ebcac54b", "value": "775c7d434cffd499e537a34db4132a29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348140, "uuid": "f701ffde-73b3-4a93-b923-80afe0cb815f", "value": "3072:Pqj/wSv6+faQdPo9aNY25a7BflNTbMv5hway/miFMxgKY:Sj/9vvfaQdPdN7eBfbTbUJyfi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696348140, "uuid": "ec802b27-fc47-4deb-83e9-9b4743308d26", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696348140, "uuid": "0288490e-2fc5-4635-be2c-138f976c6bda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348140, "uuid": "2777a3cd-be3d-4e9b-a15a-762a4a64f789", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "074725d9-61fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343698, "uuid": "fc1b1f45-bdd0-4165-b9cc-f7ceb2b29d30", "comment": "Malware payload", "value": "8919bbdc471f157cf0995d4ced21e54e", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343698, "uuid": "c9666bc8-069b-4b3f-9c63-7326d4416da7", "comment": "Malware payload", "value": "7fe0f997c3d9bd24ccbbd31bff16747a8522c9a2fa9ba33341447b2eeb0297c0", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343698, "uuid": "4ebb58d2-af9e-4a24-8a31-bf351abf9a27", "comment": "Malware payload", "value": "c14e671a64a36b7cb865fe6171e9a34b4cd5bed8", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343698, "uuid": "5717f5bb-811f-446f-b70a-ae4daa5f2658", "comment": "Malware payload", "value": "7a58233014b4a2cbab09e1b88e12f8ab6d19a6747e4d2648c90cada7630ffaa70f0e246c292da546a5156fc152a1e9dd", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343698, "uuid": "8bd81e9a-6640-4c31-bc66-18bb1d22b154", "value": "T1F4B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343698, "uuid": "d905e304-e5a8-42a6-b2ab-9499debc0021", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343698, "uuid": "c6014de9-d441-4723-a15b-ea8f1d07e5d4", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343698, "uuid": "ef708e72-9c49-449d-960e-e44873df0a07", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343698, "uuid": "c30df747-8bdc-425e-8dba-7156d6b7e491", "value": "AppleApp(111).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4231388-61f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696340123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340123, "uuid": "461c554f-e17a-4f5e-a5d8-5bfd77c5fe5b", "comment": "Malware payload (Smoke Loader)", "value": "3b5e0893549516ac1508d1b5438ed40c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340123, "uuid": "7baef90d-83d9-43d4-9870-af426f4e4783", "comment": "Malware payload (Smoke Loader)", "value": "80aa0e3f87e7a0527526d946ddf371afe27de3f6cabb2a6748c002d24bdeb142", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340123, "uuid": "13747164-d7a8-4541-9327-345035030b7b", "comment": "Malware payload (Smoke Loader)", "value": "a0e0aeeece219da2f27c29607923e82458e830de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340123, "uuid": "406188c3-e637-43e8-929f-67fccb5e83da", "comment": "Malware payload (Smoke Loader)", "value": "29099eadf6008a0d2828d2d72aaa7b5b4775c7cbeea721b8b53879633aafaa759869ec003afc9af684506383da5ab2f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340123, "uuid": "c996045c-6fa6-44e8-8047-e9d723dc4374", "value": "T18C54AF127790EC61D4765A314E2AC2B47B2EFCA09E6867DB33583F2B59701E1DA72703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340123, "uuid": "d786eb79-f263-41c1-8d3b-4db3090457c8", "value": "e9df9444a99e49eb51fccc88bae85d1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340123, "uuid": "f258be6d-b409-4118-83e7-ee69477d3670", "value": "3072:L2rX6SvqgpaQ94YCz2rYsUycB7cvu9QSjVL+boH1KVNA7j5S:6rXPvBpaQ94YCPrcvwQu5+UMDA7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340123, "uuid": "e8599283-0d2a-49f7-9e29-8a3a23fd6ca9", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340123, "uuid": "f0a0e1f7-d7ad-4707-bdb7-92eac86df8b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340123, "uuid": "6451fcff-cebf-4e28-8b16-2e44b90596eb", "value": "SecuriteInfo.com.Win32.DropperX-gen.8724.28261", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56d7f889-6234-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696368742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368742, "uuid": "cd39753d-4484-421b-b78f-e4f089c65293", "comment": "Malware payload", "value": "ab9b2062fbbd4d9b2957d97a0506c4a4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368742, "uuid": "dcdd2780-372e-424b-9352-9abf3c099090", "comment": "Malware payload", "value": "8192f84102d9071fc922c436f69660b5be0bdb300adaa212295f84f985bbc5ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368742, "uuid": "f4ad2f8f-fbf5-4b67-be6a-d09c1babacca", "comment": "Malware payload", "value": "19f2acd026dff3e26e2159283c1a0e62d47c7304", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368742, "uuid": "00641ca5-615c-4945-a422-5e1961da8fd4", "comment": "Malware payload", "value": "c3ea4422e0b750e617ce61ccdfbb8d41079d2132cc88e147ba8486ea0740c92283e93de02a8173700fe489dfee369fd4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368742, "uuid": "64956a74-fb6a-456b-9ed3-259a2a55d0a7", "value": "T141D4225A31BC0BA6D87C4FFB94F124152BBF6A2B1D60E39D2CE152DE19327721A16703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368742, "uuid": "3d7a4c2d-41ec-439a-bdb3-1d1e1bce998d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368742, "uuid": "ceedd8a9-314d-468f-ba5e-b35d6e456f69", "value": "12288:tn0iSAx5PWPQoeKX2wGG11Iw+eTv8H1LFCPbcSVUYs+Y+QDJOXBDmf:tn07Ax5uPXqG11IwRkTCwSVzfY+QDJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696368742, "uuid": "b40adb94-e530-4d52-a07c-57c35f4d48c8", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696368742, "uuid": "8a4e6e29-8502-4abe-b102-07f1329b4a13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368742, "uuid": "de1dd017-62ef-4913-99dd-f5174f7498f0", "value": "SecuriteInfo.com.Win32.PWSX-gen.656.20888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35b8967e-61d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696328744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328744, "uuid": "754228db-1db3-475b-b903-df7a7e984714", "comment": "Malware payload (Amadey)", "value": "74d702c79b9813d2b0379c1d69c60414", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328744, "uuid": "f1e8fcc5-77c4-4ee9-8728-888eced5d66f", "comment": "Malware payload (Amadey)", "value": "81e2e8d324728eb23305d68824eb18eac642a858423bbc9fc0f894ba1fd74d69", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328744, "uuid": "6c2ee4f8-7ba3-4604-a77d-4fa38f3e0794", "comment": "Malware payload (Amadey)", "value": "86374663fcd85305645d12a49392a14b38a8d4f3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328744, "uuid": "86267215-e891-48fa-bbbf-af32a64e6e87", "comment": "Malware payload (Amadey)", "value": "a7885db1336e9f870dc1fd8403a9dbab9888ffa92583fb0f1a881befeddf464e664d981704f66a1f7b1db8116caf8baf", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328744, "uuid": "1257a4cd-ad10-4cc6-91c3-095d4191bb1a", "value": "T1FB357D1BA26601BCD4BB9178CA235A47E775744603309BEB17D05AAA2F13FF15EBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328744, "uuid": "ce3099cb-0c18-44b5-a0f9-710f43e34bf0", "value": "907e684baa019f5bd80cf160486e7eec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328744, "uuid": "f23c1e15-9e50-42e0-82bb-995c023176d8", "value": "24576:iaS3LyrV872cT+RZCPrZ13b1yolNVQd2haH:1V872cTsZKZ13EW+2haH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328744, "uuid": "f9a6f7c5-b37b-42a6-a982-fa2418e21fff", "value": 1110016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328744, "uuid": "9bbb0a18-7dab-4466-9f28-edbdf2c2cb84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328744, "uuid": "763b1bdd-5fee-4522-9f7b-946ade993306", "value": "74d702c79b9813d2b0379c1d69c60414", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aa1be35-620b-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696351193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351193, "uuid": "de6afab1-8f59-4c37-8e15-a4a8b054e5d9", "comment": "Malware payload (AgentTesla)", "value": "0fe7fac5f9d20e9d3c96dab0eb607319", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351193, "uuid": "dd28fc40-4ff0-424f-b533-bf6799bbcb20", "comment": "Malware payload (AgentTesla)", "value": "8225670e0459e46785e400e29c6b89f32d6f8d40f5201e96dab20df05cfff07b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351193, "uuid": "ec2e9ac0-6811-4ec0-996f-dc40c97e5b80", "comment": "Malware payload (AgentTesla)", "value": "2c339c033510e314bb7f2a0581d9f6c63bde07c6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351193, "uuid": "f9b9ed6d-0f72-43e6-ab33-a021aaeb7635", "comment": "Malware payload (AgentTesla)", "value": "a4a7d8bdaaf186bfecf6777e04892b46139900d1f6fc32889c37e8a1216ee7f1fed775b10946c8144cf11d961927f5ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696351193, "uuid": "ed82e455-ffef-4183-aff6-bd829231eea3", "value": "T1668423BFCE6151DA15ACE9CA4D601C26D857E0A337F4D7C5D2C0A3A2D63C51EC883A6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696351193, "uuid": "8892bbb0-66c5-47ac-ab61-c1c1d5b79b53", "value": "6144:3v3Nm+h+0qTLSIwceGaS0y9C14ywyruV9SvTXf7tgX/u71prDb2m/4zAStl943qn:fU+0V38VS0y9h4uVkrOArDF/4kj3EN1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696351193, "uuid": "9363ffbc-8d31-4480-b268-ac63e4d69f4b", "value": 378226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696351193, "uuid": "3f222f12-d31a-465d-a7c6-bff8ca69fc1d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696351193, "uuid": "4edc6a2a-3a6b-4c21-b384-03acd58d5db0", "value": "SHIPPING DOC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bfcfef0-61e1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696333157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333157, "uuid": "5e38b027-b919-4210-be4a-7e79268c84c2", "comment": "Malware payload (Smoke Loader)", "value": "becdce3289da746b1132421f1bb9b5c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333157, "uuid": "8c9ad4f4-45b6-41cf-8b67-c19b132851a8", "comment": "Malware payload (Smoke Loader)", "value": "831fc1d8df2be45780ee06e59dabb36b787c3f26f544b67688cfa91c10f5dbbf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333157, "uuid": "214d6ff0-f0fd-4d03-bad8-f31b010eed85", "comment": "Malware payload (Smoke Loader)", "value": "09e8721f89a1726f357ace4220ae24761567b794", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333157, "uuid": "4cdded0a-c0a5-4439-b224-ee6b718a5633", "comment": "Malware payload (Smoke Loader)", "value": "2a35f4bccabed65282b4e558cf3b63312e75dcb9fe5f7a597e3842b80ed41f4574ed42dfb15d3232aefb546ae3da1e1a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333157, "uuid": "3f8663fd-c0ed-43e3-91d6-c16fd3fff3be", "value": "T1ED4533C87646F088C9F3A634958D68C2EBA92F3553544C227D3A71E338D7F71A977806", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333157, "uuid": "ff99b088-f459-49dc-b29e-c95f94054faf", "value": "e74c8ae3503a17604f2a2d84ae3389c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333157, "uuid": "07d93902-c4dd-4c69-8879-002edde002d4", "value": "24576:gptqA4nuEzNQOrc1AYiVdIl/bOkdHZRyMj/y0YhvJ8GHvKb4:MgDnuExQOrhYi7q/bOkd5RyMj3Yh+g24", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696333157, "uuid": "d6136501-29d3-477a-8fea-f92aad997b4c", "value": 1229024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696333157, "uuid": "03bc480f-0429-4b5c-ae0d-6b3602da9629", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333157, "uuid": "8b12ad88-0c5f-4cf2-991a-48e93130b768", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38521e41-6246-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696376422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696376422, "uuid": "824cc505-818e-438f-838b-f8b82717a4c4", "comment": "Malware payload (RedLineStealer)", "value": "b2c6fe2d48502fdd3530f2dfcb2d4f6a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696376422, "uuid": "2f8cf38a-7ef7-4d24-a8f5-8e9eb8d4f31e", "comment": "Malware payload (RedLineStealer)", "value": "83b846c3ec077cbe339faa5aac5a7878672665005a25a58afe1f0c6cb86843d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696376422, "uuid": "d0bf7967-469b-4744-b5de-4d009f328ff4", "comment": "Malware payload (RedLineStealer)", "value": "0bf975bd2b4dfd2286a42711ca79cbb4097992f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696376422, "uuid": "09365baa-cd45-4c06-8183-b3a3ad782443", "comment": "Malware payload (RedLineStealer)", "value": "c04496c6e63073778496995f501ad25190fb50effcb68c6bdaf48dcff39a23324c9fbd1e3b3558266ca9ccf7bb8e4683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696376422, "uuid": "45bfa222-cc3e-447c-a7d0-165e36d03606", "value": "T1E804D55C764BA9BED56F487DACA00CD0777C6C635242A7039C8EF4E4393A785AB050FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696376422, "uuid": "cda96c7e-4a2d-4836-954b-181619532465", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696376422, "uuid": "5a5630c8-b160-4cf8-a7cc-880c84b68c5b", "value": "3072:0kbOIXImZEXIgeu5cN3KohrqvE0mdGZGqNJJ18e8hH:0kyIhZEXIgeQxmrqvE0mBqNJT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696376422, "uuid": "3d4172e9-7380-497d-9296-afcab3b7eda6", "value": 182272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696376422, "uuid": "07e6eaff-9ca2-4975-90fa-0778161bf6c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696376422, "uuid": "fb54870c-3857-482b-a478-13e138a1067c", "value": "b2c6fe2d48502fdd3530f2dfcb2d4f6a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc04add0-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696356994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356994, "uuid": "c18fb8fc-6957-4962-ba16-9ea6a001a2c0", "comment": "Malware payload (GuLoader)", "value": "57cba5842bbadb319635afea38d0fe87", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356994, "uuid": "788f4149-492a-47a3-acb2-c48ef3395f68", "comment": "Malware payload (GuLoader)", "value": "846ee8ff33498cd907aa4528d484cbf4fdabb994335f68a5fd3ec59a2e15bf4c", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356994, "uuid": "8d6bc5d0-fd97-45a5-a9b3-07c7555e1197", "comment": "Malware payload (GuLoader)", "value": "216a579771f7a76576e1c97c8932cc1f726c0ed0", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356994, "uuid": "9de18d36-68a1-4fee-b97b-19eca98d727d", "comment": "Malware payload (GuLoader)", "value": "c2974f180d2936d050bfd66a23a2d567c220e8ae6b4d5e2d4d72ff1dc51a58292301d7f73f01680e6e436e6f95ef0bb5", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356994, "uuid": "77b2675f-2be5-41a3-98cc-1c419e9a8fab", "value": "T1F6F27DA1FA9A551B884F37E6DD005896857BA12916331061BFDD03CEA30B94C87BFF2D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356994, "uuid": "90b08f42-758f-43cd-ac91-745baa718474", "value": "768:9QccYguDW5qQAz3mW+/qCArg3bLIc/KGono7HSzcbErx+H2c39SpIlXy:9jgu68PKug3XX/KG6Q1bGmtZC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356994, "uuid": "e3b43350-86b8-47f5-bdaa-918d850fe515", "value": 36745, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356994, "uuid": "86e8d1f0-20d9-4e31-a9bd-cd30b19b8c82", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356994, "uuid": "8b64ddd4-2645-4143-a770-e1baf2c30732", "value": "POLY V-BELT_Gufero 20231003.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d337268-6187-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696294531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294531, "uuid": "f159f2c4-e84c-4ff4-9e2b-29d2348305d2", "comment": "Malware payload (RedLineStealer)", "value": "6fdabbe1573825599076936d11a0df92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294531, "uuid": "9f0e1540-4dec-4388-bd9e-f7074debf877", "comment": "Malware payload (RedLineStealer)", "value": "85141f90f131642d924d04489036b72a2aed0f912ee56b0701a123615af66ee0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294531, "uuid": "6880f633-328d-4ea6-bed6-15c77d6cdf11", "comment": "Malware payload (RedLineStealer)", "value": "74fe03b3ec25465a8b53ebe15b7d67d6d17b662b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294531, "uuid": "415ea41d-8e0b-4539-a703-cf1d2743c5f3", "comment": "Malware payload (RedLineStealer)", "value": "91d51b8bbccf87d44d7162b81e6ae80a606a351cb2f1f1b3a4d4d3e37a94a59cf87e6ded1879255d2cb68c9350911a37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294531, "uuid": "7dd24488-b43e-4c22-babf-40d56edacaee", "value": "T103540121E2F491A4DAFE9A761FA0B3E48332506B2542E738ADCCD55835BD5C38BC1B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294531, "uuid": "c7cb0a67-6bc6-4ccd-b7d2-19bd8c26e86d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294531, "uuid": "55cceaf1-a7c1-4576-b56e-a9170896a563", "value": "6144:7+2RwNkA20lT9rZV1O7kFFFS4EwoNU4jSy+c7Od70uq:NRwNkliThZPlABbU4jJ+c7O6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696294531, "uuid": "afb74ae5-4dde-4257-9cdc-84ee24e35032", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696294531, "uuid": "0ae24f77-f32a-47b6-b74c-672f9aef7bb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294531, "uuid": "584ea5c8-fb6f-47d8-8572-17b7314a4c7f", "value": "QUOTATION-98475.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d29419f1-61bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696317410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317410, "uuid": "6bf915af-cb7a-4d48-b7cc-d916c201ed10", "comment": "Malware payload (Amadey)", "value": "f4408301dd39adaf7af91d4f99aa6f88", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317410, "uuid": "d0a85db4-7f23-4a34-a473-cdd36b013355", "comment": "Malware payload (Amadey)", "value": "85719973b630d088e2b37a06a645481d948d481295031c73c9cd0e16bf09c061", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317410, "uuid": "f6b95a45-06fa-47f3-b6bb-dfc6870d132f", "comment": "Malware payload (Amadey)", "value": "6c5a80dbcf0f4e791edc2870ae83f6971d1b0d7b", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317410, "uuid": "14bb706f-674c-424e-85e7-ee8d68b11bdc", "comment": "Malware payload (Amadey)", "value": "be56683b5711831629f83e686c22a1ed2a5a954ebb12458a9973b05afabfd4e77e729d0fdca56b8f3e21efc369d277fb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317410, "uuid": "ee333be3-6ab5-43ae-b454-11695c0a15ac", "value": "T1A5152317A5E94836DAB16BB08DF203C71A3ABCE18DB4C65717C5794B0C726D4A032B7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317410, "uuid": "c4cdce19-cc92-4e71-9542-cd3d4ec836cd", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317410, "uuid": "2d050efa-3080-4df5-829c-f99a5bad10be", "value": "12288:gMrty90q1aJYtrOQki6nOayvMeBV0wxhXKb2RLS5ppvDWtiK7vwHa9TSx:9ysOOQBeOFMYV/hXK6cpVDAigvwETK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696317410, "uuid": "8e004bde-0e58-4e33-93b5-7aff9f0bd9fe", "value": 897024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696317410, "uuid": "9de1b109-7a5d-413a-85bb-a89ed7203d7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317410, "uuid": "c9b5b268-d46f-4281-bbac-4cc6e2e80ce6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4767db9-61d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696329037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329037, "uuid": "f222f547-1337-4359-a174-2fa6c7c69cf4", "comment": "Malware payload (Gozi)", "value": "5ff7577d70a6e1f1ce749180a06a4621", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329037, "uuid": "cac92111-3ec5-4154-afc7-c3ea3627f4c3", "comment": "Malware payload (Gozi)", "value": "8591ffc132683cf4b3ae634ca29847788d15bbced677e02770b4cdb2e6e4192b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329037, "uuid": "2eb3b039-7104-4b8b-9c2e-6fc64c35a395", "comment": "Malware payload (Gozi)", "value": "37ca94eefd3af02f638a6ea601a4088f204771ed", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329037, "uuid": "5a52d2e0-68d4-4856-bdf3-f2fe2df54044", "comment": "Malware payload (Gozi)", "value": "e0021b7c2f6d2d38c22c31f4fbf91532aeaceda257194839d18d277ba5313cc810741cc1346310d08980ce8803848c8b", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329037, "uuid": "dd717816-7bfe-4013-9897-d3fa40d9c0a2", "value": "T135E07D24D242DF61C86B4C7BE98743E43566D860EAF4BAA14A1871130C3BB9B1E303CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329037, "uuid": "572118c6-3784-443d-be18-ec29d4c96886", "value": "6:5jqPtU/LQcNMLIwZP16XSfjX3a4a0SbwY4XiaDfeV+SHPtUTjpbjmUau+lZ:5jk0jmIQMaD3a4Qr4XvDfIvIN/aZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696329037, "uuid": "3e2477b7-f9bc-41d5-9c5f-8cb7b1476159", "value": 333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696329037, "uuid": "4b6fbe21-18b0-44f3-bf11-2f90bed3074d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329037, "uuid": "0fb552e4-9504-4c69-991c-49fb38d75ce8", "value": "impresa145.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b89988-61fa-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343691, "uuid": "a6f25913-ebbe-434a-b772-e0aa5ff80889", "comment": "Malware payload", "value": "67f7eab6a43711a198c45b8d7d947c62", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343691, "uuid": "3bef5447-0283-4c80-a2a5-2ccab6672b76", "comment": "Malware payload", "value": "862b21fbdb7e319d7837e6b5b373f749e92fb6792e56956cda7c0c13a6d6101d", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343691, "uuid": "b5420c82-d848-4711-ab8a-b572798d4a9c", "comment": "Malware payload", "value": "048c9f7dc059171937b8864f7541eb532530f065", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343691, "uuid": "eb3b8f53-102d-4978-8337-400875935b24", "comment": "Malware payload", "value": "43ccd5fc98d34e9b020b210fcad89fa63760db4c1795401eec10b404617acc6c68375fd223efde3a79ce5993e8b7f071", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343691, "uuid": "550b73fa-e603-4a48-9415-a5ddc362eaaa", "value": "T1A0B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343691, "uuid": "fc50650b-04d2-40f5-8f3d-75c0ec8ecf22", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343691, "uuid": "ad2f092c-6adf-4997-bd0e-929aef7d03a8", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343691, "uuid": "6ab8bc70-36fe-422d-b96c-e009a36b0598", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343691, "uuid": "118c5689-e9f8-4023-8b42-dd38d1c92e67", "value": "AppleApp(121).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "434db82f-61f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342081, "uuid": "ac33b611-41be-4854-a26b-73de08c96e4f", "comment": "Malware payload", "value": "da61faf5c5673592c5904c4f4996ffc8", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342081, "uuid": "2d676c69-5a68-43ff-b709-bbb92fce4e86", "comment": "Malware payload", "value": "864808c9035822d73e19a30d8f93bac6069cce3bbf2dc9941833328ebe35f96c", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342081, "uuid": "f28cfe1d-f87b-46ad-8ef2-c8d66eb9f574", "comment": "Malware payload", "value": "2f188b10e671fc366f1d11a1fcd2dec3f51a2546", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342081, "uuid": "7f6dd8c5-02eb-4cb3-a81e-68074b5a9fb8", "comment": "Malware payload", "value": "bdaeaeb627cda0d44bf2f91a653e53b0f3380107b4c829f944e7b68398b9f3b9ad9b7b430dcac3b24c707bba74f9a8ce", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342081, "uuid": "f6d0e536-8b23-476f-bdf6-b46c65e2b40f", "value": "T113B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342081, "uuid": "e9fcf8d3-2e6c-474a-b45b-cece81cada4d", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342081, "uuid": "e6974b06-bf74-4b18-839c-56f3571baf80", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342081, "uuid": "34a4dee4-034a-414f-a519-8f7a94e702b6", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342081, "uuid": "2819ed21-74b7-434d-aab0-50642cb4791c", "value": "AppleApp(52).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139a1b12-61df-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1696332122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332122, "uuid": "f09d3409-d09a-4bd9-afb8-a9893bfc4ca8", "comment": "Malware payload (RaccoonStealer)", "value": "926194fb847563586fe6be86b25d6a6d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332122, "uuid": "56689835-37d0-44af-9d1d-c5ffe527ee5f", "comment": "Malware payload (RaccoonStealer)", "value": "86bccbacd8e9fde23ff236155ee47f866dd7dd51c6129ed340034810a10705b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332122, "uuid": "55619549-80e4-464f-9fe8-e7b0f7e4ed7f", "comment": "Malware payload (RaccoonStealer)", "value": "2667ba4d5599aae227d61ad7dafda04d6d2e0e70", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332122, "uuid": "768711f6-d1b6-4d38-bcf1-c03364a0d441", "comment": "Malware payload (RaccoonStealer)", "value": "3e4e2c88a4b6f236097d413bf613bd12b1da8b6f848b57c7b80822c33af68eb09ad924b7788e40ce89034dc2506f9620", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332122, "uuid": "d87a727b-6099-44c5-9531-1893af6e0777", "value": "T1A4759E42E3D6C2F3D94665B4917BA3BB9A309F05C32D86C3B3503E45B8313E15AB9396", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332122, "uuid": "6984e961-e8fa-4063-b3d0-697c5ebb30db", "value": "9e604fa03f90625680ac2f8bef162aff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332122, "uuid": "9999e4ce-727f-4847-bc34-34188bbae629", "value": "24576:kVHFXSjnhDD8BbNmqGk14kQdltDUGcbmFYLBIUe3k7VfgYVckVsPuPTiTZ4cq:kVHFXSFEmqiDqCbS1gickV9GTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696332122, "uuid": "7a2cc1ec-d607-46bc-80bd-ca7d4cb4f5d8", "value": 1554344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696332122, "uuid": "9eb73ea1-27ee-4d7e-a1f0-53b46e8bc0a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332122, "uuid": "b9069699-ff14-42be-af82-7972ad195973", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c7c095c-61fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696344620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344620, "uuid": "5faf7fa1-4883-42ee-b492-d34ce5f42e30", "comment": "Malware payload (Mirai)", "value": "621215cb99b33817e161ffa71cd1d50a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344620, "uuid": "0a6f578c-53d0-4fbf-a900-20f85400c91f", "comment": "Malware payload (Mirai)", "value": "870754816277bb9227d4820a2769ce077b2dd13b510f677ea637d79a5e9e0144", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344620, "uuid": "3cf82823-662c-423c-b7e7-eaff9ccf45da", "comment": "Malware payload (Mirai)", "value": "8be737e30e2c8e078fdb5f8cd2ba48c2bdad4a7b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344620, "uuid": "8e98dc1c-4b77-47e5-9753-6b956e4042e0", "comment": "Malware payload (Mirai)", "value": "a4ebcce8be866a476466e620e004a580e36e250514800d07230fb86fee38addd09b9e6d2bf9f52da871f41a06787eca6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344620, "uuid": "7a70d132-f95b-429a-9b9d-bac855926c93", "value": "T1CE33027267AD29D651B09737BC33BC5A979C27F89867309A2CF0661973C58024EF2382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344620, "uuid": "043189a6-a00e-46f3-b249-67026d05306e", "value": "1536:d9O/ZMAXIxNUk0hLcPqF1aBexo4opKZbw:d9O/ZNKytLGqFUFF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344620, "uuid": "cd571f70-6e5f-46b0-ab28-b15fb36426f2", "value": 52512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344620, "uuid": "e2b246e3-e07d-49d9-8cdf-66ce1a89b900", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344620, "uuid": "da474262-3c40-4c1e-899a-402b2320b121", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34a5edf-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346161, "uuid": "843b3ac1-0b8a-4374-9b98-9859fa15b67a", "comment": "Malware payload", "value": "d7754c2075ddadab194e19e2aca480c3", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346161, "uuid": "fac42362-4be4-4244-9610-86d547d3c4d3", "comment": "Malware payload", "value": "879c7fc04cb9686f8f972165966c34cb89f0cc15959d6ddca9df1d73d5f30dbd", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346161, "uuid": "745529ab-e256-416b-9bce-66ecd8aa3157", "comment": "Malware payload", "value": "2444098711e2451a896845714d3b5a022318adb0", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346161, "uuid": "75493847-2628-48fe-b4f5-088cdd328173", "comment": "Malware payload", "value": "2595708381f4f48b543e95a79a6e2242682bba1e6040734d74a6badfe9bdd1ce5250b290ab09f8986c4416a0a2f400f3", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346161, "uuid": "1476705b-5768-4e45-b703-bc6759be05e0", "value": "T1B9B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346161, "uuid": "000060de-3b3f-4578-9d95-cba2534df271", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346161, "uuid": "cbd64e63-4d94-4fa5-9482-7f1db378aa49", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346161, "uuid": "444475f0-606f-4821-b9ee-22f0e4ff1961", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346161, "uuid": "c993d906-f041-4ca4-9c36-3f3077f247e5", "value": "AppleApp(150).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81077d5c-61cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696325434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325434, "uuid": "bd591f15-a4d1-4f04-ab3e-28e395e6cd88", "comment": "Malware payload (Stealc)", "value": "a0751319e2ebba282554dbde4ad5b548", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325434, "uuid": "74aa8381-f84f-489c-a17c-024057f4625e", "comment": "Malware payload (Stealc)", "value": "87ec3dd4160f049b289793c2682f45bba724cc8c39de7094594fde12f5ce0df1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325434, "uuid": "64755e44-f071-4b43-bbb6-eed165e437ea", "comment": "Malware payload (Stealc)", "value": "28bc78bd23a0cc307507ddfaf8406b0ac9b5b556", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325434, "uuid": "c4e7d755-e3e9-4e39-bace-44f9ae1477c7", "comment": "Malware payload (Stealc)", "value": "fd18854f0c9ee686d627bbb9c642dfd7bc06f3b2388bff6dbffcdc62950c3e3e0137ffbb4d3c79879ae2f9123b547bec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325434, "uuid": "fbc3d4bd-02f5-4fe4-81e9-fddf7241dcc6", "value": "T137A3E601DA40542EE1A504FFAAAF5BEBE81C3EA41340C0C3EBB26D7925E11F664B557F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325434, "uuid": "a92b3ab9-057d-457d-9c42-d98c23d0b8c0", "value": "372dad7e771f409df9ab1b912548c291", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325434, "uuid": "27ab21dd-7502-41f5-a976-f7beec91e08a", "value": "3072:k+QZx7YwQ5jXl9t6Swu6bCYf5z46CyOVfFEQjSI:LQZ1/Q9jtpf4DHO/EQjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696325434, "uuid": "b365135f-8004-4ed2-9831-cf1adf075087", "value": 103936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696325434, "uuid": "a288f473-2013-4368-b411-6d65064e30c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325434, "uuid": "399cf5dd-d55d-471c-b22a-466b1dabe118", "value": "a0751319e2ebba282554dbde4ad5b548.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3def1baa-61f5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1696341642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341642, "uuid": "fcf313c2-6208-4d69-ba23-0d5c201d10ed", "comment": "Malware payload (AveMariaRAT)", "value": "03f6fa58e4364de21a1f6a59afef58d6", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341642, "uuid": "4189bf37-2ea6-4647-8991-2477a318e188", "comment": "Malware payload (AveMariaRAT)", "value": "883256088dded2fdc3a914d6e2cc68ff538a20dba921d7eab36fbc7bda213913", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341642, "uuid": "9d392f21-113e-485f-a393-d79672eab883", "comment": "Malware payload (AveMariaRAT)", "value": "6a6baed0541bbec4c83c09d70930aedf6cdf855d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341642, "uuid": "ea84aa6e-8d44-4412-af2d-d92fa53ba2b4", "comment": "Malware payload (AveMariaRAT)", "value": "12ec80dfad23255d8004bae1dea66605ccd7433723d03c156c1ccb028f2ca1d55be3c91429bc034abb69a321166eb1d2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341642, "uuid": "b49a2bd8-b4d7-4c5f-93e1-55f8ebcd7ab4", "value": "T1F8A23A46337CAB7ADA764BF918610010077AB12B6472FA4CADD960DE2D23B014762FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341642, "uuid": "3704b7d7-ffa6-4c94-bceb-b80a7a704323", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341642, "uuid": "c99e6006-6492-47aa-9264-a9b7deb7e285", "value": "384:vC0Kaa50vFjy/ZUKnAkgwUF3tXLrKsYtjY1fIookwXwAIz3wAIz3wAIzP3:vZKB0vFOZUKnCwUr9Ya/++z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341642, "uuid": "22674552-91ad-44c2-a43b-a623b1fd2334", "value": 22528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341642, "uuid": "c82db666-0687-4e62-a894-8b334d740977", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341642, "uuid": "86bb1f6a-50fb-4b59-ae54-4bc5ab0ab93d", "value": "INQUIRY0092709092023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64d1b39d-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347291, "uuid": "9949f966-58ad-4488-b370-51f2c56c0244", "comment": "Malware payload", "value": "bd7939eb15ce394225c9095d5f25ab9c", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347291, "uuid": "959a8f63-4211-437c-b8a1-a2c6dcef4745", "comment": "Malware payload", "value": "8873ae9ef12bb5542d743116136e811789bbdc28b8cbc492cd55cba1b6e153ba", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347291, "uuid": "e406265e-39a3-4d50-888e-0d5edb3264eb", "comment": "Malware payload", "value": "5909d90239475d29d1045f38b98857b40a059d84", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347291, "uuid": "b1d5742b-5eb6-414b-89c3-e99b45d2980b", "comment": "Malware payload", "value": "3a1b7921e11d688ebdc58dab24745dfaf1dbce2ad4f135ac4000953353683186c9d03af46adffd86a79fb32c0c22cd77", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347291, "uuid": "40858603-a7ba-4157-b2f3-a8c82141d1fe", "value": "T197B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347291, "uuid": "c215a774-fb50-405e-89b1-ca1588784c80", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347291, "uuid": "edcfe19c-e3c9-44e7-9a18-ba445baca76d", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347291, "uuid": "c2c833ae-8dba-4e8a-a75c-54c919fef027", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347291, "uuid": "564ecc3d-ceaa-4538-aab8-8379d44adff8", "value": "AppleApp(207).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1afb3914-61f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342872, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342872, "uuid": "029553a4-2e59-43bf-bdd5-053a5524360f", "comment": "Malware payload", "value": "ae5fd5f483713e5490441825333644fc", "object_relation": "md5", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342872, "uuid": "0e2a63c3-4b29-4412-82f2-d5a6ed459baa", "comment": "Malware payload", "value": "88ac32e91a53c852ee024a1aac0f1e1fa29e43020427bde6986ab5c404bafeb1", "object_relation": "sha256", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342872, "uuid": "33eea3a5-c1b5-4b91-b860-f596857d3091", "comment": "Malware payload", "value": "7817f4091fd0c4fef2f30a6331a926b7176758e4", "object_relation": "sha1", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342872, "uuid": "63624c5e-f476-4390-9d90-5552f647b952", "comment": "Malware payload", "value": "c7ba36d979c1e12bfba50076b0fd8e064d5f2502dfff82c0aff30805455c3f4975650a2989daa29aece7e5e1ff1341e5", "object_relation": "sha3-384", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342872, "uuid": "4b000bbc-ece2-42e3-af45-dc408950355e", "value": "T1DE27222129EF905E73B29EAD5BC4B8AF885EF773170E71F9207217868322D418D91739", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342872, "uuid": "beef5682-07bf-4570-ac2c-59d619b3675e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342872, "uuid": "5964b45f-5abb-4d73-96be-b95316631b61", "value": "49152:VgPnkYckuOEUrh1w3BDXcydh7Tt0DwdShTonT8E0ei+TsJeKI4e338fKg0PExp5B:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342872, "uuid": "af59a860-c002-4e2b-85b7-2cc1debd1644", "value": 21964288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342872, "uuid": "67a49bf2-7f4d-4ab0-a3ce-ff5c2e038807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342872, "uuid": "20cd24c5-3e81-4634-9e7f-4ac27a368542", "value": "wireguardsetup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6409525e-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344283, "uuid": "38e81411-ff3e-4c56-818d-810184d7e963", "comment": "Malware payload", "value": "8c585de3e450032e34bbea0c0f8d9fbf", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344283, "uuid": "56398b25-a524-4956-b576-0e4fd95bef42", "comment": "Malware payload", "value": "899c38579770bdb456ece12d9b1dcf23acec813f28a5e92a8d1251bd27130789", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344283, "uuid": "33724fa1-cdca-4f7b-948d-d2e8b53ff02d", "comment": "Malware payload", "value": "15ca2482a51a8cfdeef41e52d86d9dad22cf693d", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344283, "uuid": "5f4ee9ec-d7d4-4a91-a980-c32439da6687", "comment": "Malware payload", "value": "a7e6e7f702ef39c08d9f43609095ab5eb44f993d1b1d8e00f3734f94b3027c6cdf3855a7469129bca11e32b3b4b3b0e2", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344283, "uuid": "37a941e2-46f4-47e4-9df1-12057a16697b", "value": "T154B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344283, "uuid": "678b58e3-5495-4d69-9a85-8be09c0cb89b", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344283, "uuid": "6e0ab8cd-1e40-4c3b-a5fa-28529241d608", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344283, "uuid": "5475fb65-817e-4acb-9eef-caaa00a68f01", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344283, "uuid": "9858a656-05fc-4e70-8472-5cb5f78b84b0", "value": "AppleApp(116).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456081f3-619e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696304289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304289, "uuid": "9d54beb2-6a36-412a-9eaa-3eef2d1532ad", "comment": "Malware payload", "value": "56e30f6c0b4f2ef33ced1f931e8d5395", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304289, "uuid": "741f0c44-87c9-4c34-9312-1ab4e3a95570", "comment": "Malware payload", "value": "89ba65bd88059d9fdaa5ca1d5acf2cba488418efcfbe23b4d331229407e90cad", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304289, "uuid": "94586559-568c-4b01-ad9f-f2072f9afc0b", "comment": "Malware payload", "value": "e2ccd314b3772725095f119eea132ba818cf3c9b", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304289, "uuid": "822b5143-347c-4d55-991a-3c2ce197763b", "comment": "Malware payload", "value": "b9fbc665908e223f7a9c25c0d26519ec02870636ba618073272c73d67521f8521325f1fc44414524f1e9df4d6b292f9a", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696304289, "uuid": "713cdf3c-dee6-432e-95dd-ac64f9cb36b0", "value": "T196E0C6C130281B12E3026AF820E72A017A718BAC3C6AA0A2B84A60887E103601E48AC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696304289, "uuid": "5dd451b1-4ed0-4473-9d00-c40bea308660", "value": "6:5j/mPBa8r5weCwZZ+jRwuYtDdmWSRWuJS2yp/1qHu+lhlXn:5j/QDtweCyACuqDdmWIrk/1qOazX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696304289, "uuid": "782c0ffe-a16b-4621-84e4-bec9605b9c31", "value": 335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696304289, "uuid": "46362779-f2a9-4593-8e6c-5a91eef81064", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696304289, "uuid": "7f979264-3ca7-48a5-98e3-01c2c0bd390a", "value": "Gestione652.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b3cdcb5-6193-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1696299547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299547, "uuid": "4527e047-47c4-459b-867d-a487d9fe3971", "comment": "Malware payload (RiseProStealer)", "value": "2bab84e1db225680a069f45e32d76cf0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299547, "uuid": "4b9834b2-e322-40b9-966d-083f2d45bbec", "comment": "Malware payload (RiseProStealer)", "value": "8a323c15d9371a15cedf914b75c2887a399d7372e0a0ed7107cec899b41472ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299547, "uuid": "70cf2373-595b-4719-ba3c-fd2459c98f67", "comment": "Malware payload (RiseProStealer)", "value": "14c4ab451af373f954f20c40dba9870e841242a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299547, "uuid": "0bca88d3-93f9-4e58-9da2-9db6bd9be4d4", "comment": "Malware payload (RiseProStealer)", "value": "2be487aef099a3eefae0ee50f2946dee9f2f72827eb08ca88842b27d30c5b12901fa575ba000885eb78f3c5084d9a113", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299547, "uuid": "aaffb81f-d887-48e7-9cc4-cf2fa09b5934", "value": "T1C546CF02B7A9CE12C16EA737D5E1141443F7E982A722E70F36C513A90E437EE4D95B8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299547, "uuid": "bd414903-f120-4a6b-ae50-f599080b8613", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299547, "uuid": "35fd0265-8e21-4b96-8922-81902abbcacb", "value": "98304:vslEM69mhcjLSWJGheLg3KpGOess+jUbay:UlWjzUaIMKt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696299547, "uuid": "2c234ca3-6155-47c0-a06c-d8b3f0016184", "value": 5465336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696299547, "uuid": "5cdf7d4d-0c6a-46c5-8446-bf6212e9a0f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299547, "uuid": "15f18c75-6b76-4b85-af5f-7c888309b8da", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13586e9f-621c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696358321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696358321, "uuid": "11cf0c84-f4fa-4454-bd94-c73f1105bb0b", "comment": "Malware payload", "value": "77228713b1ae12efaddd001535782c1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696358321, "uuid": "d02b2490-facf-4601-8c53-bd2a028a6d13", "comment": "Malware payload", "value": "8a6c6cf2621bc864fe773ead086f95b0d95a6d959f0920b59c571242ef5aa126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696358321, "uuid": "dab250cc-c77f-4082-8039-dc243e207f93", "comment": "Malware payload", "value": "a8270c88399a47d739289190f1a06da12d55afbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696358321, "uuid": "8e83b17b-38b5-4f94-9dd4-7c602e8b6cb1", "comment": "Malware payload", "value": "33ac170bb4bb19a24075b578e1a9579db0a87f024cc3b7ba9781bb2441d7df73589769812a41f8d48b4a5647c27fb20a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696358321, "uuid": "5206ff92-65f2-4ce5-8c58-2971b4b739a3", "value": "T101E42349BEAA92FFCBB17D723589988C673F924F2145DFF6D8C91848181FF18250924B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696358321, "uuid": "285c366c-45eb-4cf8-8b20-1912c5c0eb85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696358321, "uuid": "d4d2c64b-5e01-4075-8d7d-b66a7171321b", "value": "12288:AJysnoROJFmRp7OCy+RFS5p/IoGB5EErDIrQz+CUB8QvpKU8b6ZsZKpn6s+jfOF5:IoqMRp7OCZ2DGB5EErh2vp+OZsns+i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696358321, "uuid": "d437d5a5-0f28-4f18-a7b3-1820103451f1", "value": 662528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696358321, "uuid": "657d0f3c-e540-4573-befe-2722739c9c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696358321, "uuid": "fa72b18c-3e8b-4c7d-9254-0e48b0b54f64", "value": "SecuriteInfo.com.Win32.PWSX-gen.24110.16531", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c9618bc-6181-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291980, "uuid": "d3819301-ebbc-4d4a-96dc-6bb2cc2553bd", "comment": "Malware payload (Mirai)", "value": "501ba3e2db2429b1dbe6b1e86e97ca80", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291980, "uuid": "d340c92c-15a6-4fb2-9d9f-96c1e98fd59d", "comment": "Malware payload (Mirai)", "value": "8ad91ae8c2999dcc95567ce92fc901aa7c53fe351427366569934b3dba97a24b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291980, "uuid": "077e2613-f218-4b1a-8f98-379f5d5da487", "comment": "Malware payload (Mirai)", "value": "ccceb154341626fff4232ec7abfb4a9dc4776f14", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291980, "uuid": "c2657eff-7e3a-495c-8d30-9c0f625fb548", "comment": "Malware payload (Mirai)", "value": "41270085ec0013801d495d7c32d7a35b111672f7509037856127360d3100355a2ca2f5c89a60696d7ed1493002464fe0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291980, "uuid": "9b868cc6-f2f8-4771-9b43-bf2dc5b5b082", "value": "T1AB539FA5C5ACAE58CB1441B8B654CD398723F408A5A76EFBD646C796800BEFCF0187F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291980, "uuid": "37e77975-a962-4946-8cfb-c0099e2da6ea", "value": "1536:PaAtVnz1/mUUNztiYmW6ihiYLTofs3wfpWIDNEJ7JC7:P/tVz1eUUfwN0T0f+whWONEJ7J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291980, "uuid": "3baf2606-9395-4274-9089-2ff676469980", "value": 63772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291980, "uuid": "95ca7de6-216f-426c-a402-1d28a80498dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291980, "uuid": "fd074834-480a-4e66-a416-44b22c298b82", "value": "501ba3e2db2429b1dbe6b1e86e97ca80", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5843cb4-6198-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696302007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302007, "uuid": "c7feae25-91ae-4f4d-af0d-2569650fe150", "comment": "Malware payload (Gozi)", "value": "52aa02b4f67f2f504fcb991e6d094e58", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302007, "uuid": "11780716-45eb-407b-95d1-6839737ad8ba", "comment": "Malware payload (Gozi)", "value": "8bb04ebea49b92e090b777efedfa44c8aa881a5531a0791f7f2404d0d50f9963", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302007, "uuid": "22155d16-b4d9-4a28-94f9-ecfd67ed2e21", "comment": "Malware payload (Gozi)", "value": "87e772a1597eba6b20bb750fd79c9ac30738229a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302007, "uuid": "be368014-f6fe-44a3-b55d-63f9da0b0922", "comment": "Malware payload (Gozi)", "value": "51375b47fa597e5832fa2994de9c3b82ff04133f6164cdfee12d31638bc9778a5772e1bebe1a9823bf388cad4efff660", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302007, "uuid": "42df52c5-008c-4529-8ed1-2b19c9469338", "value": "T180C022184E4DC162C002580A9058FC88AC0EB8442DE6E8981280DA8A9C810D4DE08ABB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302007, "uuid": "602f03ef-daea-4dc6-9c17-fec4aadfcabe", "value": "3:HRAbABGQEb/5sQaOUlQx7+M1M7ovQvycAI9RyJ25YdimVVG/VClAWHn:HRYFJb/5sZO5NwovQvyc1yc54vVG/4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696302007, "uuid": "68298d50-b0a1-49b3-afb5-6164b9eb1e2e", "value": 192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696302007, "uuid": "c7b0c146-45b1-4660-968c-86225c3d0dfe", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302007, "uuid": "7af873f6-911a-4ee8-a3d1-3beaf8f3b528", "value": "Organizzazione.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36fd3dad-61bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696317149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317149, "uuid": "50ee0cc5-50c9-4705-aa47-1836e65febff", "comment": "Malware payload (RedLineStealer)", "value": "9faa65e4f6a67196a89a708d008cfcf9", "object_relation": "md5", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317149, "uuid": "fc92211c-7778-4c15-aa21-a060fffdb11f", "comment": "Malware payload (RedLineStealer)", "value": "8bda76536b382a15e8a88cb7b4bb9f41d24a0ab0749fdd293ad9aa08a3a46956", "object_relation": "sha256", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317149, "uuid": "d0968295-b465-4cad-acbf-633c270390b3", "comment": "Malware payload (RedLineStealer)", "value": "70311f0940fea7cc719fc85a363da95e11309a56", "object_relation": "sha1", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317149, "uuid": "2155afff-f12b-4ef9-996a-f8c48690432e", "comment": "Malware payload (RedLineStealer)", "value": "a00a143a04402d1a741bfaa3bc48d1d23fccf7a8ac8237e60b545948ace6663fcb58bc88536e6d84f3d21bb9fdf72575", "object_relation": "sha3-384", "Tag": [ { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317149, "uuid": "cd746867-18fe-4399-b608-8890457ed3ec", "value": "T198F4338EE276BB60981893E75E7A7D193C34BEB52E81357847273B135C52869128F3B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317149, "uuid": "4099a236-df87-4bb0-a1a5-3fb133660bdf", "value": "12288:oOXiKIvYWo6jHyZbvOqilLWsbQ9J+RVrt73PccuCzLEB5VY3KAb+5gbM+ACEDm3b:oCiKIn54LGvM3+RViC3E5b1uECEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696317149, "uuid": "7864b5ed-8cb4-4f0a-86c8-94d460bdfe88", "value": 777995, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696317149, "uuid": "9794cebe-3cea-4359-8ea8-998b084db60e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317149, "uuid": "008591e5-4846-4f97-add4-cd1be506f20c", "value": "#PO_Teklif Talebi - 1523 Dmreklam ltd sti 0%01% pd.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "766562ac-61c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696319403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319403, "uuid": "79438670-e38c-41b1-8aa3-4d825a365946", "comment": "Malware payload (Mirai)", "value": "da0762a7954707c94e323dfc6b1762fc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319403, "uuid": "7d202d64-9cb7-4667-a84a-b8724699ce82", "comment": "Malware payload (Mirai)", "value": "8c3bc733d5a7d6fc1fe1d19b840d5a40ab536c6e4102f7ca144d36d6f578c307", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319403, "uuid": "3b5a7ae7-38b8-4fab-9b14-821c99061afc", "comment": "Malware payload (Mirai)", "value": "8967ab290d62fda562511a9e27a1bae4e8a6775a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319403, "uuid": "cba60fd1-0801-4378-ad8f-e16e5fff84d9", "comment": "Malware payload (Mirai)", "value": "db703d086da2301cd9c67518e659b7fde06203aecd171dcc98606a1b6d76af0424546847a683561a810fc1ab089d9b13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319403, "uuid": "0d156398-1ae8-40e9-bf59-4dc9c19af84f", "value": "T10833F135C27290358E40747EC5644F8BBBB5E3E4E31C38E209529E9CDA640D26D9F99F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319403, "uuid": "aa47e543-5a21-4f77-aa89-80ef24c06e47", "value": "1536:tajdmwVe0jrED9E00LxhhESZbjdJGI1Kt:tsdmwfnEsLLKCFEt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696319403, "uuid": "f42ca321-d07f-4790-9b54-f92239a269d8", "value": 52704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696319403, "uuid": "010464d2-4fba-4a12-9eae-81a864c16b4c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319403, "uuid": "fd6274ff-4c1f-4f18-8dce-cd8cf14940de", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f37a84-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696357175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357175, "uuid": "91c4ca52-2bd8-4aae-aad3-cd861c20ed14", "comment": "Malware payload (AsyncRAT)", "value": "07478a5c4795897c09745378c750f8ca", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357175, "uuid": "6248ea7a-0883-45c2-8dc9-bed3b0f4e8fc", "comment": "Malware payload (AsyncRAT)", "value": "8c8aee950d1420d409169010b6a9e475c2d0d78ecf9c6d31a3a7542c15735e4f", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357175, "uuid": "8f159a61-9f09-49f3-9741-f78b8d498512", "comment": "Malware payload (AsyncRAT)", "value": "1ae0911fd5fa57d1b94ecef287af30d4845c3019", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357175, "uuid": "2d6f9a20-3527-43db-b95b-f2afa28e81ec", "comment": "Malware payload (AsyncRAT)", "value": "881bd29f4372c4da40c9c446054b1555eda8b4be20d05e1769c58f6a559cd9afb1add2b9afe8fb63ebca7d2fda8e6705", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357175, "uuid": "c9dd1e92-6b50-4087-9370-0578793352d3", "value": "T1A5E4C052B28588B3F2231C364C2DE76164BA7D301A24E91D73993A1E49B135163FFB6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357175, "uuid": "09ed2b0d-9aab-4eef-bbb0-fd919aae24a2", "value": "00be6e6c4f9e287672c8301b72bdabf3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357175, "uuid": "ff3c78ff-e7df-4447-84e3-b3e26b8c51b9", "value": "12288:JcrNS33L10QdrX4FBojL8DPNYnzENFuUftj8Y+JxeIlTPYQZjDa321uz:0NA3R5drX4GcPNYo7vljEUIlLY+Da34K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357175, "uuid": "9d106278-1cc9-4637-af79-def8ca83cefb", "value": 682808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357175, "uuid": "7fc52832-272d-43c1-bd55-9c4eeecd49a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357175, "uuid": "f308ab25-e70a-444e-b475-c36e7e778c54", "value": "Odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "987ec94b-6181-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291973, "uuid": "461d0a91-9dd9-44a3-bb35-652691a57760", "comment": "Malware payload (Mirai)", "value": "4af6fc9e4de5706f989cc31ee1240b48", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291973, "uuid": "aef095b9-6e45-41e1-8f73-fe70b767c78a", "comment": "Malware payload (Mirai)", "value": "8cafc42667cfb46d34b79fb83cd026094b7c6fa3b28a3c7c192fb33299c056aa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291973, "uuid": "975b9403-1c3c-4311-a10d-e5dd2e249342", "comment": "Malware payload (Mirai)", "value": "0252e64848e8683ed33de12d92d043a2b81a9210", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291973, "uuid": "74e67712-2746-41f4-b02d-ccee79386fdd", "comment": "Malware payload (Mirai)", "value": "53a34d4167b28cfbf16be43069d5b6517139234d6e5f068d8db0bc0da0c08d4010de01f1b963da7cb4e029de21c11c04", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291973, "uuid": "515d91e7-151b-4afc-bf05-965872d1860f", "value": "T1E4E2F193D366A011CEB82BF1F96985CA2BBC4EACC57770A3160456282D9B0435B3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291973, "uuid": "1c405835-0071-456b-b09c-d5f2191b373a", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9XZfq9q3UEL5IF:Porm1vpALgUJZfLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291973, "uuid": "67611803-c1c4-4df4-87c7-635ffa6b9572", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291973, "uuid": "e5c56045-673d-4078-8988-37101c97f226", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291973, "uuid": "eea1da9d-c666-4f2f-8f27-acb23726db8f", "value": "4af6fc9e4de5706f989cc31ee1240b48", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "caf89692-6228-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696363783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363783, "uuid": "f5cae301-259b-4737-9af5-7a0ae410f7ea", "comment": "Malware payload (Tofsee)", "value": "d8c9522f741314f1c024e6755505ba9b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363783, "uuid": "31053c9e-d3a2-42fb-8930-b45baba3dd19", "comment": "Malware payload (Tofsee)", "value": "8cc6e4b0743c271876dc08734181e36c9e1fae263b3bfff8a965afbc1f27e4b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363783, "uuid": "be0137d2-76fa-429d-a822-b1822a0f0f20", "comment": "Malware payload (Tofsee)", "value": "e22346e1cc79848ea4cf029632052fdea401a129", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696363783, "uuid": "a9ef2b8b-b9ad-4df2-997a-4ecef5e9c2d6", "comment": "Malware payload (Tofsee)", "value": "899b1ad44a55192a06ec7955742373b7173c262dee3fe209f3d4e218bdafe21338f57130355c3b8a41d96580823aa1ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363783, "uuid": "1cb5e137-481f-4eba-8bab-ce7bc80843e4", "value": "T12654AF1372E0AC71D4725E319D29C2E53B2EFCA19E6957DB33587F2F48701E19A62B02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363783, "uuid": "b9ad68e2-5bed-431c-bdc9-4f8675aa10b6", "value": "4a68060be2303bc791c841045bc41876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363783, "uuid": "93e4b8be-9e8d-4b92-a464-71ae8d5db889", "value": "3072:huvOnOPudVLPLRuCxlESptTB/ubOKzzW9i6GldWyec+uPys3W3g9Y:MOnCu7LPLR1lFtTllKzqs6odWbMPy3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696363783, "uuid": "8ed996f0-fe35-4761-937f-f34266155ae8", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696363783, "uuid": "666d0c74-bcdb-42fc-a363-f59dabd42297", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696363783, "uuid": "a19bde6c-2cea-43ab-a9e4-229ee8fac063", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a931db-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696345868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345868, "uuid": "f2da9625-aaa2-4350-a461-4b4df96734fc", "comment": "Malware payload (Mirai)", "value": "2f249e95bac680ff4634ac9b7a3d3e03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345868, "uuid": "bb4aefe0-19e5-4ce8-8c8a-372f2efa00b2", "comment": "Malware payload (Mirai)", "value": "8d17ade466790eda6039058eb2dbffde9135dbbb09cc7745edc19258321813eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345868, "uuid": "46a94ab3-8459-43f3-840b-50d245726d15", "comment": "Malware payload (Mirai)", "value": "22e058956f2c2fe37f6d3b7b1356d8b5878db44a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345868, "uuid": "4db45029-a7c5-4e22-8c56-09181e86ec05", "comment": "Malware payload (Mirai)", "value": "40db6a813e2eb348afbc12984eeeff66701b210dce8c9198f524f36279922b2f40322f816e1833cdd5b3cb615d042809", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345868, "uuid": "f4638ce9-f409-4fe7-956f-3cfab038705d", "value": "T159B2C1A49B91A706C2F0B435937C8F926A3715E0C5F63877272082BC998559633FC6C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345868, "uuid": "52c91035-1d41-4698-80fd-1e483c296560", "value": "384:4C9KXlJIDFUS0Mggks3aIrokYVDoDDRRKj55N7LB9U+BSjzhymdGUop5hu7z:4C9KQFH0rs3zWoDDRsjt7LB9U+BSHs3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696345868, "uuid": "e81fbf8a-6d3a-4da3-9d44-1fd74e1e3ae7", "value": 24536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696345868, "uuid": "56f63603-4264-4ebe-892f-c596cb847ba9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345868, "uuid": "5a971772-8aa3-47ae-98df-2d44345be216", "value": "2f249e95bac680ff4634ac9b7a3d3e03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fff93949-61e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696333808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333808, "uuid": "054e649c-db89-4747-8eb5-88284bb2926d", "comment": "Malware payload (Mirai)", "value": "704b5a27489db42655be0877dc111dcb", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333808, "uuid": "87ee864b-e6c8-4b2a-b24e-2b3e85aba3ee", "comment": "Malware payload (Mirai)", "value": "8de1d63e6c56de67548988aa60a0fd7e42a85109ca3b789a1b72c9328bd96510", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333808, "uuid": "33903cd4-0ad5-43af-acb2-95441330b499", "comment": "Malware payload (Mirai)", "value": "a986f788f44626ae0869f3ee127a45b09b4b7cb4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333808, "uuid": "2bdd7ce6-ab6a-48d4-8d9b-be1ebc1a85cd", "comment": "Malware payload (Mirai)", "value": "2fdafb5c0015cd4efb133ccbc20812f713827249d5aedd52ae2956e02fbac4afeaf650e398d7cd20e8cc5527458c7b87", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333808, "uuid": "d283daa8-0432-40b0-8b35-b4e022ac7cce", "value": "T1B8C2D070A6AE2CB182500532F7B857C9BE530F7DFAFA3C90114057BB7941D451ADA9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333808, "uuid": "2a71842b-5322-4374-bf13-d2666083c428", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEEOExhymdGUop5h8:A7soTAZ3alkXLvFh8nNEEvxs3UozK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696333808, "uuid": "a3191683-e0cf-4100-b7e7-cde83b165ab8", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696333808, "uuid": "4f1b8bef-cf51-4457-adf1-c3a83db94ee9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333808, "uuid": "e9f728af-2c6d-4f08-a773-d63065577202", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76dc4b6f-61f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696341308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341308, "uuid": "6ae6a99f-85bc-441e-9855-aca5a1d865f4", "comment": "Malware payload", "value": "b07dd5127e1c5e569d135b4d24d53d18", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341308, "uuid": "2a3f3441-a0c6-43a8-8077-c026e27d195f", "comment": "Malware payload", "value": "8de319b0404a7b9d8f988acea01c94022fa9fb2852db22f0d46686292fab6ac8", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341308, "uuid": "ebfee66f-e223-4162-9e73-6154e4c15cb9", "comment": "Malware payload", "value": "6d375678164ceaddbd1fc98484f3ee537f770704", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341308, "uuid": "88ac1884-ddee-446f-92fe-ca84ef9c69f4", "comment": "Malware payload", "value": "a311276278dfa5da01857ebb33f5fb7f1ecd07f616bb6e785e9ada1e46f9a52fa274e3089f41c0e7ef233ebce287f39f", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341308, "uuid": "e86b67a3-0cf9-4135-b171-0f50923a3e10", "value": "T130B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341308, "uuid": "f925b0e6-e357-47ff-8358-feeb00712013", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341308, "uuid": "300af579-abf5-4a93-86a6-3b5f86d91571", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341308, "uuid": "55c2a716-dd08-414c-99f1-7742ea38a748", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341308, "uuid": "cf07cebb-c8c0-4882-80cd-69446c56b048", "value": "AppleApp(63).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71d104f-61f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696340128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340128, "uuid": "3e4dcca1-7ce3-4c73-b849-5503afdcda88", "comment": "Malware payload (Formbook)", "value": "ecade0af264b3a1f7d3a91a54c8aa4c1", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340128, "uuid": "6040a59b-f056-44c1-8100-0dbb13fc7853", "comment": "Malware payload (Formbook)", "value": "8e1e47e161fc665ab7b9ada82b9d9e348a058ee865982035c27e758409714f60", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340128, "uuid": "f2ee9ecc-abbe-4778-8bc3-9561cd9463f3", "comment": "Malware payload (Formbook)", "value": "1c8a6fd038e391527a4e0fe497bfedf3b3c33457", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340128, "uuid": "6a27797b-4b2c-43b7-bf4e-f2a8efe0c79f", "comment": "Malware payload (Formbook)", "value": "b1f385f7ac737b63289b3fe29a435ac3ede8d8356616b680012afcc0b72d0f5bd05c3abfa65a62ac51e42e48ab9c74ee", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340128, "uuid": "88a5b1ce-a3c1-4971-9209-3364a5eb298d", "value": "T12E813B37E70D555FCB628BD3DCBCFF2A81F4B11781CB90904A32DE6209672A65D0A8C6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340128, "uuid": "842fb70b-fcb2-4c79-b42a-a5d939d0b048", "value": "96:fqeRa1TrK2WI3v0Ty5iKCYKPn6JtW+0lOeots1yLWTl:S2a1/K2WIfMWaotWXlDoWd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340128, "uuid": "ebc0e161-bfd2-4279-a09d-0c02821eef72", "value": 3840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340128, "uuid": "f958823d-1416-4afb-abaf-99bbeb65ac00", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340128, "uuid": "fbcef862-f11d-411b-b06f-667581885cee", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.22769.14377", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90f2d0b6-6197-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696301409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301409, "uuid": "6c80ecb6-362f-427c-b36f-680b2ff6f36c", "comment": "Malware payload (Mirai)", "value": "3c349769ff9da855aa194d5e25aff056", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301409, "uuid": "a88cda92-afcc-4642-8bb5-014f15a36fc8", "comment": "Malware payload (Mirai)", "value": "8e65e8ce532712ba0b541d36d509aba6d94b26625531c3689d3008272224ff65", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301409, "uuid": "0fa9d09a-c3c8-4854-a4bb-8edf8ccbf6e0", "comment": "Malware payload (Mirai)", "value": "c1f1e2d2b4e3801439bebfc75394592b8d61ec52", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301409, "uuid": "64e8fc9e-4e4e-498d-a963-f7de0b5776d3", "comment": "Malware payload (Mirai)", "value": "2cf10ec54cd2c9577d9ab4398be733008c85e7e2804509bcb0e79e1cb83320d68200ba772e1a5f8c336696a1e357c38e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696301409, "uuid": "8e03538b-a447-421b-b404-7ccca2e7976e", "value": "T1B3C2D03096AE2CF6C7100532E7B896C5BE520FBDFAFE3C9011415BA7398191529EA8C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696301409, "uuid": "6cba6a67-2786-4b16-a9d0-295b2ffbf0c5", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEXt6kNxhymdGUop5hF:A8soTAZ3alkXLvFh8nNEMkrs3UozD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696301409, "uuid": "0cf6c58e-72fc-42a1-a5be-bb44ac70c98c", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696301409, "uuid": "85ef7410-5d14-4ba2-a9c4-bd386ffd22a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696301409, "uuid": "ebcd7ddb-632a-456d-a3ad-0f90d2640d56", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ca4c86-6200-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Pikabot)", "timestamp": 1696346407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346407, "uuid": "6194747c-3fe9-44b9-b723-62cb83dc6736", "comment": "Malware payload (Pikabot)", "value": "e5e48e4619d951e0dd6d7bfd613bb109", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346407, "uuid": "3e3cc291-d43c-4eb2-974f-21c60809e1f6", "comment": "Malware payload (Pikabot)", "value": "8ed71986b28af6facf58d6d47d1190459d95427d0b0d92f32b25de3cd0755f2c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346407, "uuid": "ee53bb74-90a0-4f69-a362-18c8bf812a2a", "comment": "Malware payload (Pikabot)", "value": "308a7cb97bf20596adc697107c7a89fb34bb7224", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346407, "uuid": "74d2ad36-9d9e-40a0-ae60-741b2a8e2f56", "comment": "Malware payload (Pikabot)", "value": "721628c6f5ffaaf2e969d62eee9d07fb9f5e1dccbec58775b6e5992aecc98f7e5a8ab6a9f624c6724fa3326b6eff764f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346407, "uuid": "64e3d4da-dd7f-4fd1-a865-bf63b3774667", "value": "T1B095592DFAC97FE3DD2360B3A121159099DCCC469B52EBA3C5916733B65A33C9CA7240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346407, "uuid": "1710b91c-cb44-4af8-8c1e-75be5fe7b0e8", "value": "244d8f9f2c625c07accc7836974657c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346407, "uuid": "ceebf925-f8a2-4a79-b933-a0945581c92a", "value": "24576:FSfBk+9Zl7pC4HE+Y/lU/Z46vVJkWuQpJ53am1u46FxVDmdVxoejIF4UAVddHctD:6kFhgJ8m1u/CVxodFSfd+WC9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346407, "uuid": "7bd4cd95-ab40-4e98-93da-284359f95b6d", "value": 1887784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346407, "uuid": "675d34b3-4c5f-4514-9717-9d19032edceb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346407, "uuid": "28718969-c744-416a-96da-2336b4b22c64", "value": "123321.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b078a7a5-61ac-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696310481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310481, "uuid": "283bb4e2-1a54-4172-ae9a-dad67deeee93", "comment": "Malware payload (Tofsee)", "value": "5b67f2c18b61f0fd4ed4343a7e5f3c17", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310481, "uuid": "24e5f804-4948-4919-8897-df488831505a", "comment": "Malware payload (Tofsee)", "value": "8f10b0bfd5cfecd77dc53dffb7d1e330c16066e38561eacd1c189a1f2b23f75e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310481, "uuid": "5241e450-cea4-443d-83d8-923fe54ddd14", "comment": "Malware payload (Tofsee)", "value": "4229dbbb3278f547976e13401bd1c19d27a37c71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310481, "uuid": "c5808496-9e07-4906-8260-687f0f619622", "comment": "Malware payload (Tofsee)", "value": "594958efe4e27d4e0c8f76eece1281d876135c1e25cce81f509ba2f0f2bb254a2be9f42291093d5188b73297d8556112", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310481, "uuid": "d5a102f6-f648-46cb-beb1-14a5df25774b", "value": "T15954AE0272E1EC21D4721A715D29C6A53B6EFCA1DE6A17DB73583F2F4CB11E186A2703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310481, "uuid": "89d4ab66-d094-4861-9f22-377965a13150", "value": "22101b09b25f37226d51fdc3f87abcff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310481, "uuid": "114bdf62-08e2-4243-8534-82a117f40188", "value": "3072:0FyUWKBCrBhus7m7dW0zO0jj2rHMzndb2l0v1hil7w:KyUWECNhus7msCfjj24LN2l0vDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696310481, "uuid": "c884ef08-9e4a-49eb-95fa-1cefcfd3de6f", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696310481, "uuid": "5e0e1f5c-038b-43bb-a569-dcb002575742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310481, "uuid": "881729bf-f1ba-407e-9dde-811217f243b5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3867683-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346108, "uuid": "fa8426ca-1153-44bf-b559-aedd50a9b654", "comment": "Malware payload", "value": "6342c1c7a7a9ccad85dec92cd9abe4a1", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346108, "uuid": "45999f00-dcb6-4802-8f77-dd9c8cc3c47c", "comment": "Malware payload", "value": "8fe946a62bbeb0efc73ad94d18408aeebba9d4ffa559932799ff67286fa0c2a6", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346108, "uuid": "369dea2e-f5e7-468e-a677-fd428cc21966", "comment": "Malware payload", "value": "dd8a6b4dfd001bc4b1f7ef9dc606b36a878d0591", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346108, "uuid": "beddef83-3073-4e41-97df-111e38da4a4d", "comment": "Malware payload", "value": "69aa1c06b2373c4dd78f66feda061aecffe47f4a9e415065d557d4c7dc44af4ee46536acdef4a6049d4c6fea2364e8fa", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346108, "uuid": "bc915278-1e02-4079-b7c9-b3eb8c571ea5", "value": "T107B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346108, "uuid": "b9e66a65-bf49-4975-907d-42b9d7e69973", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346108, "uuid": "03d4bdae-ff45-4c24-8ac6-62997de0cb20", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346108, "uuid": "9147c243-1761-4c55-a51a-e8af0c312925", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346108, "uuid": "4b7ea921-2da3-4c5c-a1ef-2fed1b8432c7", "value": "AppleApp(179).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd9496d1-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696356943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356943, "uuid": "ed480aca-6774-46e6-9f43-e63d872cf1a7", "comment": "Malware payload (Formbook)", "value": "72c0bc2015dd196542efb985568dbbb6", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356943, "uuid": "83c01edf-c54d-4f0e-ad01-51c162379859", "comment": "Malware payload (Formbook)", "value": "903a59fc3dc873833d79a8a6f343fc5d23b23645e04dfb62762e7317063fe5e2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356943, "uuid": "bdd8fb94-8de4-40eb-b1e8-eeaebcf924f4", "comment": "Malware payload (Formbook)", "value": "fde673dc8b91239b9df546c34affe381618411a0", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356943, "uuid": "2fcbbbcd-ab7c-47fe-9479-c357ac2b1dd3", "comment": "Malware payload (Formbook)", "value": "c5ff6f02121eb3202652ae76b0289962c47eb801eb576650aa55d750b8c2baad987b7a078943b3f782f123a2f48de248", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356943, "uuid": "79d53093-49d1-486d-b0c8-d852672b3e1b", "value": "T11F55E00F9564AF86C00983F86E1339951F0E7F19A7C169DB14673B8B3E307A219CA6DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356943, "uuid": "b292c23b-0818-4e1a-ae2c-87dfeac5278d", "value": "24576:fWQmmav30xyw3ZyNw6VAAXZSNi3/ZyLw6VoAXZSyvdq5bzMgTAxhQxc+iv3wxx:OQmmQ30L56V/E6X6V3EGdYzDTlBiP+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356943, "uuid": "d57235a5-42f4-4e76-842a-4c1ad0e91db6", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356943, "uuid": "e9af5153-1364-4927-b8b4-5ad6d4235e0a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356943, "uuid": "ec6b16ed-7836-468b-88af-8e4e641faa03", "value": "221036299-043825-sanlccjavap0004-6531-1.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c85c4f24-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346170, "uuid": "5eaf111f-c21f-4d2a-b11c-fe0ac16d8434", "comment": "Malware payload", "value": "d93d03ef4daf846fa4517907aa621fcf", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346170, "uuid": "55251854-9a36-4068-a2a2-2dd77d55647e", "comment": "Malware payload", "value": "90c8e9d71ef18e3416e0384908bde706ff6f2cbb9b73137f793aa18eb1e5d8ae", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346170, "uuid": "8b823dd7-07f5-43e8-808b-019085b122ef", "comment": "Malware payload", "value": "d1504f909afc9e82fa54bc75e48da697e661edd2", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346170, "uuid": "6bdfb0da-3132-4963-8fb7-085ee1b976b5", "comment": "Malware payload", "value": "a959c8621f50d0c68b53c6738f4a62c251d1f2592dc47407ed38a4e4dbf294d3a4e91519d5402c8c96a34d134168b0c9", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346170, "uuid": "fafdeaba-cc2e-4844-9145-de59fbb79af2", "value": "T135B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346170, "uuid": "180cd14b-a2b0-4306-9ccf-5f9bba1d2f9f", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346170, "uuid": "add0b4bf-579b-4cc0-a4fa-4f93f3e17703", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346170, "uuid": "61c92d98-6b8a-4d21-b99a-f58f24bbf02d", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346170, "uuid": "4b2b5e70-c2e9-4818-94f7-58c104da6ce1", "value": "AppleApp(160).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b356e91d-618e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696297601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297601, "uuid": "f0c8d401-1654-449a-a564-c47c8a77b764", "comment": "Malware payload (Mirai)", "value": "b030a1ce84923325c78d24d1d3f25cb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297601, "uuid": "cc4d8e42-6f49-48f3-8e22-fa2df77dd011", "comment": "Malware payload (Mirai)", "value": "91699fe260cfe3d8b306b1f1cdc2ff61c43f2b9b91f63b23f38d72b24154be6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297601, "uuid": "2fc16bc2-1b68-4db4-a631-ea51919b24f9", "comment": "Malware payload (Mirai)", "value": "88e3541f5a47f4e778007cf7489e31ff5e62771a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297601, "uuid": "d6960c27-be0a-4a11-9829-56819f7c18f1", "comment": "Malware payload (Mirai)", "value": "aeb9c20fd0e48146574d4eaa4db699f42cca2e0b747b5a4479b144ab4b2a944de1d48adac3376bb7a72777484bfd06ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696297601, "uuid": "a1a8cc7f-bd91-42cd-bb83-1e60fbc70d7c", "value": "T17713F136A3848967CE399C364A319BC9F34C9BFD83B5B17D561A89E06FC11C1A62C532", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696297601, "uuid": "2fbab08f-e9e7-4d7d-bc34-be9a0a555003", "value": "768:LAETdTUjhTVFzBOoVELmB9PjDFIrhq3UIdql1+YO2AHlTQYDL48y8VosSv:cETdTAPhImBBDFa1KD/4JnsSv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696297601, "uuid": "641da279-b050-4c5c-bfa1-2e5be8215fc4", "value": 42792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696297601, "uuid": "97c3e0a2-d0df-46e4-9e7e-769135c5d0e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696297601, "uuid": "f5c7341f-bca3-43de-9fc0-d89905f32c03", "value": "b030a1ce84923325c78d24d1d3f25cb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6676f19-61c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696321685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321685, "uuid": "fb17e71b-fd99-4943-bf97-6dc8c7651ad9", "comment": "Malware payload (AgentTesla)", "value": "d841e73866568b599806d180cc3effa2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321685, "uuid": "30aa9833-8a60-4ff4-b172-ea5a301bfae5", "comment": "Malware payload (AgentTesla)", "value": "91ad210dae91d724c701330e1ce8fd5047b8ee7a475d1dcc1474a812cab351ca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321685, "uuid": "2fa1786c-c9b9-4270-b445-7e0d230a0e58", "comment": "Malware payload (AgentTesla)", "value": "148cdc793d63cf6bdeef154cba4cfa85129a594b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321685, "uuid": "c7268700-fc06-4f72-8e16-c388fee7b591", "comment": "Malware payload (AgentTesla)", "value": "8cd0030ccd18803034f4a528c82cd7d791bb1968d5d1ee7200511e6c3639b494e3d824b59be500bfd7b9af408923d332", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321685, "uuid": "932466e1-7dbf-4c8c-8800-2720cd8b38ef", "value": "T12864F81857585565C36F9234E051220DFEF0CA27A38A9B8F9C40F6FA9D6B7C0BA035E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321685, "uuid": "4311987a-16a7-47fc-a1c6-b65f5c9e90b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321685, "uuid": "064243a1-f3a6-4fbd-8f2b-b449c9af8787", "value": "6144:QZvY9ZG5JdAPshUr34VKAbinQeeTwVfRZqZNTfKSK:QZvYmndYshUr34YAb0hcByS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696321685, "uuid": "edcd39b4-2a35-483f-bb83-d309d9f978dd", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696321685, "uuid": "9a7dda02-03b1-4ddc-bbfb-c579f53f6e4a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321685, "uuid": "d9f75365-790c-4774-8121-ea2df99993d9", "value": "TT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7be9f21-6180-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291569, "uuid": "c2b9657c-d8d0-4e77-810f-c1a1e40fb416", "comment": "Malware payload (Mirai)", "value": "bc9361de6be083bd4d6ab6761885b938", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291569, "uuid": "61864c01-0120-4b0d-a107-1c5dee1e192e", "comment": "Malware payload (Mirai)", "value": "91f0326f6113794e6b6827af514d4a653803e6ca9cf9834eb51e531b2513f314", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291569, "uuid": "0b4e6595-b877-4b23-89cd-c719fc9e4617", "comment": "Malware payload (Mirai)", "value": "3975b1eb9e47f40ad0dac3d344b86a0ac8cfc8b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291569, "uuid": "b18e3ca8-620a-45e8-a526-be537cd56f81", "comment": "Malware payload (Mirai)", "value": "8cb4b1937d165bb1de331c6d737f821742891724a55edc60e4fcb228df2b202e9ce5b54d38826588abb35991b754abf1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291569, "uuid": "66c71ee2-d664-42bd-81f5-4ee714dade27", "value": "T15CD2D03081C7AC40F3B0253FDE9A428B77E1597191FAD2B31E54A9AC5AC684773B52C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291569, "uuid": "f10f0eac-2246-4384-b748-e702b70cfdd6", "value": "768:QeDw0+mgJQ/iwhBOcKff7dyGEHqsVsf+ZZhGdXO9s3Uozm:QV0+hYVBOcKByDHqbf+zQOAzm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291569, "uuid": "d8f66e22-c75d-4aaa-8dd0-1801d7836b5e", "value": 29492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291569, "uuid": "dc518d4a-e746-4687-881e-6d91b335c458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291569, "uuid": "76bcdba8-d933-46f5-b583-62f8faf082cc", "value": "bc9361de6be083bd4d6ab6761885b938", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb508581-61f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696340162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340162, "uuid": "c0933cd9-db36-4ac0-bf8d-66b1a0dc9f53", "comment": "Malware payload (Stealc)", "value": "199668462be2edab3dccf4fd318cc672", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340162, "uuid": "40e0aaff-744f-45fe-bb0d-2c2320f857f2", "comment": "Malware payload (Stealc)", "value": "9200a8a400865b02e3ed94fbaaf553bf6c7b52ee8d50fcc2671c2f41c1513812", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340162, "uuid": "b8a254a7-68d0-49ab-ade3-c79da384e158", "comment": "Malware payload (Stealc)", "value": "36e228f9c499eb8a77eef9eec2fd7fa188c8403e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340162, "uuid": "c221ec38-5066-4a1b-8197-aa8a649a294f", "comment": "Malware payload (Stealc)", "value": "19ca4b97a941db5ef9de206be6f7c2a6776003750fd0135eba890c3cd281643151db75d99aeaba4448e0066740ee1478", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340162, "uuid": "b4f08017-860e-4a21-8e05-dd747b7f27f3", "value": "T105F522087B4E4663D29EC77BA4562041C6B0CC12AB4FEF5F5C8572E86993340FA5A3B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340162, "uuid": "8dfd3d8e-8243-46e2-bf5f-c2b7f7f4a390", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340162, "uuid": "61ea2e9b-55cd-4f57-95bc-5b26415875b2", "value": "98304:Z17NGWdUu8oibIXPkfqIkQ9n2N7HhyN2mTBNS:bBGWdU9feQQLhtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340162, "uuid": "7d9a7ae1-b70c-4b95-99fc-e6456ffd59f4", "value": 3326976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340162, "uuid": "4828d686-74e9-4307-a288-30a9851fd0b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340162, "uuid": "c53451fc-1f96-4c45-8439-38ad3fcb1ef5", "value": "199668462be2edab3dccf4fd318cc672", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29bbafd0-61af-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696311544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696311544, "uuid": "b26c6789-48fb-4d00-aa0d-157b80235b1d", "comment": "Malware payload (Mirai)", "value": "78bf8923e2f892b3d3c7275c0c3d6aea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696311544, "uuid": "d69a310c-933e-47fd-8d4a-97f0f1e7da9f", "comment": "Malware payload (Mirai)", "value": "925225df35216ff5c88570b5ba4f6988af706f16db8df1db561fd255bdd5c4f1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696311544, "uuid": "8bffd051-b98b-4bb6-ab41-5fa85c24c2d3", "comment": "Malware payload (Mirai)", "value": "3209d2fb4e39a85918f2255849869b9d3ff851c1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696311544, "uuid": "fc301937-67d2-4de9-aff1-dcb025020803", "comment": "Malware payload (Mirai)", "value": "794d81a5b2dd7cf05591f59fb38b46e440bcf5059a3ea02f82f5341f2724ff87e700301ac5d41615bc4699272eaa1280", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696311544, "uuid": "dfa0df00-85a1-4a20-ba63-ea6d62c22c78", "value": "T11673641E6A21DFFEFA5C82340B738E206799239136E1D6C4E25CD7185E7024E685F7E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696311544, "uuid": "4137645e-f37a-4190-b5f2-7b0af960ab5f", "value": "768:SPtLV7wCFXivQbCKNG/Ue3/gzKrVPqnDU5uygjC24vS0OppEV2oyxEdec+e1kIVh:IRLhzO/m7H46d6Bec+QkYKBS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696311544, "uuid": "f424c047-b297-4444-902a-ba7dc8071fdc", "value": 79244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696311544, "uuid": "2dfd8d78-631b-4d3b-aa8d-10a22a385309", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696311544, "uuid": "920571bd-bf50-4281-b96c-8ef753519786", "value": "78bf8923e2f892b3d3c7275c0c3d6aea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aac481c9-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696340966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340966, "uuid": "f2ce3ae2-4d45-4167-a5e2-b1fa65fc0aee", "comment": "Malware payload (AgentTesla)", "value": "a85e29b40df4054660e2172c1623f5fd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340966, "uuid": "c635e3c0-af55-4d65-858e-ecafbf548456", "comment": "Malware payload (AgentTesla)", "value": "927d6879bbfa7b3ce300974d8721f89a7cbfd6978dc9b22339eec12fd424a460", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340966, "uuid": "dde5426f-e2af-400c-8061-66d77b4b735c", "comment": "Malware payload (AgentTesla)", "value": "54a73675e5446bae7a7f476082880057f2d9784b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340966, "uuid": "ca483219-2a68-4a77-a798-6f7eb8d3c929", "comment": "Malware payload (AgentTesla)", "value": "6ef4759fc30df9fefc5262c1d45667ba50b8022db42a31a5cc7f98a2c35853595ad5dea3b8990487f1f3b1193443f340", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340966, "uuid": "0068e537-23d4-4ac5-a96e-324aa49df63c", "value": "T1A9E4120A36BC06BDDB6ACA7E0272445603FF6105AB54E79E2E8728CE7CD27129741F53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340966, "uuid": "5cf77bfe-f4f7-47a2-8e24-68c79bac79fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340966, "uuid": "b954a434-37dc-4678-8398-f63bbaa205b1", "value": "12288:OZ0iSAx5PWPQrxWG6r+tP+8+kWNlcD9t9Sk5ITQwvOeT+mAoN62IOCtGEfGJkqLl:Ou7Ax5uPqsduPH6lwMh4b63Zi3O5koS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340966, "uuid": "7ad534a4-557d-410d-b104-a9d343bd33b3", "value": 713216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340966, "uuid": "ed3a3d90-9972-4f23-a057-4b5fc46e9a7a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340966, "uuid": "42585cd1-7677-461b-a2d9-6f787a9ae1b4", "value": "Payment Document.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b37843a5-61f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696340122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340122, "uuid": "cb2ad47a-6b0d-4dfb-96ff-fa0b264e4f64", "comment": "Malware payload", "value": "491d4de4fe5b4ff4e6656ba965c10b26", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340122, "uuid": "0c27f668-d783-49a2-90b2-0b52ab908035", "comment": "Malware payload", "value": "93e65e65f04227c980035a12da31248bf29289690f879d574da775d447eb885a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340122, "uuid": "d8aa1cc2-ad38-408a-93cd-61fa0e2be38e", "comment": "Malware payload", "value": "3bf19779ab511315eb830e82eed8bb2dbb84ba35", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340122, "uuid": "912f6d71-6ed7-4bb5-b7fb-dcc979c3a8e8", "comment": "Malware payload", "value": "9db015b80ccce33813a65b16da3c0e2f52075358daf8b04f8922fc39e485493ffa10e7716ce70cd854423dcd959e9add", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340122, "uuid": "5c8e7a5b-d865-49be-9b31-c5bbe9040385", "value": "T11B531A56BA819B11D5C1127AFE1E124EB313077CE3EE73226E24AB34778746B0E7B416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340122, "uuid": "8fb19178-f5f7-48df-b963-25f1f8501865", "value": "1536:L8niqslntU2xa6xddDzM9i1aOINakwT7zt5YY8y:n7tU2xa65wOINakwTXtmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340122, "uuid": "754ab590-e073-45a2-b289-6c539aaed202", "value": 65008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340122, "uuid": "90ed6584-ea7f-4ddd-85a0-32e20d19a255", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340122, "uuid": "34768067-4fee-4e9e-bad5-dc656d57e17a", "value": "SecuriteInfo.com.ELF.Mirai-CKM.19975.19608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9233d1d1-6203-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347797, "uuid": "d5e0f01f-5436-489b-8375-3a0418eaa7e2", "comment": "Malware payload", "value": "5206d5c253bbc356dbc12c0876d134d6", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347797, "uuid": "0cecfb32-221f-433f-8d32-642e6602f602", "comment": "Malware payload", "value": "940592d0d9a12907ecb2f6cb0a77aba2ba25f8ea093f12211020db716288289c", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347797, "uuid": "f6404414-eecf-4869-84c0-b5f2a3a3af0d", "comment": "Malware payload", "value": "99a178214a12f6f353199618dc5edaf6c60975c7", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347797, "uuid": "cea1a740-500e-4226-ace7-4f640735ada7", "comment": "Malware payload", "value": "bd53a2bbab7fb8da4dbfbd2ddb3832a3e1b73e0bba16df744dcdacf24680c4c0fdbe4224634354dfca3afcb11a4ea26b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347797, "uuid": "98efe48c-bd22-4513-963f-7b7b45c80651", "value": "T12DB42338112D3CDBCE5356F7AEA42B729CDB85E729B4129001B242658C6FB4AF9F444F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347797, "uuid": "63180b97-f6af-495c-a342-07bf9df32c47", "value": "12288:JMGiNz/PUAg4Nq474U1ue65dRDwdFBg+3oEpVQaoKk:mNzkyqi4UQ7m3BRo5ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347797, "uuid": "27f3aaba-c50a-44cc-a2f4-a5a97fb9ffbc", "value": 500047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347797, "uuid": "75c261df-377d-4a9e-914a-3dfd532ca762", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347797, "uuid": "653dcf5a-c438-403f-8dc0-2ca6e74d9b1e", "value": "Installer_v2.1(3).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7eac928-619a-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696302870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302870, "uuid": "5ce71a16-a453-4771-b1cd-aa02441f50ae", "comment": "Malware payload", "value": "b038c77ebb4ab8e3e036a790b2b95c6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302870, "uuid": "6ac02709-3864-449d-bd07-e85966138743", "comment": "Malware payload", "value": "94c40d73ccb3e98195d6c64ccf4e733a407a54753dfcc49ab413667e5af368cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302870, "uuid": "485f0c7a-7b9a-48cf-9a5f-e5bef3e79643", "comment": "Malware payload", "value": "d445d63a3f98c4df3273c31d5fc13be5492eeff1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302870, "uuid": "12685b5e-e8ce-4df1-a5b2-fe810ad06fbd", "comment": "Malware payload", "value": "3c1d3454778a04668bbc76956db33ece924c3551f8aa468521a24ec77e7ec6b0d698a2a7c37562485cab6ff0632bf76a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302870, "uuid": "1f971cb0-f3f4-4638-9639-ac36e70aa556", "value": "T182F523116FC80239C6DF07B6A8615109DFB4CA56578AAF5E9A227DFC2DD7343EA07083", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302870, "uuid": "9500d0a6-6661-4dad-820f-4f618e1c76f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302870, "uuid": "b61dc630-12e2-4a9e-9085-d060da95a933", "value": "98304:R1yAmr3MfNNfg7Lb7PStgtrbu9ABWPzk:R8AmmN1gT7q0m3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696302870, "uuid": "6ff47fba-f957-4f80-8af5-a94e1d79cb52", "value": 3399680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696302870, "uuid": "0a471af1-76e8-4419-97d3-7244cba65d04", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302870, "uuid": "db204fc6-38c5-4c74-9ea1-7874940b16bf", "value": "b038c77ebb4ab8e3e036a790b2b95c6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512dd58b-6205-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696348547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348547, "uuid": "471f2b90-e28e-4668-a20a-a210ed447492", "comment": "Malware payload", "value": "f3c10f030ccafae7f626576d05403fa8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348547, "uuid": "6f8f84a4-2a20-4daa-a60e-686425f3069c", "comment": "Malware payload", "value": "94dbca37ecb5b0d1e87577f1971f0813e4dac979dd3d2db810381a970089be21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348547, "uuid": "3b940ff5-266e-4c87-9a11-967a9e7813ac", "comment": "Malware payload", "value": "c61d1d4212d319289bff243ac9664ef82ac46a9d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348547, "uuid": "51aab449-7bdb-4882-b4a0-2c5a658b7d75", "comment": "Malware payload", "value": "6e51aa26655c7480961286b6482668456ab7989a266cbbac6d3853dad8e29eb86a23c2f204cbc8c28936987f7989d466", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348547, "uuid": "c24ca884-f56a-4601-8758-158c71ba8f5b", "value": "T1979449051549C40EF2DEC67A80FACCB51D263526E2B546AB2AFA60ECCEDC397751720F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348547, "uuid": "ecdb8a9c-8084-48f9-8a89-990aa1cb2c62", "value": "231ae748dbc4fa94aca4a2ab6a3f3a91", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348547, "uuid": "de29bc1c-fb25-4747-a10a-faedc7e12d66", "value": "6144:U452CbXcdYTr2ZOVPM/mG8usvBljB2AtUIzwAHFNOi47VXxqQYT47hLs:UbKcdYTCX/mGgvnUIzwAHjOZ7SX2s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696348547, "uuid": "7a639e2d-0843-49b8-8c69-61e1624f268a", "value": 417281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696348547, "uuid": "2a11dea2-1752-4299-9b23-411db627591a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348547, "uuid": "becc3ef4-f622-47ea-b6c2-95b65c559a0c", "value": "f3c10f030ccafae7f626576d05403fa8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aa5e470-6247-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696376882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696376882, "uuid": "2e165b5d-7ecd-4fb1-8695-b8ca89cf2e4d", "comment": "Malware payload", "value": "e8076ccdf5fa25a9b54bf28c85775e2f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696376882, "uuid": "4b4398b9-4652-4c7b-9688-f36814d7f660", "comment": "Malware payload", "value": "94f9901021891b76a7602ad7a8ca17ba0b8b2fb268c3d2417a7fdc226519ac33", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696376882, "uuid": "00f42505-d8f6-4d19-abe8-65276eac4db9", "comment": "Malware payload", "value": "787750437cc8b121f798863f55060e2fe362fa01", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696376882, "uuid": "98429eea-0232-4e92-9219-cc642cc0c41d", "comment": "Malware payload", "value": "2a71525a67eea4ed1f559368d7df518198fc74007d0f7677543b91674efb7f0f5d6473d6ea8e287dd1a2dd512fec568d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696376882, "uuid": "350b4053-a081-47f5-a04a-2b5b7e47bfe9", "value": "T1D9549E127AD0EC31D4665A318D39C6E53B2EFC909E69679B33587F3B48701E19A72B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696376882, "uuid": "c6e78df1-5c4f-4f45-a24b-6c46ee224d48", "value": "775c7d434cffd499e537a34db4132a29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696376882, "uuid": "92bd531c-6e8f-4bf3-9b49-f0e2cf76f6f5", "value": "3072:n2S7BTivBoduzHLmtkY2j0eUnkrfPqU6xyhACMOTMNjAY:2WB+vaduzHLmtMSnkrXq7qAgQN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696376882, "uuid": "7d8dd4c6-8ef9-4a8b-a490-20a515d7282e", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696376882, "uuid": "334cff62-091f-4958-a59d-7ba4ae772bfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696376882, "uuid": "851efdb0-e05c-4d3d-8fca-c503c30bdad7", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ca7b7b-61f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343048, "uuid": "e9066963-abb5-465b-9f28-731f5bcf70e2", "comment": "Malware payload", "value": "bc30e788b73ea9025eae5ee76613f87f", "object_relation": "md5", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343048, "uuid": "f7f48311-70c2-4b1e-9eeb-e8b8b29c8ea2", "comment": "Malware payload", "value": "95f070f65e000efad889aa4649b99bb3dd8f57593325b148777295e1933d3663", "object_relation": "sha256", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343048, "uuid": "435ae962-8fe0-4cf6-a115-7a810169945d", "comment": "Malware payload", "value": "3d616c523b3f93de65a7288f1afea18cb62a4f56", "object_relation": "sha1", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343048, "uuid": "2953b816-f10b-40f2-bd53-656d21760a6d", "comment": "Malware payload", "value": "df3e64b15a994984477e4fdf460dc866185198b90f4d92d90fc681bf5ede502d75a32a0fe785b27c0fb9d7c1ddd453e6", "object_relation": "sha3-384", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343048, "uuid": "11b8e39e-b5f7-4196-a731-8ebccc610e3a", "value": "T16627382439FA501AB173EF9A8BE479EADA6FB7733B07645D109003864723981DEC153E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343048, "uuid": "c81aa090-ac01-4c61-bd0b-35a3cc732bd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343048, "uuid": "f8734ec7-9fe5-44f8-a345-82c8a8324910", "value": "49152:cgAHK3PH2qnaDRcq0Hmm+VT8xV7S/L7Z3jZP8B4Ju+lkT5W36XxG8bjjQIwg4h0M:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343048, "uuid": "46949c9c-2aa3-4c24-826a-49667b453cca", "value": 21716480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343048, "uuid": "d7d6a6c9-a660-4df6-a2d7-41ff7145c61d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343048, "uuid": "b9feeb53-a3ec-430f-9c59-5563e9a33eca", "value": "VideoWallpaper_setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feeddcb5-621e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696359576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359576, "uuid": "0333ed25-f641-44c7-81ea-127804b3ec44", "comment": "Malware payload", "value": "9a5249a1a15f641d06237598c065e596", "object_relation": "md5", "Tag": [ { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359576, "uuid": "15b9718b-3b63-4eb1-8929-7cc666eeceaf", "comment": "Malware payload", "value": "9631672267ea29a6215ed4541759206d184a06deb60bf7141b84ca6049822930", "object_relation": "sha256", "Tag": [ { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359576, "uuid": "2b3a95a1-9871-4eee-8fd5-4bdae22278d8", "comment": "Malware payload", "value": "2c506ee14f1641a8a10d8e49ed525ab361561e12", "object_relation": "sha1", "Tag": [ { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359576, "uuid": "7f6b74e2-c4ab-407f-8910-196bcdc6cf45", "comment": "Malware payload", "value": "d04641c41cc16c5c1aec43bdd66fcfe393bbcee43b5137bf303bf2212e32a3dbe10f206c5042152cb902410d52440335", "object_relation": "sha3-384", "Tag": [ { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359576, "uuid": "b86152c2-70f3-4dd2-9926-996106eb8ca5", "value": "T100649DA62F2E428BDF4B29FB640439A2CF5C6D5D97DAC0201AE0616BC189CFC75D1973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359576, "uuid": "05dda15f-9e79-43e4-a9e4-84ca02c1df4b", "value": "3072:gF5rYL9zXxvaOA+U2jDAujMOWLriXgFNYu6SkCao+9eEEDWGMNl0u3Qaksb0Uv2E:QyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696359576, "uuid": "c4146206-da21-4a9a-92c5-ec9eda93e5e1", "value": 329719, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696359576, "uuid": "28dcc674-d7bf-4665-bcd8-0caa3ab625e6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359576, "uuid": "6913e8b8-3088-4439-8747-0aecca54aa27", "value": "mg.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50d07f9-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696341037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341037, "uuid": "f7a47ffe-a72d-4e27-aca2-61503eae25da", "comment": "Malware payload (GuLoader)", "value": "02eeca453605d5902d202e36cb44f5df", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341037, "uuid": "5346e538-0af9-40e3-870d-a85506bcb9c5", "comment": "Malware payload (GuLoader)", "value": "96438d0b3067337c39266737d24db93641628d21e661e517568cdd31020703d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341037, "uuid": "ac86c986-02eb-479e-a9c4-6e9881556e10", "comment": "Malware payload (GuLoader)", "value": "c9c3fa1f21060499a5e1ea040aa853457a0e233c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341037, "uuid": "619c0d7f-5b61-42fe-926d-35ea1bfb40c2", "comment": "Malware payload (GuLoader)", "value": "4c3f8cd3cfdb9cef97fc3f5331ddf1d3cfa59dab43e2f8331a0aefb62b351fa2a0ce2b419dc78ea846ba626ba8ce9baf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341037, "uuid": "0d754beb-586c-4a58-8ff2-21c2a1963fe2", "value": "T1701523D096E0C5BFDBBF643491A6420EDFF4FE21A6A757468F003E48AD6B6C18729344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341037, "uuid": "779c78d2-2eab-4c16-9ae9-580fc6e3cb59", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341037, "uuid": "32af9f52-9b0c-4824-a3be-dec215f09c51", "value": "24576:INPx3TpeY7QUy3sEQyz6uc1L9J8xVCT5ATqY2BXY6+g7:mBTEY7QUy8Gz6VL9J8xVCT5AT2Y6N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341037, "uuid": "3dbed466-80e5-441e-aaaa-9e74caa9eb11", "value": 880741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341037, "uuid": "96b9f650-6942-40d2-99c0-b0a9ac463a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341037, "uuid": "fddbbefc-dc71-471d-86ed-71ba572cdc4b", "value": "Athirst.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe27e324-61e2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696333804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333804, "uuid": "3eac2ec4-3e47-426e-8305-f2797f3d460d", "comment": "Malware payload (Mirai)", "value": "1676eb6b86a4934dc3d48f1aa30e3dc3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333804, "uuid": "b2c07fa8-504a-4c23-af03-c939fd1b1ebb", "comment": "Malware payload (Mirai)", "value": "978176f8510996377a23a0881b0f1b645c8b133a2a6282380be1e16e048c6817", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333804, "uuid": "c59e0135-7316-43ba-a363-85684f66d673", "comment": "Malware payload (Mirai)", "value": "e8e0c9a755eda74fe2b7d0f788d8863cd48ab3c2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696333804, "uuid": "196f8af0-a2cf-463b-bf51-5cc6304c40d1", "comment": "Malware payload (Mirai)", "value": "4ed2237f1f55a9b21207420c0f6c58220b1793d3622de5be1063016071b7882fe5a7725ec077e712b291cb36c193829d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333804, "uuid": "903b16ad-eedb-4be3-9988-3361c4dc1105", "value": "T147C2E1BC7EFB5F83CE1B0035699CFE3382B0A5A5D35BB697B24441026C131E5AB66C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333804, "uuid": "420bd51a-104e-47f1-9826-705545229653", "value": "384:MG1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjJV/H:HMw4DZdFbBy6x3K/KdWnH5yjT0Nk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696333804, "uuid": "137d32ca-cb13-431c-b056-8a56b58006f5", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696333804, "uuid": "41a4b38d-fc3e-44e5-9be5-7f52bff7e953", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696333804, "uuid": "f5d4db70-0d46-42bf-b4b9-ae40d93235df", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53f424bd-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347263, "uuid": "4760eba9-c063-4b10-b8bc-7a5e0e5cd635", "comment": "Malware payload", "value": "5abb0cd4b47e3792134da4d00dbc1673", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347263, "uuid": "fe8b7c36-1c23-43ed-9b38-1979aa13504e", "comment": "Malware payload", "value": "979893b00fb16342a112ce06cd14549debf022094887ee329dc4b040712072c6", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347263, "uuid": "db85066f-fc3b-48e3-a437-9c3ed49af196", "comment": "Malware payload", "value": "1f823588b2f2e67c74934fcd5866dff0abab3cd6", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347263, "uuid": "41686d0f-3df6-4ab4-8aa8-14f0ac7cbc5c", "comment": "Malware payload", "value": "ac0959e67307e4d454095e272a9c4429f23189f85feef369416f643c3ec9839617b7e3304262d0c8fa3c13766476cf4b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347263, "uuid": "3c6cece3-8f10-4763-925d-ce35b6d418b7", "value": "T1E0B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347263, "uuid": "793663b9-fede-4ec7-93da-79d14dafe21b", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347263, "uuid": "aaf8f273-b05d-4f69-b42f-e70669227a17", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347263, "uuid": "8fb905b0-b967-4863-b81a-369049606efd", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347263, "uuid": "93c27009-c9f8-4d2a-89ef-e7c740f9418b", "value": "AppleApp(221).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07e1c232-61cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1696323513, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323513, "uuid": "e51966d2-2f8d-40ee-88cc-2f41a50080a0", "comment": "Malware payload (SnakeKeylogger)", "value": "6be8e9398d30635fbca93732150a7840", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323513, "uuid": "be13cf88-ce10-44ff-8ace-6173dfd36b8f", "comment": "Malware payload (SnakeKeylogger)", "value": "9858672b7c7fa3f8b4ef2ed4b8ab8686f1edfdc46a382ae6296051ac3b2742c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323513, "uuid": "753fb40d-87b8-4a35-9bf0-795be50849b0", "comment": "Malware payload (SnakeKeylogger)", "value": "39c5164b57efa461a0ddfe1d262344a183a2287c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323513, "uuid": "299a4f2a-82bc-41c7-a869-3feb3bbf6fc7", "comment": "Malware payload (SnakeKeylogger)", "value": "482542881d6270f0a17358ce158861480f4e5f0d89a8cada326dff5f702da39c1346eba8c99a25491e498d3ee0afb97a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323513, "uuid": "751725f0-1ac0-40a7-838f-4e4640376385", "value": "T17364F71F5B587A15C36F5238E0516109DEF1CA27A38ADF8AA800B7F9DC537C1B6434AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323513, "uuid": "e2acf7b7-8e9a-4539-82b1-c17b6e60c4c3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323513, "uuid": "f2a2cfd5-e0f8-493e-9104-4b81b09c69a8", "value": "6144:pl8AdaxZli+Ua0z4my8PJ4+YcNM2IqEHTd51KSK:4AdahfUlz4mBPJ4gI1zd5kS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696323513, "uuid": "54c883ae-9c63-4897-9f3a-bb0afe867d33", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696323513, "uuid": "3998a9a6-e39d-4557-8284-dce7716178e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323513, "uuid": "4460e0fc-cdee-44bb-a2f6-d6dbd8cdc591", "value": "VSL Q88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85ff7fec-6195-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Heodo)", "timestamp": 1696300532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300532, "uuid": "1720c12f-129b-41b8-b84b-bc230c387ddf", "comment": "Malware payload (Heodo)", "value": "fe43e3595e8e79f086fe9b367e8d7005", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300532, "uuid": "b87f5241-e2fa-4cbe-a625-2fe809ee8789", "comment": "Malware payload (Heodo)", "value": "98b9bd9da1ad5c48dc82f3c7152494217823514b5fc6d5b8e53b9b5a8dec5f7a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300532, "uuid": "5b90380e-50ae-44b2-8f1b-4ea94cac7401", "comment": "Malware payload (Heodo)", "value": "fbc5f7531e7dd3969e41b81c77c91f93ab5625d4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300532, "uuid": "82b56a68-00f9-4488-8b3b-8409312a21f4", "comment": "Malware payload (Heodo)", "value": "ae26a0c4232af5d34c9fd0b22b2caa01b48e07f531860c8d563a0d58f88789574b7ff308033fbcb4b82a46881ef8435e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300532, "uuid": "4b48ae46-b4af-43b3-b4f0-58f4ec7ac556", "value": "T131F35C24A89305EBF8BB1832A0077A4FD5753D159320AE7BE690CF96BF21B11920F55F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300532, "uuid": "66615189-4836-4d19-ab6f-05d02e2567b9", "value": "3072:gab7+a6RKcswmok6hxrFO/DjPehy+e6kylW8G:fQ1sw7hxZObqX3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696300532, "uuid": "6902954d-9b85-40c1-8166-a8eff7d47519", "value": 171520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696300532, "uuid": "681e2a60-27d4-4079-a340-cbd78a195cae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300532, "uuid": "54b12b88-335f-4a93-91a0-eee931ce0518", "value": "payload_carved.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a6719f-61e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334673, "uuid": "94a3ec79-5bc0-4f58-966d-e34012fb3f51", "comment": "Malware payload (Mirai)", "value": "faedf7a935d5d7306eb32d6eddf89f50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334673, "uuid": "a822d8e3-2d37-4101-866d-8624b108ba1e", "comment": "Malware payload (Mirai)", "value": "9929a2f3a9b730bdd25e0d5c749cc3dae139ec9bac62a2d60e8e188438d0050e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334673, "uuid": "2bf60647-1d65-48c8-8bc7-a7191d07cb7f", "comment": "Malware payload (Mirai)", "value": "b7ec4dd1d5f0566388c1e88a3d413b48b87aab10", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334673, "uuid": "0f267da0-efde-443a-9907-08ab92b0b895", "comment": "Malware payload (Mirai)", "value": "bd049d7c8b60c38b1d4a90af1c60398d920600423add797fd766942b44c4c8c07b283598b066c215adc42254718ae063", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334673, "uuid": "6a3b8870-c1e2-47dc-ae20-0638bc7bd0b5", "value": "T170735D24A9792E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334673, "uuid": "d0cff721-25b5-45b2-b5bd-b38395747393", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8k:YwfdNu4cmZvFqI3w7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334673, "uuid": "a6f8eb98-f34b-42b9-b314-e1017510d979", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334673, "uuid": "47e9c22d-5a5d-405f-83b2-b4b2c09bf2f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334673, "uuid": "11592d15-c245-4f92-bd2a-1741105bbd35", "value": "faedf7a935d5d7306eb32d6eddf89f50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d643cd6-6224-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696361747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696361747, "uuid": "f863e793-24a2-4b48-ab50-fb7cdfa64c38", "comment": "Malware payload (AgentTesla)", "value": "202e2f27180aab2455c8a861628c24dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696361747, "uuid": "be1f9d6b-ba17-48f2-9f13-c4053ae5d002", "comment": "Malware payload (AgentTesla)", "value": "994b21e92be8e881a30abd11ad20cd3c7315e81fe8c81cb0c6ce6e8318f76e46", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696361747, "uuid": "06dcaa2b-7603-4c34-8cf1-7bc128a4c7ff", "comment": "Malware payload (AgentTesla)", "value": "a5fc027bf4d9a62eeead2d91770dc59025d162f6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696361747, "uuid": "54fe33bf-c7a3-4d3f-88f8-4af5d75b014c", "comment": "Malware payload (AgentTesla)", "value": "5328a6d830181c6c2269b1ad3c84b71977e5c0bd1f2ee1b8854d83444b96eb81cad5e18c69d5498f08fd86b5f85b6224", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696361747, "uuid": "82aebe5d-b7ea-4e27-b9b2-80cdb3b34d43", "value": "T16FD4121630AC0BB8E2759BFE157015581BFA686B0D24F38D2D8532DE1A73F2786A5F07", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696361747, "uuid": "4fc42ca0-b62e-41db-b8eb-5ba0d624f696", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696361747, "uuid": "8fb38564-2718-4fbf-8313-247dd94b960c", "value": "12288:n0iSAx5PWPQ4wOUZagMzRPxUs30yLjIW7X72ckoQ08wt2cgB3pmhSJftGEaB6:n07Ax5uPrPEGjrTkoRupmhSJf0f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696361747, "uuid": "a71bc3d6-1eee-4aa1-9b99-b3a1f5cf2063", "value": 616960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696361747, "uuid": "6bac5718-ac06-4511-9287-1b4fc5f3d2ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696361747, "uuid": "adba764d-8901-4203-b5de-1c9a921712b3", "value": "SecuriteInfo.com.Trojan.PackedNET.2370.4446.9814", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9a628c5-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347407, "uuid": "07398175-f0c5-43f3-bf7b-10d7d7b6e56a", "comment": "Malware payload", "value": "5cf8ae43deb064f8f35bef8b6df20990", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347407, "uuid": "39429c52-b844-4f3d-ace4-d53aa07f92cf", "comment": "Malware payload", "value": "997e8ac749dbdbee5603e46081a41812bb51955ce712cf0ec1a30266a1e9c3fe", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347407, "uuid": "2383d672-6b95-418b-b564-eebc65939c73", "comment": "Malware payload", "value": "26162094a975789b180692bcb30d5e13ccb043b6", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347407, "uuid": "9750c367-cf4e-4dcb-b4fc-4636bdeb0207", "comment": "Malware payload", "value": "81d41465ef9c20dd8ce32af31104d6a470a295bd51e2cfc3f2967e86f11063e08ab9e6efd3234ba30403130c6b6b42d3", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347407, "uuid": "9cd8877c-0b51-4a31-b1c8-04711becba06", "value": "T14BB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347407, "uuid": "92b9d6aa-d0cd-412a-82d4-281a5729341d", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347407, "uuid": "06e7044e-36e8-4df7-9932-c29b13b4a6bc", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347407, "uuid": "cd8a225b-8b9a-4c4f-8652-85357c5927f9", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347407, "uuid": "32a45b21-f37a-42d3-8fff-5a651c689fb0", "value": "AppleApp(250).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "970d20e0-6182-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696292400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696292400, "uuid": "5904e06d-190a-4a26-9628-a92efa9cf427", "comment": "Malware payload (Tofsee)", "value": "6fcf1266c2f82dfd18ce9b26c3f18569", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696292400, "uuid": "01795ea8-9fe3-4f18-b6f0-eab819a3d4e2", "comment": "Malware payload (Tofsee)", "value": "99ffc11a0ddf8c9175aa7164e28aca8d185ac6be65549dee8b1e04133a9096db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696292400, "uuid": "43c8ff20-20ae-4bcd-9fae-4c3f18b91aa7", "comment": "Malware payload (Tofsee)", "value": "fde5329a38ad3ef4e54adbd511149a609e65e4cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696292400, "uuid": "aa9c2b9d-2011-42ce-ae64-c9d0fadb51ef", "comment": "Malware payload (Tofsee)", "value": "1c7a9da7121b9506267e7fd729ae7bc42a4f3afaa6a25394928fe2652b12084e06e35a9e0df1554456dcef86123dfa5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696292400, "uuid": "142f7f4e-f9fd-493d-8eb3-35b8f4a5245e", "value": "T1C134DF2275A0C0B2D6E706B95434DB943F7EF9736760C54F37640AAE6F20AD1AB26313", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696292400, "uuid": "c24004ff-3beb-4a79-a322-743d4520ca56", "value": "a7960cb042304220b44306228fd698f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696292400, "uuid": "d5914220-f55e-4fc8-a5e3-0f90f09f77df", "value": "3072:KpB8WymrKxmzd01gd3TkYzfV/wMfeWIWyANWX43Z5mGF2n/Q:u+/Ii10TkYzTphYIS42n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696292400, "uuid": "b18d59d5-1097-494f-8e8c-2b7fd092861e", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696292400, "uuid": "055b6967-fe99-45b4-8944-9c561a50cf86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696292400, "uuid": "9cf1904f-d5a6-4d04-aa8d-be1fca69175b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc5beab5-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696356941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356941, "uuid": "15cc0b2f-d5a7-4ee3-b653-ef3f8b9d752c", "comment": "Malware payload (AgentTesla)", "value": "1085d7f912798931b7e241973cc978e5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356941, "uuid": "46f9fce7-24f6-48c0-be1d-080ae62b6e0d", "comment": "Malware payload (AgentTesla)", "value": "9b417b5e5064e3663b124b55b306a41c0ffb970fb6463d21977d720ce61caf77", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356941, "uuid": "3f2ff07b-c2ed-473c-92d0-8f064862f961", "comment": "Malware payload (AgentTesla)", "value": "6e177d14645468c81f977201cc7d093082c88190", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356941, "uuid": "fca25377-78e8-4fdf-b7b9-074ec5416f06", "comment": "Malware payload (AgentTesla)", "value": "6f4811d168b6c793b8d4e32ba4a1a1cd5d458a641dba4f1ccf118af670ce164a1cef41a9643e8d14934e0621843f9e5f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356941, "uuid": "09d2f472-4d15-4c8a-90e0-8f040709a605", "value": "T1C355E00B9514AF86C00D43F86E2339991E0E7F19EBD069EB14577B4B3E317A259DA2CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356941, "uuid": "b3f68c90-1160-40a6-be26-706d09d695d2", "value": "24576:dWQmmav30xf7pZyNw6V9AXZS/ZhSnZyCw6VoAXZSKPxkiBb7MYTQRiLKcyRaf3wV:8QmmQ30x56VCE/Ye6V3E27jTryRafM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356941, "uuid": "93342d1c-8523-4ec6-ad00-ef99161e4dfb", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356941, "uuid": "01a8657c-6ba3-4a12-bbcf-c41b3911b05f", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356941, "uuid": "a56c31e7-e35b-4ec0-9e73-8aeedb301d28", "value": "NEW PO-230.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46b761e9-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1696313310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313310, "uuid": "09206b1e-c63c-4235-8010-2c6842a27cb2", "comment": "Malware payload (SnakeKeylogger)", "value": "209131b7f5c017d2ed3ca9bb8789d9cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313310, "uuid": "69f5b622-dea9-4877-8ae0-eb5754cb952f", "comment": "Malware payload (SnakeKeylogger)", "value": "9b8823dcdaeeea59ec64f4718bff9619d1d0c24e4953a0002d6dc96a12f330be", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313310, "uuid": "6044c6b1-f615-4926-9a03-7cd4fc6888bc", "comment": "Malware payload (SnakeKeylogger)", "value": "79d95012a5f433239d81563ebd1a501a0443194a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313310, "uuid": "fa8a02e2-afa2-4fea-bde3-486bd3f353b6", "comment": "Malware payload (SnakeKeylogger)", "value": "17187409fc504586c4bb2bcff960c0d86e9f546196f9e955e598840ee459a4989714ccd74df1ddc9c774d55b8db95ff5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313310, "uuid": "80297775-dc0e-4f5f-80a9-cc34e632da90", "value": "T1D07402E924C8473BC60B43BAE297532560395023A59BDB473D8B158F23F138EA6077DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313310, "uuid": "12be81f3-6809-48d9-ad5b-1114c8fc0591", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313310, "uuid": "0e511717-e2b0-48bb-9db8-ff8247a24de4", "value": "6144:vr9BIKD2SJMzodRpUZNFvz32LBWd9mxMzIqz8q/Qvt3mkscDdk6ceh9X3P9:BfD2S+j5ZTSD5k6ceX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313310, "uuid": "8b09df18-f929-4146-b1ea-ce6a40f7b6f8", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313310, "uuid": "38700c73-2dad-46da-a349-1c95e7caae22", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313310, "uuid": "8fe237f3-2f55-4a4b-98a9-bd616b16f506", "value": "D09865445789-0987654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c1fd39e-61de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696331788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331788, "uuid": "91c58ac3-3a00-4674-86e0-c0d6a0ac5e2d", "comment": "Malware payload (AgentTesla)", "value": "e579f84e3f9f94f3abc41dbe9ef35e4e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331788, "uuid": "b9965a44-54cc-4783-979f-d3d8d240bc1e", "comment": "Malware payload (AgentTesla)", "value": "9c446a102a7d7719a88bd946e5e81596cd6393f636713ca4eb782a1457a185ec", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331788, "uuid": "10f97691-9106-4c74-b7a7-d3af2b00adf7", "comment": "Malware payload (AgentTesla)", "value": "8ed215d2ef455999c346544834a7d7ea5e938b94", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331788, "uuid": "18565dec-bdf1-4726-b85d-6362a8dc1485", "comment": "Malware payload (AgentTesla)", "value": "f0d22f3d4a6eda7e3cbe286fd4f40497e767c39aa68b71cd31d383153bb9dea4fef6b48c96d8c50a643131a6def3e103", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331788, "uuid": "01880d38-f6b2-484b-9ce7-0675696f9273", "value": "T136B312E2EDDFA75F378A6443450AD56491AFDF2B7A6B84B81A045939280FBC03814C1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331788, "uuid": "2c3b645a-ca1c-40c7-969e-9d4a9c275b7c", "value": "3072:OwQMRWvypxEE8DiwvDsJ0Mbs2ip2aPHaiG:CMQKpxENDiwLC0UipZa5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331788, "uuid": "2b4ab300-4a5f-416b-ba45-e4def3675974", "value": 115882, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331788, "uuid": "b7924846-7a97-46a6-b29d-401b3030ae16", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331788, "uuid": "ea9eab3e-e019-417a-aa2b-4a10d5123e2b", "value": "Order.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ec15d1f-61c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696320330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320330, "uuid": "e2bbc782-579c-43d4-a8b2-56b1b4749efd", "comment": "Malware payload (RedLineStealer)", "value": "32bde18a16c416077831b74838f80ad3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320330, "uuid": "e3bfdd36-0496-448f-ac5d-014e1536afc6", "comment": "Malware payload (RedLineStealer)", "value": "9cbdb8e2103328fcd51687a14b752ffb2d3a28a7d5de6cc2c912861070d65fe5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320330, "uuid": "05db89b8-0add-4d6f-a189-61deb2a2c797", "comment": "Malware payload (RedLineStealer)", "value": "0cf5b3e339164e5a06a3a6acf8f8d508a1d2c266", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320330, "uuid": "d9a6b7d3-fd4c-4c66-88c9-70f5241e8e1e", "comment": "Malware payload (RedLineStealer)", "value": "f838b0268ecf56a885839769ef3050711f289298ea1e7fb67875c57a81aee45dbad8d7f0e86b6be7b6342317afcfe577", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320330, "uuid": "9c83e435-cdac-4bc7-9e67-ca5482a1e564", "value": "T1ED85AF7039C18171EED230B646ECB978D2AFF1B00B2656DB75E907EEC7256C06B32586", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320330, "uuid": "4c969248-971c-42cd-9f84-84ef97f717e0", "value": "f4092d18c79f86ed28d4556a63302087", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320330, "uuid": "a367df53-ce3d-4678-843f-95a3ead1b398", "value": "24576:mWycIKlrBQFn/NXJHKA2x8F4euy8nyFgCdf:dhBQFn/NueWTyR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696320330, "uuid": "7bb2a414-90e0-4187-a35e-ecc844ab836c", "value": 1735072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696320330, "uuid": "4cd50239-a8a6-4c51-a3c9-70b74a75a39b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320330, "uuid": "ba0d51b8-7b0d-49f2-8a9c-091e4216bee7", "value": "32bde18a16c416077831b74838f80ad3.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "555db6b4-61bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696316771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316771, "uuid": "f4748334-e68f-42b3-a9d3-577e0a676c6d", "comment": "Malware payload (AgentTesla)", "value": "c4246ff37fe1d2bb3744918ceab9d392", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316771, "uuid": "28f98d78-9b9e-4cc2-b1c8-b4f4596b534b", "comment": "Malware payload (AgentTesla)", "value": "9d0030c2c7fa31d81278dfb94e88e98dc04268cf6a3df23d98aaae875e40cb82", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316771, "uuid": "cfed9c08-ea48-4bca-b97e-143165c4cb6f", "comment": "Malware payload (AgentTesla)", "value": "4832af95b9b8dec6b3f584c2db418acee2a01bff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316771, "uuid": "f7b3a0d6-3fec-42bb-9f97-c98b76b3ffa0", "comment": "Malware payload (AgentTesla)", "value": "368d9520d0847976da0dcd1677ed13627b87630bb595e88db9df2dab48b8bd194718132b896930e8d1dae2a01c3bf0e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316771, "uuid": "087b4007-7458-4cb6-919a-5d808d8b3afd", "value": "T12325BFAC366078EFC91BEC7289182C74AB607477570FD207A11725AD8E2D7A7CE146E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316771, "uuid": "e2de8528-a814-4368-a4a6-9912c33666c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316771, "uuid": "57694fc9-73ae-4e81-8cf4-385a8151e7f4", "value": "12288:NHALGjPHMmNumB0o1kwBi/qSy8+dx7r3VMi+vkCk1aRW04sYFrj1zz0wlD9kvATF:9BCyjkfXmNBMi+hk1oYlzZRDrg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316771, "uuid": "65b37b70-37c2-4d29-b0f4-708def1a47e9", "value": 996352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316771, "uuid": "114ce41b-c68a-4719-84eb-91cbcff36aa6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316771, "uuid": "8c852252-c45a-4b85-ba3d-21e889e1fc71", "value": "Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "817bdc62-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344333, "uuid": "49a9bdc7-b94f-4704-8426-bd751ea175de", "comment": "Malware payload", "value": "9a5819418deea6d9fcc00bd6f04f2271", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344333, "uuid": "73f3a82b-9d23-4a43-94a6-5ba85a534376", "comment": "Malware payload", "value": "9df9213885d1ba9864a236f556a0504dd8b10d1a2488decf682a438cbafd4aa3", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344333, "uuid": "456e94a9-914d-42b8-8f9e-94e6063de919", "comment": "Malware payload", "value": "2f4ac1af63304d7502e192a11d8a01ccbb10de24", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344333, "uuid": "4c0dac32-62f3-4873-8b86-29dd94a88771", "comment": "Malware payload", "value": "85927312c26d066ff7a90d6ad1c11602b003e63926cbd15f0ba6ac577a4f5ce625a0ae6c898535d0ca8f38943386dbde", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344333, "uuid": "277b7392-1e22-4463-9224-cedd40cbc250", "value": "T1B3B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344333, "uuid": "bf1ff69b-0518-4e0a-a00a-bfcf9b3f8ca8", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344333, "uuid": "ccc27bf8-a7fc-432e-828f-440bc1d88ccc", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344333, "uuid": "cab84256-1744-45b4-b9f5-cd0789243382", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344333, "uuid": "3058e549-44ac-4905-8a2b-eda0c9421ce8", "value": "AppleApp(138).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdd40f3-61e5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334686, "uuid": "0d355ed7-c533-442c-bcd1-39acbabbb651", "comment": "Malware payload (Mirai)", "value": "0bd64198286ae121536883dce337c661", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334686, "uuid": "6d9e7fae-c5ce-41ff-ba08-e051d6b0610f", "comment": "Malware payload (Mirai)", "value": "9e4813b4a7963fa363c7cf8c23630b7f7e5b37e288d2f6ad0fd8f193a7048385", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334686, "uuid": "3c808238-aac9-4e37-b2db-1f16ac1f9be9", "comment": "Malware payload (Mirai)", "value": "e17517331a3d7cb9ef69952b3ba514556be9cd26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334686, "uuid": "393bcbd9-91dc-423c-a17f-e60cefed6c77", "comment": "Malware payload (Mirai)", "value": "318fff4b9fb668161380b81d198fad959a564be016414b7457bf8201376d9add12b09c829e7c710016d6d08a44a462b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334686, "uuid": "6500dbe3-0339-45ee-98b7-8defa2b803e8", "value": "T1B7536DCAB8119E7DF5CBE77E84220D0EB821726150931B17BB6FFC837D721648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334686, "uuid": "7735e30d-b01c-4356-8d9d-0ae4dca4b0a1", "value": "1536:AXyRgQF4TbSX5lxLepSGY5cFnehON2PPB+qG76E80:N1TjJ8EVGO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334686, "uuid": "f9e51250-5e2d-44de-af64-9b610ba596c8", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334686, "uuid": "25bf2b27-8d19-4d53-952d-00550435e353", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334686, "uuid": "27826fc8-f0b1-44cf-85e1-4a4de2fea3f5", "value": "0bd64198286ae121536883dce337c661", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffcd0d9f-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696357000, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357000, "uuid": "1eb39e2c-03f1-49c5-b3f8-af58c9d6ed61", "comment": "Malware payload", "value": "fd932828580b8a9ecd1b433b3193e2a7", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357000, "uuid": "ec66a631-c72b-428d-926b-2b0852bd1885", "comment": "Malware payload", "value": "9ea01a574477257f6dba7f46fe65d3f9609a27cb74049e504d0b4c7bc316e7c2", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357000, "uuid": "c39a8397-3c62-4ca6-a7e8-db857756fc8a", "comment": "Malware payload", "value": "f267d70e1e6780c24d132038344d24ac80d5a2e8", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357000, "uuid": "14b6eb6b-68d9-4a10-b92d-841e5f9577fe", "comment": "Malware payload", "value": "9da8b68c1b8051ccce12df2b344738072cb912e2aa54d8d2fbd069fc2cdd699d4b3473c48f691d1f63d1f398c536b7ad", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357000, "uuid": "434aa0b4-a248-4471-a88a-0fb7b8eb8aad", "value": "T130E4E0E7BD98937DC307B3394C119C33A94D2CBBDCC1D01A94B72845896898877DABDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357000, "uuid": "d5da7143-12ed-46e2-924c-49cbd41f4d1e", "value": "12288:P0h9BJfgcVzzq9PP2dz3khsm9rqCWXEOOANIO7ky8AfFivW47d/eBEBWNeAgT:PC9BNgVh2ehqCeOeyAtivNjWAT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357000, "uuid": "22074b86-9495-456f-b6c6-483cb940cb28", "value": 685047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357000, "uuid": "ee9c7fe9-6559-40d3-b522-388752c18ace", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357000, "uuid": "996673b9-c6f4-4a11-8e36-2de4c1a58c45", "value": "Faktura.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b9eafd3-6181-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291951, "uuid": "f4cfd94a-be09-4bc2-b2f0-76c6e9c57381", "comment": "Malware payload (Mirai)", "value": "4725a07656c797b1c1ce2dafbe185756", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291951, "uuid": "637e927e-4880-40aa-894e-f476a0a023b4", "comment": "Malware payload (Mirai)", "value": "9ec5ce4f2385a775189cd711eb151b901e0454b7e5ef93c6c75b45497f99a13a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291951, "uuid": "98f0662d-683d-4e1f-9e1d-9ebc61a72a16", "comment": "Malware payload (Mirai)", "value": "e72cb5f0db553a561b7e7ac83a62b7d9de044152", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291951, "uuid": "197cc56b-31f9-4fb8-a9fd-3cfca94511f8", "comment": "Malware payload (Mirai)", "value": "d6d027722d4173bfe9f0313f14718144d3c416cd928f8d054619e041c19ec1f358377f0d1afe874dd6fcce9a168d2a09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291951, "uuid": "38e0fefb-2b79-43c0-843c-a5468844dbae", "value": "T14A535CC6B8119E7DF5CBE6BE84224D0EB821722150931B27BB6FFC837D731648956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291951, "uuid": "83044b1e-e6ab-4883-bde1-fa98e75bad18", "value": "1536:AXyRgQFTTbSX5dhLepSGYacFuxYhON2PPB+qG76E8n:N1GjR8EVGOR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291951, "uuid": "409ab292-e9c9-4c76-aa7a-005050d2e1c6", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291951, "uuid": "a1c153f6-fe5c-4f59-af25-05257f0f422c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291951, "uuid": "225a4c22-71f4-4c57-a79b-b098b1ef553f", "value": "4725a07656c797b1c1ce2dafbe185756", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24172e70-61d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696328714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328714, "uuid": "ffcf4001-691a-4a1b-a10e-f99286b431f7", "comment": "Malware payload (Mirai)", "value": "39bbf1cc781adbe3d464752e1a3870cf", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328714, "uuid": "dded04a2-41a2-463e-8899-d59659948023", "comment": "Malware payload (Mirai)", "value": "9f5aadc9cc942549522d1d6152fa9164d16e8701e9c92969fff9b2a5755974b9", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328714, "uuid": "97db0644-9a42-4d71-8d7d-2278833eb6fe", "comment": "Malware payload (Mirai)", "value": "7627fc5b7ae6eefbfb8f737206928eaacc07dd11", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328714, "uuid": "75234036-9093-40d8-bf62-cc41ee30d3ac", "comment": "Malware payload (Mirai)", "value": "7fea32155c64003fd318f4c1f18ec374b6877af10741b911ce300e4204e099d1e5ab50045367e56a66fe39dcafdb9caa", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328714, "uuid": "d63e875f-0f9e-4354-9c8b-f710fdc53faf", "value": "T157D2E0FAF2C7E4F0D6F694B9919C10C0F47C72568720C7FF089962BD48A66CA5235B62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328714, "uuid": "358c0d8f-10fd-4353-8b47-351ae4228ce7", "value": "768:YYSoXdJZtUjkFfNJlVrQeHvPx2csGHEyYcShuZV:YYJdJZGjkFV35/Mcr4TuZV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328714, "uuid": "6e02582f-803e-4ae3-9c31-f8377fc1f7d0", "value": 30104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328714, "uuid": "a3ccdf83-30fb-48f7-b031-547b5854ce9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328714, "uuid": "e6eaef94-ef93-481b-a59b-d0b0c2d4bb60", "value": "39bbf1cc781adbe3d464752e1a3870cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e12f3ef-61e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696335200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335200, "uuid": "d7bc8443-e564-4dac-b556-cdb849b8b57e", "comment": "Malware payload (Gozi)", "value": "ed017c0f334b6d10ac5aca77fe7f9a2a", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335200, "uuid": "0ad5c904-c1d9-4e46-a7d2-aef2644ff5ca", "comment": "Malware payload (Gozi)", "value": "9f710a0fc0cadbf3378c06ca4fefa2486bdf04646201f9efec7cd5a4c97634b4", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335200, "uuid": "405a0d08-d616-4841-9bf9-c0c5b9a3fce3", "comment": "Malware payload (Gozi)", "value": "de7a838cbf418f5c093e5bed00254c4c68b82fa7", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335200, "uuid": "b7d08176-5179-46b4-9672-2b62bfe1d37e", "comment": "Malware payload (Gozi)", "value": "050d89ad01ba06e741eeb7ce66c82c0cd27edc93575c013c1e948f2bd327c66aeeff31be2cfb6c005ce10eef9489a27e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335200, "uuid": "636ade19-fdf2-41ca-9e88-e4d043440e21", "value": "T120549E13B3D0FC21D4665A315D29C2E8772EFCA19E69579B33583F3B59701E18A62B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335200, "uuid": "f7060467-274c-478f-8a60-7fece9fc89c4", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335200, "uuid": "be74c385-b097-4eea-bf8a-beacfc390025", "value": "3072:Az6N1tmvikka83g9IGkpt4fMlw5mlg9eidid74+VONrRrCS:bN1cvBka83g9PkUf55B++1r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696335200, "uuid": "9ec2f81e-7fb1-48da-b5b7-4729a18a9928", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696335200, "uuid": "33bf6c79-97df-447c-9d7b-d29cea71dbf1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335200, "uuid": "7809dc50-962b-462e-8851-9d180500310e", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "732290b3-61ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696338296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338296, "uuid": "7144e78d-89cc-4ab1-ad48-adc2d2cac96a", "comment": "Malware payload", "value": "4c9c7ce9160369cb040d7d87b02fa905", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338296, "uuid": "03317533-4e45-46cf-b0f6-bfe9783d3054", "comment": "Malware payload", "value": "a0dc21f7d6b5ff52be320b9fb28ae2394b9a4c0a2575f18c1bd58f806495d4cd", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338296, "uuid": "def34da9-d360-4ad7-b7ab-bc65ff8b1c75", "comment": "Malware payload", "value": "a4fa0062451ea5e432fc75e689f97a1e8f0734e1", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338296, "uuid": "fa6ad726-6830-4e4c-a193-489fb442f038", "comment": "Malware payload", "value": "9068f9885a1d163105eea6bd1cfe8fec69ffa54d13525806f41b0ddd15b4c23c60e5908f53f1cfae6257ca1456a0194b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338296, "uuid": "3727848f-222d-4e72-b4fa-7f2d9c2fad7e", "value": "T155B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338296, "uuid": "cc81ae46-5b01-45b9-853d-c5520be6cc2e", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338296, "uuid": "b7482484-b970-4269-af15-988fddca48b3", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338296, "uuid": "d5797538-2d5a-409d-8a70-b45f7cadeffb", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338296, "uuid": "486d304b-8d05-4028-9e13-6d6f36dccdbd", "value": "AppleApp(23).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4409f56-61c1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696319561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319561, "uuid": "90df2738-3c23-4178-b2e2-934eaada8588", "comment": "Malware payload (Smoke Loader)", "value": "ec1d1cd9d43698631ceb1157e680a00a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319561, "uuid": "23ef77b1-282c-43b0-956e-f33c276727aa", "comment": "Malware payload (Smoke Loader)", "value": "a131b5cb6dd4b0daeea80eda409b3957fc9d7d33b0a4058e19d28b9cdebb51b6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319561, "uuid": "cc5b691b-3d6e-4abf-8665-e54c243f8639", "comment": "Malware payload (Smoke Loader)", "value": "fe62f6419edca78ed9ff69b7ce0251e0dfde76e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696319561, "uuid": "a8700dad-d80f-4532-9f35-f5b6546ab244", "comment": "Malware payload (Smoke Loader)", "value": "b9add4271a14c3775b169f249ff961123f249bc30947a7f83f8de2b5f99b37b0432db97e70fd4aabbbab829f2c7f51ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319561, "uuid": "1d5cb766-7533-4376-b780-4fef0a165876", "value": "T16454AF1376D0FC21D4666A314D29C2A53B2EFCA19E6967DB33983F3B49701E19A72703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319561, "uuid": "30458d99-2181-4fae-8ada-38223bbdf305", "value": "22101b09b25f37226d51fdc3f87abcff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319561, "uuid": "21d119a7-5210-4513-87ce-75c9e8596ee2", "value": "3072:NF/UIMBCdB8/sD2bFtBKXRo8G7lWsoSywCo62qXSuqWRlGhiVy:r/UIKC38/sD2bFeXRIPorOK/bRlg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696319561, "uuid": "8163214c-7bfe-4375-ba32-a3871cbac5be", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696319561, "uuid": "7ac74be9-6de8-4f35-917f-6cb07811e6a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696319561, "uuid": "0f89e7c3-f647-43a1-bbf5-13a493d97418", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a3ccd8-6199-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696302031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302031, "uuid": "d730eed3-0365-411f-a449-02e68927744a", "comment": "Malware payload", "value": "dbbfb8f2f101f709bbe45c0a45498d15", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302031, "uuid": "98b68252-b8e8-4d2f-8202-828d640b0f7b", "comment": "Malware payload", "value": "a14257e6a94ea6444a74f74b3f3f7a4f4f930576362d8c2d7fb0615ff9916ce7", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302031, "uuid": "390194b3-9dd5-42f9-9549-c9d509e00d9a", "comment": "Malware payload", "value": "ae0de1cfe4c0448718708f15e157cfa870d423ff", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302031, "uuid": "bc3f18bc-c45a-4adc-afbb-d97f08dfbcbd", "comment": "Malware payload", "value": "b833dc8d9873af7c6fc99bfbb3b98c94bfed010f5614127ff9e71f688d9e9aeaaa880dbeb2d9c6c9911c5b616eb37723", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302031, "uuid": "6f8f9f29-d25a-4442-b822-41a86cba3493", "value": "T1FBE07D40D7C30E48C53F8DFA768729B08545D5C88454B18BCBA8F22B0D3334A1D7D5D0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302031, "uuid": "1d1f8131-f6b3-476d-b3a7-9c4716f32112", "value": "6:5j9xtU/LumN7/8nTiKkTsRz7bOI85iZ9uW+YmcG2PcuuARClPkXmarS0xtUTO9LG:5jJ0L5NqTxBbOIeqjGAfuARo8mCIAR2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696302031, "uuid": "f90d4258-6a15-4fe4-8791-9644f9fe9beb", "value": 333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696302031, "uuid": "303251a3-13c6-4e85-8dcc-d5b3fe8e21fe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302031, "uuid": "2cdb9c42-51d1-4e57-b29d-12b09ec1cdd8", "value": "Azienda626.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c7c640-6248-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696377215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377215, "uuid": "2b93a8cc-49b3-46ca-8c1c-ff0c1757bdd9", "comment": "Malware payload (Mirai)", "value": "57d46478c3f935ea53adb209763bce55", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377215, "uuid": "e44c0de4-1b7f-418e-a070-c74ea53f0eb8", "comment": "Malware payload (Mirai)", "value": "a170b3986952c17140c7f3a676331fec123839fa97a613e9d58c6db3edf6d89d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377215, "uuid": "3738bb85-4e7e-4668-87ef-167af5e8f1bc", "comment": "Malware payload (Mirai)", "value": "9dce7232a8e2582deab5671e7ca1e6a40ef6600c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696377215, "uuid": "7fd955d1-0de7-4814-a6eb-ac48f299fbe6", "comment": "Malware payload (Mirai)", "value": "9141d6491d768a51196aa80f38ff040d661cb65ec8f5a9bce9c5c9ee98692e9fe948363fa1da97065ff241baf5ddba39", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377215, "uuid": "a0985153-d2eb-486b-9c04-eca60930d887", "value": "T1B0632B867891AA2AC2D117BBEB2F018D336567F4D2DE3213CC140BA4778AD5F0D53B92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377215, "uuid": "98bd9ccd-50c9-495d-ae7b-626535306cb7", "value": "1536:k+1UbOahCfdN6OHDyK9+EjOdzcDDDVhPX51t/MKq3+3+:k+1UbOahCfdN6OHhCEDDV8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696377215, "uuid": "63fbc432-f8d5-446e-9e85-c7fae1c02413", "value": 72632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696377215, "uuid": "f72b1db4-465f-4fb3-8937-9a39091480ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696377215, "uuid": "cf6af2bc-ed83-4494-b34e-21069afb2474", "value": "57d46478c3f935ea53adb209763bce55", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c561f2e0-6187-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696294625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294625, "uuid": "11f75bbc-4d0c-4fc4-93ae-a28419101a01", "comment": "Malware payload (Mirai)", "value": "b4ea2e3609ac017413e931b9f27cd4b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294625, "uuid": "99fcf9ac-0201-479b-b190-20573c437665", "comment": "Malware payload (Mirai)", "value": "a2d372e179b5d1e20e356af03843d87210e0782743154dbd18b7b8e2cfc9c633", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294625, "uuid": "21aa0030-7d03-44ff-9d1d-9a797e63aabc", "comment": "Malware payload (Mirai)", "value": "0e91b4b2747102c0991eeb7df082d48df8577f73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294625, "uuid": "9b025c62-a429-4f52-af94-eab7c6de33db", "comment": "Malware payload (Mirai)", "value": "6ae07fb52ed727f5963dae1ae30127c4b92e66f9ea36261180370af6ae72a2999f5197d5b9e9ac7c92db96866b6e7d86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294625, "uuid": "cc517a13-c155-4de5-9cd2-47ead88dd3c5", "value": "T118E2E13A656538D0D6340831D8EFC3E4B7AF977CD6AA73282B84497932819CB50BD5E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294625, "uuid": "322e4c41-ff0a-4309-9295-8000c57eb7a0", "value": "768:9glxj2JxTqLweLLNxedLi/WFxzrOxCAALXxs3Uoz5:OmxTqLRLELiAl0C3LMz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696294625, "uuid": "c307c4e8-5908-467f-8925-d6e0320fc2a2", "value": 32112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696294625, "uuid": "ebcd1954-6836-422f-a400-89d238b48ff7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294625, "uuid": "66a3e2bd-27e6-4d08-a968-1546eb024f66", "value": "b4ea2e3609ac017413e931b9f27cd4b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd87f6a-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696345910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345910, "uuid": "cfcf3afb-c3cd-4eb9-9d62-9eded1b741ec", "comment": "Malware payload (Mirai)", "value": "bbdd822bb33296f06ff7c09b980637e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345910, "uuid": "0f109abe-5909-475f-bd33-a8f1e083ff5b", "comment": "Malware payload (Mirai)", "value": "a2f3ecebbb8c2c3f86409ef1d3075563ea664ca775d985dc364317c77449eb5b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345910, "uuid": "0da9e443-3ca7-4c1f-9ef4-9f1444b31b9f", "comment": "Malware payload (Mirai)", "value": "49c0a3b934c3d33056981e71d829571d0ce32afd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345910, "uuid": "6c24c1ec-0070-4964-af19-a5d1a183a5c2", "comment": "Malware payload (Mirai)", "value": "cde4077123993e1b7bb77def9912de7130f4ba602116deed7cea3e1cf8d483b5779af380c681aff6b458bdc802e95fe8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345910, "uuid": "65733f3e-4cb3-4578-bf42-d690c4fe8184", "value": "T150E2F1639372A052CE7C2AF1F97985CE2BBC4B9CC57730F32A1516282DA60535E3C893", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345910, "uuid": "ba7192b0-5514-4100-bcdb-0a728a70e1a4", "value": "768:PoiWiO031vpAPbrVWZK3XVGxm9XK4E+9q3UEL5I/:Porm1vpALgUJK1Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696345910, "uuid": "de2bb6b5-d87d-4836-902e-f631ea86a4ff", "value": 33028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696345910, "uuid": "3519a619-239e-48ff-9883-d12abbcf48f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345910, "uuid": "3a8f33cc-4f56-4ca8-8cd8-616a8be70703", "value": "bbdd822bb33296f06ff7c09b980637e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f878aa83-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696313609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313609, "uuid": "eb867c40-11bf-4bcb-b7d8-b4c114464872", "comment": "Malware payload", "value": "0008b035577fe91de489e2e17e24fde0", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313609, "uuid": "3e4b03af-22a0-4cad-af43-b10ad3719744", "comment": "Malware payload", "value": "a31ebecfbec94ec2e2fbef243529303dad5b8cd22950e07fa85cd157100962d8", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313609, "uuid": "98d91fde-ac7d-4636-8ee8-9a5cf6f332cc", "comment": "Malware payload", "value": "ed85760fc23d69d05aacfe6a35ae54fc71a96337", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313609, "uuid": "6d931ef4-a20f-4b99-81b8-f591bb86fc9d", "comment": "Malware payload", "value": "e3134b5720fcfb8c10735913d1639b67c77300ba48d8233fd890cf1743a3c97c57ad5033a803016168abfe9fd77e0e55", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313609, "uuid": "b6f89f00-f845-4433-bdc3-251616238680", "value": "T166E4F0A3BEC0877AC39373392D414C33AAAD6DF2DCC5C02A51732959D81198D67C5BDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313609, "uuid": "240017be-f49c-4de2-8204-839a237392bf", "value": "12288:P9MHPffXDlqvumwE/+dUjkIhQbJqDdkzDQHP56CA27fGGwCItW4kjlFT:lMvffzlV+fjkaQb8DdzHB6y7wqjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313609, "uuid": "60f34175-d53e-4e3f-9be4-9cb1f12e14bc", "value": 685107, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313609, "uuid": "05ff621b-b699-4122-beb5-fe2bb6c7eb7c", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313609, "uuid": "e91e9546-d050-4418-a6b5-9f2879c45736", "value": "open invoice.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "424599d2-6188-11ee-a6f9-42010a9c0055", "comment": "Malware payload (NanoCore)", "timestamp": 1696294835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294835, "uuid": "f00048a0-bc75-4a82-a10c-bb59dae96afb", "comment": "Malware payload (NanoCore)", "value": "6e65813ad51126c4fcabcf6ad9267e26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294835, "uuid": "b89de3af-b44b-49bb-af86-61ad78ea1352", "comment": "Malware payload (NanoCore)", "value": "a335c9ad21f67b44232a6f31f5605b013167628f63e7e00a3fc840a8ab9afc73", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294835, "uuid": "3c285d78-8175-4924-b87b-f325f2ed954b", "comment": "Malware payload (NanoCore)", "value": "24918b78ec2c68569ca9c5236b5f56bc09ea3f48", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294835, "uuid": "9335bb0c-0fa4-4302-8540-3ac2029de78a", "comment": "Malware payload (NanoCore)", "value": "31affc0cbf10544e8902f352d925bbf7f4b9e503007002e31383e6cdd55a085c2d8542a683e4d2977556bef9d19906db", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294835, "uuid": "c4d5204a-f7a9-4205-b861-7091b0d0ab9d", "value": "T115C4DF93BA9B8FD7C1E235F3195171DD1AB58C240E51C257A3A07E3CF877B02CA16266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294835, "uuid": "fd5941d2-4311-4b63-9d37-fd250acf4775", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294835, "uuid": "a68bb2f0-7a3f-4864-8795-6f96bfffb96f", "value": "12288:6nPdx6ltZqggFJbkdQRYPa1RTwexrKQQaZdV+RzA:GPdx6bozkQOP2c28aZSO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696294835, "uuid": "3c412b27-4369-4f92-a068-873a0def8285", "value": 592559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696294835, "uuid": "600f173d-23a4-468e-82b8-838b9c6cc10e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294835, "uuid": "39b7ac38-5848-4e3d-8f81-dcf7d43f6dd0", "value": "SOA00291.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85824ca3-61ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696339186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696339186, "uuid": "51f30334-b4aa-4888-9337-6cb942d9520f", "comment": "Malware payload (Formbook)", "value": "9e585f302a6f5d840249254fe3e1a4a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696339186, "uuid": "b7150d96-404d-422f-b3d8-44ee4655c6cf", "comment": "Malware payload (Formbook)", "value": "a3e03018e2dba7a61cd424c3b09864decf28815e7a3d84187f68ebaa395de908", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696339186, "uuid": "aecd929a-11c7-49b9-9c18-7fabc2c057c4", "comment": "Malware payload (Formbook)", "value": "1fffedef360d3314d86252ab60756f6474703262", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696339186, "uuid": "8de17e66-78ad-483f-a7cf-f44c4894c1ae", "comment": "Malware payload (Formbook)", "value": "53ff25561675c408e5d66626a4bdbd80d6285e66f6b009589481cb4909fbf932783af57094bc15057738567835ad9f2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696339186, "uuid": "81f5bfb2-7317-4c1b-a080-0ecfb63f995a", "value": "T105842364ABD3F2BBC221CD350775D6213793E2120596090F2388DA1DF972698F96FB87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696339186, "uuid": "c26e9a5e-cdd0-4597-b9e9-430d02e7d75a", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696339186, "uuid": "31d82f19-873c-4f8d-a6d3-b5a876d607bb", "value": "12288:BnPdw+Kj8e9dJPmdvchG5UTs4kvmbAAjGEJ2ZubUN:9Pdw+KgeD0v+G5cPkv+RzuIUN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696339186, "uuid": "f48cd87a-b253-40c7-ada2-8217fd1e15ca", "value": 402168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696339186, "uuid": "e54eb26d-c93a-41aa-bcbf-a00e947e07d4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696339186, "uuid": "87e7e818-2aa4-4808-9a53-7c34fdaf8feb", "value": "INVOIC_78354_10_2_2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e46223-61c4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (WSHRAT)", "timestamp": 1696320629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320629, "uuid": "5e5c8b91-c0d7-4856-b7a7-3abac9ccf1b9", "comment": "Malware payload (WSHRAT)", "value": "aefbde8b2feb2370f55b45f7c9fb33f8", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320629, "uuid": "ddc6f82f-2902-4407-b5ec-b514c11cfb6e", "comment": "Malware payload (WSHRAT)", "value": "a4091f479b77f96865cd035492ce534e54dfaa59178cf74e2a045fa5d0916b8c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320629, "uuid": "c8927eed-efc4-4ef0-a630-c370c89d6e07", "comment": "Malware payload (WSHRAT)", "value": "5bcee2dc04e6bef1c9753ef1b8d86e55a46a94de", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320629, "uuid": "a348b627-7280-47e8-a060-7aa6b8850c32", "comment": "Malware payload (WSHRAT)", "value": "ce6511d0a8c41ecaa181584febdc965779e212132f270dea391a38c9d2870e26ec751e92e4d52c87f9e6edd2b9401e25", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320629, "uuid": "698ec980-d2cf-4d8e-a58c-b2b99eb1aa0c", "value": "T16125F9C639F85A0297A7E6B4C331F132ED75EA123D9211C279D83A46AD37C407D7AE24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320629, "uuid": "52ff76c7-9ece-4660-afc1-7e997cf7476b", "value": "6144:MQPp6tU2vR4K1zzGxx29tUHwYwdetKadJjXqs4TSBdWHYa7iiRhqb0YDFL0jEhHb:Xj9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696320629, "uuid": "6e893e2e-de7b-4caf-81a2-ea5e6aed39ad", "value": 964600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696320629, "uuid": "06b56756-0a04-4613-b75e-020a5ae6282f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320629, "uuid": "e73861c6-06c8-4b18-99dd-eee8d9c59bac", "value": "proof of payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396c5eb3-61e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334333, "uuid": "3bf1cf54-471e-43d6-aaf8-ecbcf7f44e57", "comment": "Malware payload (Mirai)", "value": "658ef4dc1968c1ee55db0789bff2ff21", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334333, "uuid": "55663787-721b-46fc-95a9-3c9cd439051b", "comment": "Malware payload (Mirai)", "value": "a441e2185b78bd59f3c4aed2d7d582a2835da9ac08c86d698363c646507b723e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334333, "uuid": "45e4d7e1-1f60-4638-815e-a4c5b14a2a20", "comment": "Malware payload (Mirai)", "value": "5c4ceea3171d169273278fb50d7076e734e864a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334333, "uuid": "e97224fa-c9a8-4972-8704-c27a0108a6df", "comment": "Malware payload (Mirai)", "value": "491788f898b847b39cf2e8ebf9bf23997078319dad599e8fb76ed3edd5953008f6c0dbedfe28e48d35e05e7bf8c65f94", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334333, "uuid": "1a9d2533-6571-4aad-8cb8-121041b367ed", "value": "T103730746B9809617C6C11F36FA1F439977374358E3EB33029A29AFB16F47B2E0E26115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334333, "uuid": "3559dd49-7f53-4ee0-b7b6-3ebf30666b71", "value": "1536:7s2UtNJhLc0lnJOw7l6kUd16k+6vme/Eg/SYUQUn+oPBil:g20PhLZ5PwtmesESYUQU+oPBil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334333, "uuid": "1df3d25f-8193-44a8-bb07-01d1e53e1014", "value": 78127, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334333, "uuid": "808ace6c-7c38-493d-b2ff-f221ecabe436", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334333, "uuid": "8162e916-3bd9-4b68-bd52-f19fab0ff8ee", "value": "658ef4dc1968c1ee55db0789bff2ff21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31c7b6a3-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696345917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345917, "uuid": "ea0a2c70-2bde-464b-80e1-cc8f5e0d272d", "comment": "Malware payload (Mirai)", "value": "c008d900a3222da1e8c290a43b99c49f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345917, "uuid": "8c079416-6822-4470-ab82-9200b1ee5ab1", "comment": "Malware payload (Mirai)", "value": "a47c5304fc629f72f91088d4a6b72390483d41e46fffee3a736f97228aca3612", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345917, "uuid": "cac079f2-bc9a-4aa6-9349-6b138a7c6c94", "comment": "Malware payload (Mirai)", "value": "3706523cb25340718d423785677e5487c63ae3f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345917, "uuid": "4851cfae-0c1e-4ddf-9bd8-59e910c97488", "comment": "Malware payload (Mirai)", "value": "bbefa9f674eea15e6edcd36268760a67991a0f88a0eeb089c3862fb137ec206d5cdf228f1357296d5182d06309e7c49a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345917, "uuid": "e226c1f8-71a1-4673-9ca5-2fe59e46b63d", "value": "T16D536DCAB8119E7DF5CBE77E84220D0EB821726150931B17BB6FFC837D721A48956E06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345917, "uuid": "9fcc0f99-e587-4f44-89fa-c2f561fca4ec", "value": "1536:AXyRgQF4TbSX5lxLepSGY5cFnehON2PPB+qG76E89:N1TjJ8EVGOH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696345917, "uuid": "2a6be4fa-ad62-4106-a747-3ac2a949d3d4", "value": 66504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696345917, "uuid": "7b11f743-f2d6-4ba0-99db-37d09fcc49d3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345917, "uuid": "fb5f7ab9-99d4-4f8e-b2a7-8abec3eddcc6", "value": "c008d900a3222da1e8c290a43b99c49f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16e6f1ef-61c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696320102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320102, "uuid": "cfd316d0-dee0-47c7-b762-5636e7d01f22", "comment": "Malware payload (Mirai)", "value": "17fff4060029ea6f590e32720d17163b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320102, "uuid": "0d11dfd4-2344-41f8-9e70-590944b61eba", "comment": "Malware payload (Mirai)", "value": "a4ad91f94991cfa0d1f7f483c995b2b79559f03ad023b835d7b6c0d51c8e9d04", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320102, "uuid": "d4506689-c24d-4153-ba04-cec8c9f9034a", "comment": "Malware payload (Mirai)", "value": "4e361466d633b22539d3ceec129b1a78216c6ab3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320102, "uuid": "f695d754-b456-495e-bd8e-87f5c09dc8ad", "comment": "Malware payload (Mirai)", "value": "97c3b002dc8ff58e7b6fbd90a4cc04a5786316c0304e17e0de8239337d60bbf58f03e798c5801c786a56d99d62685c83", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320102, "uuid": "67b89529-7908-4833-a683-0b8eec0e7bc5", "value": "T117C2D038D1B45EC6DFFCACF88955DEC0B361AF1C6261ACB061619B4129A04271E29FE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320102, "uuid": "34261aa7-6c50-42f5-b691-b6a1b6768307", "value": "768:EsrWas2n/piCVC65MZ2qfDsOSlGs2VHcLLbjk4uVcqgw09+N:b62BiCwmMZhDsOs2hwLb44u+qgw09+N", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696320102, "uuid": "26eaace6-22ac-44e6-9b39-e7278f6aa4d9", "value": 27176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696320102, "uuid": "fd3e0209-fb68-42b2-b3f6-a10ae861b2b7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320102, "uuid": "31406ba1-f2d6-494f-a0fc-1a4d69d5a508", "value": "17fff4060029ea6f590e32720d17163b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693aeb1c-61c9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696322817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322817, "uuid": "70283762-b3da-43d0-8236-278887d6140b", "comment": "Malware payload (AgentTesla)", "value": "c3d6528d2ba2f2ea40a74a4170b4b63f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322817, "uuid": "bbb690ea-0c1c-4b52-b61a-a965960c6091", "comment": "Malware payload (AgentTesla)", "value": "a4d9ec0bbdb5fce74ca575a65f549284c4370f104d5b143ddf591b5869d9ed5c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322817, "uuid": "695f8433-15f1-4145-a1d7-dfd4373ba6bf", "comment": "Malware payload (AgentTesla)", "value": "ce0d8769d41feee9076c3e9039772bfedcd55ec5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322817, "uuid": "94cae4fa-e833-41ab-92c5-346ba6366641", "comment": "Malware payload (AgentTesla)", "value": "3397ae8ce2b285f3b038214471c261e0d0d2144dfe922d62f9edd12f8def7794165249b3947316b6d17e705cb684fef0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322817, "uuid": "6709b845-904d-465c-a5ad-59cbcf91f872", "value": "T1D4C4AE2932ED7A45F07BABB8D3A81358C7FAF2D1537FF2AD6D81018709629418F13216", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322817, "uuid": "eb46683e-a496-40f5-a886-c8d286e45f3c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322817, "uuid": "42bc4fa9-e263-4b27-b826-eed36d26dd34", "value": "12288:p8/ynLFPvP5kJRi0tjXmrfVgFtnAnBhRETXKs:pDLFvqiujXcIWBhW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322817, "uuid": "6dfe6766-7bf4-4c7e-a35f-3ee67d8c6d00", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322817, "uuid": "5fef3e68-4963-4da4-b9ef-091d8381d4de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322817, "uuid": "74d82de4-1813-42eb-b576-69c2a3d5ccce", "value": "ScanCopy031023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b8f7f4-61d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696327205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327205, "uuid": "d758c1b5-d9bb-4b43-b806-8ddcf1b37b59", "comment": "Malware payload (Mirai)", "value": "d046b585fdcdf3f021f511ebec3ea4cf", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327205, "uuid": "f9750060-a3ce-4e03-b636-e1741d08a4c5", "comment": "Malware payload (Mirai)", "value": "a577affe3a7b31e43f4fdea410f7ee965b73cbc0983c83d295135ca35345289a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327205, "uuid": "04610d45-0a9d-403b-be9f-b2d9741639be", "comment": "Malware payload (Mirai)", "value": "736b705477f526f432c9d722aba13b65e2fb49a0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327205, "uuid": "065fd72d-5aaa-4662-af7b-e1913866a778", "comment": "Malware payload (Mirai)", "value": "457c2ed1b12fe2bfce43798dafbb56acdfe730a3c8025a43e73c00ee0c1d189875ee0e8dd352d28f1ee68af137f41234", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327205, "uuid": "e5ca6181-5623-4ab0-8819-6b7834510861", "value": "T103C2E0E67D7B7A9BDB2A103938AA8D369274F162D75F7213D202420C20171B8BB7249D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327205, "uuid": "6212f3e5-9bff-446e-88fb-867f78830147", "value": "768:HMwKDZOFbBy6sSHRYfeAxdd83OhXZE2Znzk9FNy:H2gTYfe6Kedaqzk9Fc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696327205, "uuid": "875daaa7-dfab-4ad5-a224-7a8687c13217", "value": 28272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696327205, "uuid": "2473de00-d8e9-46ca-9c40-1913bd3ff740", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327205, "uuid": "3a702313-68b9-4c12-ad31-e39af6b1dad8", "value": "syms.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b158169e-618e-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696297598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297598, "uuid": "4a6d1d69-9647-4723-b3c1-506429404fd0", "comment": "Malware payload (Mirai)", "value": "e76e6e086254a419ffec4dbaa8aeb871", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297598, "uuid": "c39e72bd-62af-45d2-ab4d-20cf2a518a2e", "comment": "Malware payload (Mirai)", "value": "a6213f96ace62f1ac19a922c3cf9cd8c99af1592219c8d47a46ae0ca11545076", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297598, "uuid": "3c34cad6-30fc-417c-9cd7-fa2f187e34ed", "comment": "Malware payload (Mirai)", "value": "492565e35aabc2fb133527bdb95db79de8954313", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696297598, "uuid": "fd05cedc-f83a-44cd-80aa-5110058a6515", "comment": "Malware payload (Mirai)", "value": "27a98d7ebf7ecdb8e294bc4753830dd47a879281aa17cc35a68cffe7fc31625880c86b9b968bdfc75c4d7f804f70a8b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696297598, "uuid": "203b4a1c-31a1-41d2-af5a-da205bb63d06", "value": "T1C982C072B3AA7472DEB01476E88E068037D71AB1602360354F6453B4B5B58E38B795B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696297598, "uuid": "5fecad63-8486-4f70-a775-be781de3e0c6", "value": "384:AVXfePkba8//qBGv4WRFwNukQtFlhr6B0c3oKyLDjmdGU5Ez:A5ePLRWjwNtAHhGKFKYn3U8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696297598, "uuid": "0b9c8a89-f7f9-4921-b8d6-880cf62e2739", "value": 18420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696297598, "uuid": "ab38712d-87f7-430f-9147-d5ab80ae775b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696297598, "uuid": "7cf98766-2b27-4fa9-ac18-8b81c35bc552", "value": "e76e6e086254a419ffec4dbaa8aeb871", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94840af6-6195-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696300556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300556, "uuid": "6ca79f83-7ce1-4e00-9bb1-048ee240fa26", "comment": "Malware payload (Mirai)", "value": "36ed6f19364d3d6302aaee9dea27650a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300556, "uuid": "ffb41f02-9404-441e-bf3c-ff72b01acf76", "comment": "Malware payload (Mirai)", "value": "a8a75071fa5690945698dfb71900fece88450a0458e71551e5aebe8aae84ac3a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300556, "uuid": "a9f0e8d9-c081-483a-bf2d-e132b0f088d2", "comment": "Malware payload (Mirai)", "value": "a3d210d91d970007653eb5736e97bd4060c292fd", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300556, "uuid": "f1e68a2e-f894-4fce-8e38-58e267af345d", "comment": "Malware payload (Mirai)", "value": "a0bb830edc4c03fec1eb6ab1571220814e8547245f3be2c0c734bbf9e531f4c71c9d389f648a332e3ddf04f5a27bbec5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300556, "uuid": "c3d417dc-d3a4-4c14-aad9-df12fea61db9", "value": "T15DD2D0A985E7F1B8D0E666B6003907C5FDB67216C22A07B70CF93066EF071C95E31DA2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300556, "uuid": "7e8691bc-9baf-4b5d-8b0d-45b495a965aa", "value": "768:NYSoXdJZETc51aBfdNRQkHy3xWEMcw6qB6YgvPsSSx0sk:NYJdJZiy1aBnQfTqBjgvPKtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696300556, "uuid": "1da42587-0ab0-4fa2-81f1-5d7185f52258", "value": 29440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696300556, "uuid": "45564374-e965-462d-8d05-6873d974e937", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300556, "uuid": "196f5ed5-0e54-4e95-bd73-f2bcd23fe4ee", "value": "36ed6f19364d3d6302aaee9dea27650a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c8b7585-623d-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696372591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372591, "uuid": "820ee2b8-571a-4be3-acbb-7c8cecc8ae4d", "comment": "Malware payload (IRATA)", "value": "b78918c80c39ece17143a34f751e2a21", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372591, "uuid": "5dc41337-ca72-4b81-a05c-3a3f373005c5", "comment": "Malware payload (IRATA)", "value": "a947ff41226a0d3ff265677f36fd53ed4f159deebf640e6d46a3fbbd64d3006e", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372591, "uuid": "41d0fab6-b661-424a-8112-9e11f4f77a99", "comment": "Malware payload (IRATA)", "value": "54704e235df091aad794d38c99dae68ce0987c04", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372591, "uuid": "e9c0bfbf-00c6-4fdf-998a-b5c0b6771da9", "comment": "Malware payload (IRATA)", "value": "0926fc94c55efad982f53f8a28ba4bd207af0548b17ef76221acfa8e568d931562331e3dcfe8f3e045101e91367c457d", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696372591, "uuid": "5ef87b53-d9e8-459f-befd-35553d4c5c85", "value": "T13AF5AD97F395696BC4F38372817613A5514B4C228F83AFC76D28763C28BB5D42E49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696372591, "uuid": "b69ecb01-ce08-40b6-8ec0-8c71d0f0bbc5", "value": "98304:MT3Bl9eu6gLCrgPoSNwYfa9Gn2XIMQuKyN:MTvBoS+Ma06IMQuKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696372591, "uuid": "225d2fd4-d608-468f-8d50-36aaa898fbe4", "value": 3455879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696372591, "uuid": "b120d2d1-c56a-4bd8-ba9b-409a356fdca0", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696372591, "uuid": "96bcdf19-a469-4cc3-95d7-2f5aefaa4f9e", "value": "KissHub.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f4a323-61f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696341285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341285, "uuid": "5fec705c-dec0-4f01-a8dc-e011fa04f637", "comment": "Malware payload", "value": "9bc177c5ca578fc6c2d639aaf61ac6b5", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341285, "uuid": "62668bc5-f7ad-4ef9-87c6-fa6b16aa5552", "comment": "Malware payload", "value": "ab02d282f4fd3fb865bc44f5551e1b4ea795857af2b6ebdd01288b1f0824a1bd", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341285, "uuid": "5bdd15ed-48e4-45ff-b96a-1914381f57f1", "comment": "Malware payload", "value": "dfcef51f4d9d8fbd31f60246d77f5cf729b5b63d", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341285, "uuid": "21c14478-6ae2-46b4-b779-fe6f2f2d098b", "comment": "Malware payload", "value": "17d555984805ca2c58c32cb48ebe30747ab09282fb74d5ad17fc595cde81bceb0eeeb58a13dea0685f3632ba6fe6a541", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341285, "uuid": "fd5d10c3-2873-4ae1-8c0a-7af7bfa92626", "value": "T171B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341285, "uuid": "88d39fd4-f3c9-439e-a57c-fef485049d25", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341285, "uuid": "ab87a4ca-57d5-46c0-8a76-28e60dee82f7", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341285, "uuid": "cac9a3d2-811c-48fc-968d-7b7394e888cb", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341285, "uuid": "c70a58c7-a540-469d-9f92-332cab6b3f14", "value": "AppleApp(47).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23fe6b5-6234-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1696368950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368950, "uuid": "ce05d5ed-75ec-404d-a6ed-fc89ebc9ae5f", "comment": "Malware payload (MarsStealer)", "value": "934e42ea44292ec3fa7a0f609824e2af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368950, "uuid": "1ef2b468-022b-4e44-8f17-a45a264bf99a", "comment": "Malware payload (MarsStealer)", "value": "ab3c710d9fc4e1bbf83b6a6958a90205968c6bfa51d6dd415ede8ff1df0d3ec9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368950, "uuid": "926de472-1264-49e0-9428-dcc1c9e8808b", "comment": "Malware payload (MarsStealer)", "value": "70c3a2f412b528cc4b8a0d189254cf9a496d0015", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368950, "uuid": "b409670c-0d63-44dc-ad01-3d6ef79a5591", "comment": "Malware payload (MarsStealer)", "value": "37fe7c39ab9548d37713ae5daa776d36e2f8965581f0e231a0a10804420eff70eb20f5ce297a4f518c7ec500b6179fc4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368950, "uuid": "4b279111-bc64-4aa7-a6b2-22c6a2d75a4e", "value": "T1E254AE1372D1AC22D4721A315D3AC2E53B2EFDA19E6957DB33583F2F58701E19A62B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368950, "uuid": "07d6f9e3-7ea3-43cf-ba9f-50112f6f9232", "value": "75b76fec2d6c17598f5493b9f58c5f6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368950, "uuid": "716ea61c-82b0-48ab-8a9c-008920bf3383", "value": "3072:W68neruRzjPsv76qvp7i5pX4B1L3/N71iOAWdY:78nGuFjPsv9Vi5hOL3/N7FF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696368950, "uuid": "20f24a79-b985-404a-8a70-fe2ed79007c6", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696368950, "uuid": "e844aba6-3f66-467e-8e41-a2ee22e21102", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368950, "uuid": "d49ffabe-df67-4f0e-9f98-58993014814e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6819569b-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374355, "uuid": "4f3d1d31-c3a5-4729-a556-deccb8c49b77", "comment": "Malware payload (Mirai)", "value": "b1d4314ce23bc3e3aa49082ad43f895b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374355, "uuid": "52711c34-cf0f-475a-a72a-3096a3bd01a6", "comment": "Malware payload (Mirai)", "value": "abbddcc0af503f10af04e6dcf98122d7fa1862f900879640aca17efaff2e410c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374355, "uuid": "4eec8590-7594-48d9-9e11-5da60da35806", "comment": "Malware payload (Mirai)", "value": "f0a5649c24a698b64f613e750be3e82b60c0fbbb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374355, "uuid": "9f7919b5-9129-4137-ba85-22af6d82b226", "comment": "Malware payload (Mirai)", "value": "a4e679e10018bce7022dd951bda231f370a58a457a8483a35fd1040e84414c24f450f0ddc33794adb9037d21cd793d86", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374355, "uuid": "bd9b2513-8708-4bca-813c-4b3fbc47adcd", "value": "T17B431845BC919A12C5E422BBFB5E818C372523F8E2DF7207DD222F51769A81F0EB7650", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374355, "uuid": "cda2540b-c214-4b13-9037-0f1bb5e81912", "value": "768:g2DKq9foPc7SuOLVXj5NpkCfq3mBSAc4/9VHivUIABo50IyhBYWz/h0bwYbN14tc:yqdoPtj5z7q3mBScJIMBYWz50h43JLa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374355, "uuid": "5056da84-51fb-4788-a069-0f39f164eed0", "value": 56616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374355, "uuid": "d8c2ff92-0c04-4e53-8067-e69305b4e21d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374355, "uuid": "51167e90-e1ef-4ec4-82bd-158c1ede340f", "value": "b1d4314ce23bc3e3aa49082ad43f895b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cdc63ce-61c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696320327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320327, "uuid": "c06b15bc-4399-4d8d-8517-bbaa21957ee2", "comment": "Malware payload (Amadey)", "value": "7fdefa29d58c9b920392d13da8de17ec", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320327, "uuid": "4c0cd558-7c6e-48db-b0a8-a435b6d849b2", "comment": "Malware payload (Amadey)", "value": "ac0db3f8c382fc37ba05bc45a8f5751853b9a37e445f1e7dbef4a0ad65a3ab7b", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320327, "uuid": "8fb4dfcf-a44b-4b51-b228-157fa3427203", "comment": "Malware payload (Amadey)", "value": "f1553ade4e35f30f0308a0bb91ac1a23d88b90cb", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320327, "uuid": "6735951c-0fce-4952-aa1d-41d5c0bf5cfe", "comment": "Malware payload (Amadey)", "value": "7d58b3d1c0cad17937d355ef77838bbc997cb07b5f224aa2911a772e1dcd52cc0c9db24be0d19774fb1e1e17a17288aa", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320327, "uuid": "db0fcabc-3fb3-4d1d-97c5-48b20b4caea9", "value": "T17ED5F52CEE259B23A235E13BD185550BF9A51587F13A5F0E05CB4B896A07A433FC9F8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320327, "uuid": "73656651-5ec2-4385-a9b0-29867e56381d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320327, "uuid": "5f96ae1b-1f01-4b3a-8c01-352452052548", "value": "49152:G0OQO2skBjC/3H4O/vcYwHqnJOHUX9M6LSm+SUkR:G1QOKmt/vcZ2OHUtM6LSm+SDR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696320327, "uuid": "5bbe0c8c-80df-4f05-9aa4-0d051b8deccb", "value": 2990080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696320327, "uuid": "a7009ab9-e84a-441c-b79e-e65fe22d4e51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320327, "uuid": "c624e629-9468-4622-912e-5d053db24976", "value": "7fdefa29d58c9b920392d13da8de17ec.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08729ce9-6199-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696302039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302039, "uuid": "57712c26-da3c-4eba-b370-0710d95ef12d", "comment": "Malware payload", "value": "4a17a81693a9b4dcd1466bc71eb08016", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302039, "uuid": "af15ba59-1290-48cd-9977-cb31b411e4af", "comment": "Malware payload", "value": "ac89dbce110db24016f8342e133962aa0bcda641bc14fc489bbe20c1070736b6", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302039, "uuid": "3468b066-59a2-43a1-9b83-c813e32e76bb", "comment": "Malware payload", "value": "36118902e77d431ddb7f5ad8ed83f7d694121728", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302039, "uuid": "893a3a3a-04f6-47a0-896d-67c4a6d14acb", "comment": "Malware payload", "value": "94a567d31f3f7754297cc6749762eb569d30a8186bf267cf2091536873549f440e93e0e5a576c17f2917d3b12fd77000", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302039, "uuid": "9ae96915-5ccf-4a49-8149-264bb93adcdc", "value": "T1A4E07D25758B2DA1E441DFFA74CA87710271F52402A462DAC69934357FF274E18B1D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302039, "uuid": "f4f81a05-4169-440b-a3c2-bc80c3f8f704", "value": "6:5j+tg0mVrixmsfic1L1JxSiXwStysIq99wpaCjYySBtqknRu+lL:5jqsVrYmsKc1RJJweysIq99Ipjcq1aL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696302039, "uuid": "e7e018b7-ff8e-4861-b61f-ca092b9e5c55", "value": 343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696302039, "uuid": "a626ddda-555a-4e2a-9797-ec9ac3434df8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302039, "uuid": "06f14721-69b7-45cb-86ab-177c14b27e4e", "value": "Disposizioni831.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ee3cb54-61e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334343, "uuid": "c7db6fb5-a4d7-4e13-85b6-2eafad29d876", "comment": "Malware payload (Mirai)", "value": "b120d97f3205a24737e67d37f874b981", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334343, "uuid": "3ec61c5d-d527-4787-8653-8cf68ea954b1", "comment": "Malware payload (Mirai)", "value": "ad157e758e8b8caf40fe9880570ceecafeee449c03eb85dd6e2377bcbfe874a7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334343, "uuid": "979b840a-abd2-4b76-bf50-4bf0f0cc6b3e", "comment": "Malware payload (Mirai)", "value": "90c9aa04f1fe1495316b5911e0f54b2e51e55289", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334343, "uuid": "478d994a-0b77-4c62-ab6c-69cf0ec21400", "comment": "Malware payload (Mirai)", "value": "9f81656df46a227314e07de969c8c7147c92105897f0c3b60fd05500d2d557cbc616f3c817ea2d182d525cdab276d9d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334343, "uuid": "1486db5e-0623-42b8-a2a2-4d1807f35a1a", "value": "T1E4630846F9809613C5C11B36FA0F435A77364309E3EB33029A2AAF71AF4772E0E7A555", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334343, "uuid": "58de7b3b-7104-41fd-98df-5ac44bc3dd1e", "value": "1536:E8bBwWVqCKqqflqOVb0PlIQI62Im76pblf8zw4EOky:TbrqCKXOPeQNW76pblkE4EOky", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334343, "uuid": "8685e022-1dfe-4aee-abcc-12942b8daeb9", "value": 71705, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334343, "uuid": "e22a5a07-bfb6-4dab-b6a0-d7e8b468e8f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334343, "uuid": "b3d14329-1058-47de-a5ac-ad3e19a5bd8d", "value": "b120d97f3205a24737e67d37f874b981", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eba0a65-6197-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696301405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301405, "uuid": "2fd0bc76-6680-4d8d-8380-b16b28e3c922", "comment": "Malware payload (Mirai)", "value": "5a74977621d622ee17feb628350c8b1b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301405, "uuid": "91faf7a0-9619-4423-9df1-bd476e361537", "comment": "Malware payload (Mirai)", "value": "ad197157a4244e4e3f1035c6586a5a760da4226522d8775054641d73da174683", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301405, "uuid": "47d9bed0-892d-46b1-ad7a-4d9aefe6ee55", "comment": "Malware payload (Mirai)", "value": "a246e519fb5a15297fa7cc5fbb1541b3798e247c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696301405, "uuid": "43f45954-6a87-4739-b034-656798bfea71", "comment": "Malware payload (Mirai)", "value": "3e851ca5b717533ef70561adca59640cf477723d9e915096eef7a5849f5be3d158bf38934062506da4c5a40c761e62f2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696301405, "uuid": "040b3524-0b7c-452a-a07f-826c0855e26d", "value": "T13DC2E1BC7EFB5F83CA1B00356988FE3382B095A5D35B7697B24441026C131E5BA67C95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696301405, "uuid": "55b63e94-2b84-4e85-b9d6-c1b108de3be0", "value": "384:MG1DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjG/+Y:HMw4DZdFbBy6x3K/KdWnH5fjT0N8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696301405, "uuid": "b5401e7c-680c-4bc1-99be-1a90628df060", "value": 28056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696301405, "uuid": "d9f7e383-119f-40c1-bcd8-ecdd2879ef15", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696301405, "uuid": "d1d7fad9-494e-4bec-a1bd-d8038d178020", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efe86d08-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696341082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341082, "uuid": "e7413f0f-3ff6-4d1f-9665-04b5df9bd845", "comment": "Malware payload", "value": "d292f213943d6f38730fb9223546f43e", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341082, "uuid": "f9462f43-4b85-494a-8525-fce19b93aee1", "comment": "Malware payload", "value": "ad3b254df2ce1043a9c29a106b450856935a04a12b419a4bbcbf8d002f62c78d", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341082, "uuid": "8ebdee74-431b-4e65-8243-4773df4eb85d", "comment": "Malware payload", "value": "74fd882cab7bcfdbe452f897f502d613b9486223", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341082, "uuid": "772c31ae-b486-4b48-9099-8f213da89af0", "comment": "Malware payload", "value": "91507dfe12758f18556c8a10fcef974a2141b48ac5226e0e8b10a02f8068b1d2886c5b081c540a8e4099fe01fbf92c87", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341082, "uuid": "bb44db9a-80f0-464b-bb43-83143c9c11c0", "value": "T11845BFB876047DE6266F53ABDA96ACDD03B6172399CBA4CD80647BC305A3375FE02C05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341082, "uuid": "bd9cd656-0800-403b-bdd1-461ce0c19498", "value": "24576:s1i1ekBGwkOlWZoG1WNsBTPNnNWXn6w6UN7rGkYAm94ZNWBsPldHlsKwH7:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341082, "uuid": "461698b8-ef8c-40bd-8141-37b37d76de5d", "value": 1230871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341082, "uuid": "7dff71a7-1f95-4f8e-80f4-bc5f18309e59", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341082, "uuid": "3c57a609-5c8b-4f7b-a4a1-08b57b6c870b", "value": "Test Order Table.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7b8b75-6180-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291577, "uuid": "7de1defc-e90e-4e61-88ec-967a2b23ff63", "comment": "Malware payload (Mirai)", "value": "6ea7e2a021503db7c4bc8c8baaf45b8d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291577, "uuid": "d83af2c8-1478-481a-81a3-43813574ce8f", "comment": "Malware payload (Mirai)", "value": "ae0b116fe461f9553e27f1563fb0d7359503e0c10715d3313d49c5258afeef90", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291577, "uuid": "fed037af-4d24-4c9f-8a8e-16a5d9f8b17f", "comment": "Malware payload (Mirai)", "value": "aea13c7b9a86dffedd2bf49e7035ac2f3ab35bf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291577, "uuid": "fa1b83e8-110d-4fe4-b1b1-a39aa97f8fa5", "comment": "Malware payload (Mirai)", "value": "4e50217c69970bd9b2347c829b413f7c537d776ba6c1814ac53a267eba023a0393ade8b2ba18119ef3eff9e9114a2d43", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291577, "uuid": "f964588b-4414-4960-84a5-bd8a75147d87", "value": "T186537D76D4696E8CC5964130A429CA3A1F73D0C493876FFA0AA6C679940BEFCF504FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291577, "uuid": "ce27dfc9-c4ac-43a6-889d-5fa6075c8c66", "value": "1536:DkW4HHwt3XkI4GKtVBezw7xKnqH2tFikCKCATkJ:D/4nCZ4GUezw7YnfFik/TkJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291577, "uuid": "3bb1af7f-f14b-4c23-aebb-3add9dcd480c", "value": 62772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291577, "uuid": "3f15d289-eb04-44be-b286-0bf0b94f5f02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291577, "uuid": "47d5a34f-47dd-4501-a76b-3e2b4cb8565f", "value": "6ea7e2a021503db7c4bc8c8baaf45b8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b91e57ae-61f7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Pikabot)", "timestamp": 1696342708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342708, "uuid": "afb48562-4d10-43c9-8de8-09150901df2d", "comment": "Malware payload (Pikabot)", "value": "ec8db58467d8e2e2221635c592fcca1a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342708, "uuid": "710b829e-5513-4e62-b45b-5aa1776d6aad", "comment": "Malware payload (Pikabot)", "value": "aebff5134e07a1586b911271a49702c8623b8ac8da2c135d4d3b0145a826f507", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342708, "uuid": "c5c979a1-83e5-43c2-85da-ce54533e1f47", "comment": "Malware payload (Pikabot)", "value": "e0215d156d2dc59b6259fd5ff792dc740626c8fa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342708, "uuid": "8601f6f0-5391-4808-ae7d-9c8857cdfd35", "comment": "Malware payload (Pikabot)", "value": "9e38a0205d9e0839b51ff2b2a87ecd186baaf27777dcdbb36f07e7f61705fda20ff3572d625b9f7d3eb08d93c2b67106", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342708, "uuid": "fc581420-dd6c-484b-9fb3-d1a3a5601b57", "value": "T1B995592DFAC97FE3DD2360B3A121159099DCCC469B52EBA3C5916733B65A33C9CA7240", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342708, "uuid": "ac8a99dc-5b7b-4d3d-9e57-49706189efa6", "value": "244d8f9f2c625c07accc7836974657c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342708, "uuid": "2bd2d663-799d-4fc7-89a4-10c91bfffb9c", "value": "24576:FSfBk+9Zl7pC4HE+Y/lU/Z46vVJkWuQpJ53am1u46FxVDmdVxoejIF4UAVddHctD:6kFhgJ8m1u/CVxodFSfd+WC9J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342708, "uuid": "2e4cac46-0b3d-4909-a159-b7b9fdd15999", "value": 1885960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342708, "uuid": "5f01bf96-073c-4b70-8daf-8bfdfaddcb74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342708, "uuid": "bcdb83e3-5b8f-4537-b603-2b6e2ce8219c", "value": "UL.log", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f91528-61f1-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696340126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340126, "uuid": "0b62ad89-04f0-4fd9-9ad8-91d25df5e850", "comment": "Malware payload (Formbook)", "value": "8983cf278c6f06788003c170b6d8cc6d", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340126, "uuid": "56c9dbb6-bdfd-4b8f-8525-582ff3804d3d", "comment": "Malware payload (Formbook)", "value": "af822088e82ed32f7c78634da68a2f9baa8fd3b58f3b53b18120c5a0ddd67d11", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340126, "uuid": "68db7712-3ef7-4ada-8866-cf07c792cdc0", "comment": "Malware payload (Formbook)", "value": "8e6152dc70229aa904913f3f90d7d989609e17c0", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340126, "uuid": "d647ec51-0443-4446-9528-8e0970b664b0", "comment": "Malware payload (Formbook)", "value": "f927bba015f61b8dbb28aace14273b25dc920da568146ed55aa48365c350541430289f9b77c5abbf5c441883be6d30af", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340126, "uuid": "c0738344-0746-4f54-8729-3dbd639c5762", "value": "T1C8910A79A70C1887C91786B6D698BF260592F87295C30BC2932EFCE20D3B8546537E54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340126, "uuid": "a082e970-8cc6-4d86-b75d-98fb4b485c99", "value": "96:WQQU1HaqobdKw9xJ2NqMspxm6VeNaUMKbSTqMluVJSIj:eUiswt2ELpJB9s5fJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340126, "uuid": "c3c2aca1-f594-40f3-8e75-05f78b316094", "value": 4472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340126, "uuid": "d5cd60ba-8e43-45e6-baf9-4f193ffbf814", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340126, "uuid": "c519aaac-e1bd-4b91-b092-ae4ee18dff4a", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.25840.32196", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7f5986e-61ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696338948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338948, "uuid": "0e4e3ca7-90e9-4cd5-b769-5098afdb53d3", "comment": "Malware payload (AgentTesla)", "value": "b5855a31c59320c5fca189e833f8bd81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338948, "uuid": "36c7a939-e4f4-4a02-8b02-b5112fba9bb7", "comment": "Malware payload (AgentTesla)", "value": "b034f40e64dbb5207009f97873aead10cf0ad0ef0dd0f494f1125e5050c91417", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338948, "uuid": "48a5add1-5911-49b6-b134-7d79d303d640", "comment": "Malware payload (AgentTesla)", "value": "04781ba000d8cd63f0e951ea25a4c3727d7d39a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338948, "uuid": "3ac0dfe4-b550-417e-8c91-8ff6cb40028b", "comment": "Malware payload (AgentTesla)", "value": "b98ac72f5fe3c16ca7c4ed4ed80084d659527d598e49751d33124319e1fea343a8de338cce0bbdb322477afcc8e5446f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338948, "uuid": "0e83f101-d6af-4c9e-8e47-baf2a6e1286c", "value": "T14E052319DA88DC73EE574536B8F082C8E081FD9B4E3783E8FEEB940B8147B56A8555C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338948, "uuid": "50af7f35-079a-4e02-adf6-97839df46e59", "value": "12288:bwVBFNKl9Ga7Pa5aEtf/wFQgGchCwdwZXaUHVu52eJdMrBeHwnTh7G2qiwOEYFV3:b2G9GalG4FQgGcvgXryjq9eQnhG2tFt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338948, "uuid": "ed4a0f50-310e-4e7b-b937-6c129168302f", "value": 801971, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338948, "uuid": "761ee7e9-1eb8-474b-a014-b97166d2eb18", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338948, "uuid": "552d5734-b674-4770-b8e6-5256dfd1a75f", "value": "PRE-ALERT SKLZ2112352 00 SHANGHAI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f6b4b2-61fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696344632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344632, "uuid": "16bd8343-57a3-4e2e-8bd0-f9615214b24d", "comment": "Malware payload (Mirai)", "value": "d2bb054a2733703709344f69add536ba", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344632, "uuid": "c34864a4-ec20-4e7d-8967-d45e642f57aa", "comment": "Malware payload (Mirai)", "value": "b03c1c7072c3d238d1d562ef0b26da0c198fedc849e72932c4cadb89aee4c5bd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344632, "uuid": "7cfd5692-8817-4d35-8c37-cb1a869f3f61", "comment": "Malware payload (Mirai)", "value": "1fa02638e99d00754a452d2693f0aee7ae940ed4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344632, "uuid": "b226dfa7-7c9d-4398-b718-a450e13169fa", "comment": "Malware payload (Mirai)", "value": "f251d091f3d86b1a49bc818170758764e3aa97b340bbf253f907799dfcb7b184e4d4ea8089cbe938abfbbab9357c5814", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344632, "uuid": "76480424-e86a-4246-a554-ee25bce70b18", "value": "T151C2D17097AD2CB5C6500532E6F816C5BE420FBDFAFE3890214086FE3D82D1569E99D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344632, "uuid": "d6601f5c-7490-44e1-b692-0c6cee5254a7", "value": "384:ARt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEVhyhymdGUop5ht:A7soTAZ3alkXLvFh8nNE7ys3Uozz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344632, "uuid": "388bbefb-be90-48b2-803f-c59fa5652ca6", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344632, "uuid": "52a89a34-3b99-4160-bc77-e8bec59e0750", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344632, "uuid": "a9e94875-78f3-4b90-b606-291998b75522", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5954fe34-6236-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696369606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369606, "uuid": "fd38eaed-e9c5-4a07-823f-de4e2fb8727f", "comment": "Malware payload (Tofsee)", "value": "11676fb0abc9bc275e1c78038b8b3050", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369606, "uuid": "95ed4307-19b5-4426-9adc-dcab32c9b54e", "comment": "Malware payload (Tofsee)", "value": "b13a30cfbca88cd7568b6e4b5f2ae89ca6be70afb060d209ac4f57086a1e140f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369606, "uuid": "9f7d8c93-45c8-414e-8c98-84a6d1e2a6b5", "comment": "Malware payload (Tofsee)", "value": "04c0c7a79e17428918c0ca3065da0fe641fbc194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369606, "uuid": "258f1d4b-25a0-4f23-974f-6cd3225d33f8", "comment": "Malware payload (Tofsee)", "value": "18c86fad758e027ec41d564d08870b06697d376e40fdb8f0819708fe9fe1a5e045c8ce188d17034eae937b4595f0e8dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696369606, "uuid": "181ee305-05fc-4433-b879-44e11c778a54", "value": "T16554AE5276D0EC71D4625A318E29C2A43B2EFC919E6957EB73483F3B5D701E19632B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696369606, "uuid": "149080ac-848e-4168-899e-884803f0e594", "value": "75b76fec2d6c17598f5493b9f58c5f6a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696369606, "uuid": "f08e8cc7-623a-456d-91bb-a7845f916048", "value": "3072:G63yBruMSFPSDvpooTdmbj7UJ9SVspV5haC8LGo2WGY:r3yxu5FPSDvpooT8jmya5hab7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696369606, "uuid": "182565f9-c420-4603-8063-e908de24a276", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696369606, "uuid": "6cb93e82-1935-4fc8-bd13-23cb96fb80bc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696369606, "uuid": "13e7785f-9bfc-4554-a056-fd035c83f5e0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e6ec0c-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696340849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340849, "uuid": "957e41dd-602a-4c83-a4ae-c74e0f9ca0b7", "comment": "Malware payload (Gozi)", "value": "3f39517fb0f5de4ba10e72242fb6cd9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340849, "uuid": "1e7f9442-cb66-46d1-aed4-e02395f41eba", "comment": "Malware payload (Gozi)", "value": "b3a2a819e27b004310e65c2b6b000cb8444b3233271a5064e5314d9580d128d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340849, "uuid": "b228950e-8011-4f42-bd2e-a5cc112f1fab", "comment": "Malware payload (Gozi)", "value": "d9c68d8110038c21b9d1c5763eab9331c2cf3b45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340849, "uuid": "55ab4196-bc4d-4ac4-825d-664b6aa21cfb", "comment": "Malware payload (Gozi)", "value": "f0be2b677fa778936b52d7787a5a7cec34879b8c3c650d8d9cab59bbd725ae901baf7a89c1c0322ea2be0b8638afd04b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340849, "uuid": "6b669758-e7a3-4e9b-b5de-a3e38c874c25", "value": "T1E354AF1277E1EC31E4635A329D39C6E4372EFCA18E69579733583F2B59701E18A62B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340849, "uuid": "f9aa67ec-75ed-4fc6-a920-23430f8f7124", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340849, "uuid": "d2e3b58a-c42b-4033-a7b1-6fb65b55ad23", "value": "3072:pqrRrmv3TwaCRNnA/UeXFa3mSRACC2IS/gc/LRxNuIY:QrRyvDwaCRNn4XQ2wACZgc/LR/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340849, "uuid": "95cd4e25-feb9-435c-8516-5de0f2de808e", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340849, "uuid": "9bc4b195-f6dd-4c21-a19f-c327304560da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340849, "uuid": "75bec14a-0fbb-4b50-b4dd-fc3691ad4cc5", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03461925-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696357006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357006, "uuid": "5c376ab8-c79a-4dc9-b419-9da6266caaea", "comment": "Malware payload", "value": "d26602f01e273e59c49c0bf79e3a655c", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357006, "uuid": "49463905-0706-491e-83c8-ef87731b3249", "comment": "Malware payload", "value": "b3aec2e7a8c248dd0fbdf70721017a7c76522bf23d049961ddbf3f73a49ec12d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357006, "uuid": "1b170785-09bb-4af3-b9e4-8dbc887ef3ff", "comment": "Malware payload", "value": "b0e9753e9f7b15a23bca3ab7659cdbe1ae836e86", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357006, "uuid": "2cf42f38-daa5-4772-afdd-6f9c7a3d0290", "comment": "Malware payload", "value": "dc40ff9c86989c5319ab17c8b7a500a9c79e968303b3dc26301c7b812aceec2cf0a4ba8ba55472f2ff76dc8119709a81", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357006, "uuid": "cd975c07-ef70-44c4-bd63-0a434eb89b9a", "value": "T1ADB16C4772FFBC2DBE8225B882ED5751B10C007133A99245AC45B413A8669C74C5F9F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357006, "uuid": "bb802f91-5d4c-49c8-b709-65a3d3867c08", "value": "96:Awd+NZxxRErrhqZRuNkx6C47njvrQU4SyrQ+l/96RSLWJdVgALrhJS:AwdqYhqZRuNW47jDYtrDZ96ALQNLFg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357006, "uuid": "23fe3f0e-1937-47e4-a4a0-c309d125f54a", "value": 5582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357006, "uuid": "17a49943-11c9-4832-b4f5-514534cd7fc5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357006, "uuid": "e88e4d5a-0ff8-4e07-b987-57a046b870ad", "value": "DISCHARGE ABT 15,000MT COKE PET.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "339ed5ab-61fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696344632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344632, "uuid": "0fa3b9ce-4eba-421b-aa3a-6eff36d27bc0", "comment": "Malware payload (Mirai)", "value": "017e7bb8e598c155e027b3e81f688333", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344632, "uuid": "9fbc1281-880d-470d-8063-94a129a3f7ea", "comment": "Malware payload (Mirai)", "value": "b3ddd31ad69d8c2a6593f5542b65b9be419616c51d0aca5480ca332068e3aa9d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344632, "uuid": "41fc737b-3c3d-4262-9986-75c943e0cb41", "comment": "Malware payload (Mirai)", "value": "9b7dc3c268103d8db6d7098c29225ad03a3fe741", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344632, "uuid": "c310d058-d395-4d5b-8106-4c8f5fb9f14b", "comment": "Malware payload (Mirai)", "value": "0c68de87363ee29368d4a6fc747f877e463bcec68444978d53a3350c9db7bd8e1ede5ee00a5f01e41bc2375ce723e56f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344632, "uuid": "a08e8106-d326-497a-be86-add2cf2d9268", "value": "T18EC2E170A6AE1CB0C7500572F7B856C9BE524F7DE5FE2880224057FA7942D0929ED9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344632, "uuid": "efff10eb-7f1f-4df7-8a64-ebfb6f47cc59", "value": "384:Aot/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNEZ7+0BhymdGUop5hr:A8soTAZ3alkXLvFh8nNEZ7+0Bs3Uozx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344632, "uuid": "af54fe7b-7ec2-4897-b235-252f25cabc5f", "value": 28176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344632, "uuid": "deeadfbf-c6fc-4406-820c-990f447916bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344632, "uuid": "98ee581b-c2a6-469c-b787-93300e57eff9", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "534f1f4a-61da-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696330082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330082, "uuid": "0f39073a-0c04-414d-b466-ad377056bfb3", "comment": "Malware payload", "value": "1b7f9d92fe28a588fe0af3228a39b3e9", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330082, "uuid": "c4edfd6e-ea1c-4573-9ad8-37be384ea522", "comment": "Malware payload", "value": "b3e5d6395f0bc4e35fd22aac7e4aabc84404f3c54cd700425b1893fe31385277", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330082, "uuid": "b73179dc-e7fe-43c2-87f0-28cc994b28e9", "comment": "Malware payload", "value": "934c10da3b1264bc9fbeda189c03931e0c713580", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330082, "uuid": "181bf681-bffc-4fb6-adeb-b32f9e6ead85", "comment": "Malware payload", "value": "2cb81062c6ed61e4ea2118e48478530f44e232d3b408f935f4084f6b74e84f201c6d356ceb32ea2d20e688e746f0d978", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330082, "uuid": "1eb9fbaa-2cff-4a8c-9951-cb3dff355c90", "value": "T161B42338112D3CDBCE5356F7AEA42B629CDB85E729B4129001B242658C6FB4AF9F444F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330082, "uuid": "dadd3c4c-8b2e-4f40-8524-b3cd1520438b", "value": "12288:JMGiNz/PUAg4Nq474U1ue65dRDwdFBg+3oEpVQaoKk:mNzkyqi4UQ7m3BRo5ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696330082, "uuid": "96a8c74d-025a-49e1-80b2-80cf64f5c10e", "value": 500047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696330082, "uuid": "8aa03835-5f9f-47f7-9bd7-3d22908c7fe6", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330082, "uuid": "b2965ec2-c7d4-4e19-949b-3316af681525", "value": "Installer_v2.1.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27b59272-61d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696328720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328720, "uuid": "3c814c13-39a2-433d-aa65-21430859c1f1", "comment": "Malware payload (Mirai)", "value": "e767128667a3c5dfa4fe49b0512eefe3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328720, "uuid": "2d46c8f9-bd36-472a-aa34-92f7568a65e6", "comment": "Malware payload (Mirai)", "value": "b4273a44eb0c8929408f91bffb203d31b3994d8cb87749a690858cbeb4f0dc60", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328720, "uuid": "61d45e22-f768-4cd8-9952-bf420a6eb600", "comment": "Malware payload (Mirai)", "value": "a18aab46febfbba62e175393cb3fa9ccbed353b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328720, "uuid": "9babf959-a101-47db-a791-2effcc4fa71a", "comment": "Malware payload (Mirai)", "value": "dbdeab83709fb1e92890e9eebd82339b6329af2fd6454e394d6a4063673b2efda65092be2822f83b46ce05b4f70cfda0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328720, "uuid": "fd06331f-931c-4a17-ba12-350a911c2aec", "value": "T136E2F19793B1E062DEFC17F1F52DC18AA2BE4A9CD6B630D31A055A5C3A960531B7C883", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328720, "uuid": "6536aa61-c77a-4f3f-ad03-83dac19c6c7b", "value": "768:VoiWiO031vpAPbrVWZK3XVGxm9Xe3hY3UQwpIW:Vorm1vpALgUJSwW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328720, "uuid": "6ee7b2a4-a9e9-4f8b-875b-f621c1233731", "value": 33164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328720, "uuid": "2a8fb59e-581f-4a85-a729-9768e3c67c00", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328720, "uuid": "88bf6b06-3ebb-48da-98c3-2a926e5f07d7", "value": "e767128667a3c5dfa4fe49b0512eefe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65c8fee7-61f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696341280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341280, "uuid": "8688bc1c-01e2-4d0a-a61c-03b21af8fe1f", "comment": "Malware payload", "value": "97d8c400ab8511d9e8acc297a04f496f", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341280, "uuid": "ddfe1f56-35f9-48a8-b8ce-c577f5edd96d", "comment": "Malware payload", "value": "b56f7213be141ea75f9c9351668f5b83254dbca993157e2b74b0432e9f15bf6d", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341280, "uuid": "87366f3d-7dd5-4442-b4d8-4bf2c13eff07", "comment": "Malware payload", "value": "bbd5ba821bc7c5c38253e93b633e68774c281a12", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341280, "uuid": "b4ab4371-ce7d-4d98-95bd-2b57d5ba2d76", "comment": "Malware payload", "value": "db089b918faaba39a5a096a95c4c6a7cbaba7a38409ac540090bd3368e2b3f13ef3d6f26dcfd6f6a9a1dde73806cc1fe", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341280, "uuid": "0a63c6ab-8759-45f9-b46e-4603d15e2e07", "value": "T1AFB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341280, "uuid": "ddf26c68-ba04-4f77-875f-369496012e34", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341280, "uuid": "41074d5c-df08-4236-ae69-ce29c8b327c4", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341280, "uuid": "eb4aaa06-e2a0-487a-9728-c39963ef2af0", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341280, "uuid": "27a1feac-0f8a-44ab-bdec-b6bb3aeb8bad", "value": "AppleApp(16).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a75415cf-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346114, "uuid": "575c2816-910b-4e60-a310-d629063289bb", "comment": "Malware payload", "value": "5ceb95f8a2d9c3e8c0648527720ab4fa", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346114, "uuid": "a059282c-943d-427b-9c50-d4ebded518ce", "comment": "Malware payload", "value": "b64707e33b8fc6e4c7b79de3ef3f55804385a95c270ce94cced31e83e2513b0e", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346114, "uuid": "d5faf580-745d-479e-a276-0833b6d6e89b", "comment": "Malware payload", "value": "60a3a1aed0e23987d04387c997f968a911a82665", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346114, "uuid": "77881984-66a7-4d12-a048-ea19f029d1d3", "comment": "Malware payload", "value": "4b851d878e4760129b20e1808a09c7a072b0da93682184932d504a22f3f4b0a90d1627c9647daecd84d1e2704d02b2ec", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346114, "uuid": "f964c4c0-757d-4cda-b5a2-b52cf2ff4bfa", "value": "T1F4B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346114, "uuid": "ceec5261-f598-4e90-93df-479ebf53c151", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346114, "uuid": "744f505b-5653-4dc5-a81e-95ada96f9b55", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346114, "uuid": "22dd93a8-f1fb-4a55-ad94-f31e7f1671be", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346114, "uuid": "8024e6ef-5c3f-45f7-8aea-dd3a88152763", "value": "AppleApp(158).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b393dc10-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344417, "uuid": "97cb8a8c-10a1-4684-b587-a828ca758dd4", "comment": "Malware payload", "value": "e713581f2b27b03c8431bf7d9dce4171", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344417, "uuid": "c1d128da-e8f2-4994-9f75-b48b5b6dcd2d", "comment": "Malware payload", "value": "b654694164353575489227cf3883c3e8b2fb59b710bef9199f668eb45dc2666c", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344417, "uuid": "48a677e6-a32a-4b9d-b1c8-2deae4fd7603", "comment": "Malware payload", "value": "7d93ebfbb71a0d4871fd13137c1877e1525fceb1", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344417, "uuid": "d0554d95-2564-41b8-be61-d6f4c14191cc", "comment": "Malware payload", "value": "1b59ae4b4206a61bc8238d0743167a99a2f814c02d12f772d0ce34a5dc4d580a443fe19eb74cf53e8e004007e26d9f3a", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344417, "uuid": "415c0fd8-8200-4e3c-aea6-9d35a461fdd7", "value": "T1D8B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344417, "uuid": "c10b796e-ea6b-4fdc-b1c5-c654672809d9", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344417, "uuid": "06df9113-fca2-47b7-85be-16a7b380020f", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344417, "uuid": "47f03636-a6ee-43f4-afaa-0c60b6b45529", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344417, "uuid": "6275340b-da5f-47f6-b2a8-208c7d924e08", "value": "AppleApp(104).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49955d02-6215-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696355406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355406, "uuid": "c89a558e-cdb3-459a-b9f0-8d8cd296e269", "comment": "Malware payload (Mirai)", "value": "10bd6727d5f3eb609ca52d57bdb17a6b", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355406, "uuid": "c55b1135-c74a-4a9a-a76a-ffe96a21442e", "comment": "Malware payload (Mirai)", "value": "b692077f2b009c242bd7e23e88dd17e65d175b02a7425ed683eadda6a4f6a8cc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355406, "uuid": "fa53926f-f757-48fb-94c6-470be0c14a50", "comment": "Malware payload (Mirai)", "value": "c1a8d3e8aab54fcda5311e66f4e212c49de2ded7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696355406, "uuid": "d6337a0f-440b-40ee-a3b1-7393a1b3729b", "comment": "Malware payload (Mirai)", "value": "15cb40bea25a5beb16a1153597d9eb5e93d879eb64822e2a28e2ebc8fef82c33e96f55cda42b10dbd511cd54a034ecd6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355406, "uuid": "7c287770-8d20-40c1-8b48-f456014d985c", "value": "T1BAE32C46BA409B17C1D227B7FA9F41463322DB54D3DB730289285FF83F8AA5E4E27605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355406, "uuid": "fc7c1561-8901-41b9-a2b0-ebdd61129a79", "value": "3072:J4lpzCDO/BDvaYJi7E8J8Y7BBEO37JPd1WNJbtuGHlHK+uQM/9R0kFDIe2:uXQiBDvaYJi7E5ONdd1WNJbkGlK+lM/u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696355406, "uuid": "b726b7f1-27e9-4207-8000-acc0f70e073d", "value": 148988, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696355406, "uuid": "caaf0def-c3e3-433b-9d03-188bd07600fc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696355406, "uuid": "816c5b77-cf45-4d5b-9b9f-31cde727b5bf", "value": "rift.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de149ae-61ef-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696339065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696339065, "uuid": "a5228feb-3745-4700-89f4-c12a6672d597", "comment": "Malware payload (AgentTesla)", "value": "eda40702144ec2355291dccda48b7a38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696339065, "uuid": "b57bb989-bbcb-4ab6-9918-74a48736b8ef", "comment": "Malware payload (AgentTesla)", "value": "b73234fec5a6cbf5e739a75ce9aa9674f11dd409a81c740f009e1bf18c767c94", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696339065, "uuid": "b7e27ea1-1dfb-4075-9108-73394286c915", "comment": "Malware payload (AgentTesla)", "value": "36a59628463f556c08a803968f1fbcf8bf88f80f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696339065, "uuid": "eaebc321-f00f-4626-a27b-634dd79e20b5", "comment": "Malware payload (AgentTesla)", "value": "1fd9e3a0e7a2e1d791cd3ab92399fbfc1b72af039fd1e391864414023ea815df7b3057f6429cdc64a6b1f897dbfc1647", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696339065, "uuid": "70ffd16f-c731-428d-855a-55ff18a460ed", "value": "T12B64085A5758D6B5C35F0238E0513E1AEEF0CA1B638A9B9E9800B5F95D637C0F70B0A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696339065, "uuid": "830b13eb-fcba-4778-8987-f8d519f08aa0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696339065, "uuid": "03682ced-1994-4d27-b4f0-bccc37e6b32b", "value": "6144:PwgrUc9Zr8Ed+ioFyk9d46t2wICZZWrZyRbtU1TML5qXCTiKSK:jUcoi+pFyk9d482w1tU5M1eYlS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696339065, "uuid": "2ef98c92-8ca2-482f-a498-a03df7afc5dc", "value": 322560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696339065, "uuid": "9fa72bc5-60e9-440f-b85d-f277e64a4030", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696339065, "uuid": "0cff27f0-3443-42d3-9e6b-89a74caaddda", "value": "DOCUMENT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bd46c51-61f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696341290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341290, "uuid": "b6b3d7ff-be0f-44e4-b0b8-42a003472218", "comment": "Malware payload", "value": "996eec49b20444b1a0efa7cb19b073b0", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341290, "uuid": "2e180876-2d89-4b5e-abf5-8b852c54712f", "comment": "Malware payload", "value": "b851961682ff786792795d6f12f8b7b67444b964f7ecc4e47f693e9ba96f871c", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341290, "uuid": "2781845d-909f-46d4-a624-e2f0c269e1e3", "comment": "Malware payload", "value": "5b991050409edd16002bf469c8833166bf43237f", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341290, "uuid": "d588cf5c-6d73-42cf-a77f-2f0ae8628664", "comment": "Malware payload", "value": "ace82fcd34c87338e4315b2e9d772d83ad2c501186eef58971bfbbc95647a4bd205cb448d21430e30a1439f40c950802", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341290, "uuid": "c6d91d90-d5c7-43bf-9ccb-0465400dc2e8", "value": "T152B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341290, "uuid": "8c91e234-b3c3-4554-954f-e282e4f515b5", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341290, "uuid": "a2320ab0-e3d1-4433-8125-6de4dbc7af56", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341290, "uuid": "94f3dacd-2bbb-4162-95f6-d64392284eaa", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341290, "uuid": "6aa43ece-8a5b-473b-9dbf-cecb57c34a8e", "value": "AppleApp(69).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acb9b256-61df-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696332379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332379, "uuid": "644b21c8-5766-418b-aff9-0a7230e239dd", "comment": "Malware payload", "value": "b9338ec404749846acc5cfb901bbcb99", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "AtomicSteal", "colour": "#7C29A4", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332379, "uuid": "1d44b0b7-c718-4e8b-8c96-252e73fbd21a", "comment": "Malware payload", "value": "b86e245d71f7a1056a7c558ac6bee7ca67bf0bc7e918ca144ef2fb359e8b5370", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "AtomicSteal", "colour": "#7C29A4", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332379, "uuid": "c814a47f-a091-4dbe-ad6d-5230e26a1e04", "comment": "Malware payload", "value": "15593ecb14d0bc1c96cc1f0abef6287ae36b8760", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "AtomicSteal", "colour": "#7C29A4", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332379, "uuid": "9688e5b6-88b4-4d91-baf7-1561e481daf9", "comment": "Malware payload", "value": "d5932e1b2bbc1b40ecfd801ebeebc09feb3b0cd1344786a5f965285478e0789212c3ebdeadd66ccd4bd11ca04919f93b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "AtomicSteal", "colour": "#7C29A4", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332379, "uuid": "10b87405-b748-4397-ad15-213cf9760502", "value": "T192B42338112D3CDBCE5356F7AEA42B629CDB85E729B4129001B242658C6FB4AF9F444F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332379, "uuid": "bc798cc8-25dd-40a0-bc65-7b005e3fd275", "value": "12288:JMGiNz/PUAg4Nq474U1ue65dRDwdFBg+3oEpVQaoKk:mNzkyqi4UQ7m3BRo5ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696332379, "uuid": "2279514b-71a7-479d-b4c5-90d4e225f327", "value": 500047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696332379, "uuid": "d81ed489-786f-4e07-9e89-05a505abda57", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332379, "uuid": "b3933fbf-0d3b-468d-a7f5-9a0afe696568", "value": "Installer_v2.1.dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69f9cb2d-61e6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696335274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335274, "uuid": "eed0f25b-9271-47e6-8306-7d6f61a6e0b8", "comment": "Malware payload (RedLineStealer)", "value": "5f21ffaba6d87d9e97cdc64d284d9818", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335274, "uuid": "f766dc6b-90ec-436c-8a0f-5ce18964ff7c", "comment": "Malware payload (RedLineStealer)", "value": "b8ab78bc455194d9105924f5978ccf726e209947449965c76b11ff740575bcb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335274, "uuid": "37624cf4-1822-4967-b290-9145159bc01e", "comment": "Malware payload (RedLineStealer)", "value": "857d4c2b4e2e1ad4d60ce4422d682596248401e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335274, "uuid": "4bad1e6a-4bb4-4cfb-b14a-070b1e9b8ce2", "comment": "Malware payload (RedLineStealer)", "value": "ed67d8165a093f12213d4510275de6173c3021dc5e9d723130dfdd11653e4310b358a6333d19847af20899ca77a82913", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335274, "uuid": "61ff9307-7d04-4ed9-8e26-be2c5e9c5ee4", "value": "T1D475D71173F94B49F5F75FB996BA6612487ABC6ADB11C2DF1250908E0C21BD488B0F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335274, "uuid": "4f43228b-87e8-4e1a-8395-a2f9b51e7281", "value": "0019c5cc9dc02122ed11385f5bfdf094", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335274, "uuid": "4133674a-f1e5-441c-9990-2c796158d60c", "value": "12288:jJBI/3ZosDOl8bsJwZZs/nuBVg9X6a9DhvhaPTL7/tBSqDEslqlbj:M3tG+sJwst6a9DhvhINBSqRlo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696335274, "uuid": "821f385c-780d-4308-90f7-1ca1ddbcede6", "value": 1609216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696335274, "uuid": "5ed27ce3-2388-4a19-843a-a9967bddb9bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335274, "uuid": "295cf3ec-3303-4c28-a7a6-17ffc14cdbae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd49eca-61da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696330207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330207, "uuid": "d759bd02-ace2-4f85-9cef-603015005987", "comment": "Malware payload (Mirai)", "value": "07d09fd133a1c83b8dd03d7fe68a6379", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330207, "uuid": "5d07b881-5880-4bac-9630-d008e28d1d2a", "comment": "Malware payload (Mirai)", "value": "b8c4690f5a3611366096ecd61fb1dcfc8f12fbecdcc5dac62d18559578a20dd5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330207, "uuid": "72aa206c-8402-404d-a8ab-8c82110cfc42", "comment": "Malware payload (Mirai)", "value": "b1abdf1c1b9df18def19b55dd5e9f3d5bc3abfbc", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696330207, "uuid": "5f8b7007-7803-45dc-af68-1228cef22990", "comment": "Malware payload (Mirai)", "value": "d1b560f8a3561c98ea94174d91489aafd247a130d2909e5141ce08409fd4660b7a746f7020f5d0b125bd57bdffd57fa3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330207, "uuid": "da290ae6-1f82-4a72-9fbb-b50f85cdfbe3", "value": "T16182CF38D1857136CAF118B2E4DDC4067B631BB8C9D73176825026ACE6C60567AFEEF2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330207, "uuid": "472939cd-27e5-4a48-8a27-5d2af201d2a4", "value": "384:jnntmnWx/3KeSqrB79058xOKcjj1g6eLDA1c5ck4lBfPmdGU5EU:jntYQ3KeSi50axhcjj1bMU1xnP3UP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696330207, "uuid": "e4abeaad-c00a-4a1b-914a-75876023f5cd", "value": 18436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696330207, "uuid": "0c427901-ab62-4100-901f-f20cd433a1e8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696330207, "uuid": "c2bd6bc4-8707-4bdb-8b4f-186d912cfb07", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "061237eb-61da-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1696329952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329952, "uuid": "f540be75-d494-4a46-b36b-e6327beb6533", "comment": "Malware payload (SnakeKeylogger)", "value": "452230cd897fa11773a80b7660d1eb75", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329952, "uuid": "b5630928-afef-4164-bd1c-55d9105ef749", "comment": "Malware payload (SnakeKeylogger)", "value": "b9d4088106a3a557fb5d909c8c5b921971704d7b764306ee4190cefd9b8d89b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329952, "uuid": "0d5a5a43-9fa6-4561-bfdb-7f38204dc2d5", "comment": "Malware payload (SnakeKeylogger)", "value": "1e3e5ea548df2aef3db95d4243e6add49dab9688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329952, "uuid": "e0ddcb26-84ee-4ec6-820a-bb7255345851", "comment": "Malware payload (SnakeKeylogger)", "value": "63dd6db486cf0e0fecdd54778c8ec79409547af8b59d247784e0ee54b070fc5e56b580aeeec98551fbfcd75348b63863", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329952, "uuid": "8edbd766-a469-43ef-ad9a-faf24f9fb47b", "value": "T1317428127F4A1A67D0DD5B7BA091148497B0DC51AFCFEF4FA80273F8196B302EA0A657", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329952, "uuid": "62c000d8-9972-4aca-abdd-a7301ae3b7f3", "value": "6144:7Rgc2lOrSZPpLu51ZK7VsA+JgqNb8PiFU9+j9f0GVoROChql1vHLNyk5ufH/c/dj:PS7VsARqJ86FU9+j9f0GVoROChq3vXqa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696329952, "uuid": "8b9c3fc6-ec25-4ba8-9559-c7b9c52d52c2", "value": 344576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696329952, "uuid": "2e948902-cf0d-48b4-8226-45a0c7eb4211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329952, "uuid": "0ff7a86d-645d-4b39-8512-bf99c1c2e798", "value": "Vhycf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3250879c-61ba-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696316283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316283, "uuid": "37b57c72-99a5-4bd3-a879-dea845b0a9de", "comment": "Malware payload (Gozi)", "value": "f8acc154f92f8b2da94fbd05550fa009", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316283, "uuid": "6b80bb2f-0eeb-4f3d-a6dc-35ff3dd8f2a3", "comment": "Malware payload (Gozi)", "value": "ba27804848db9f3374c4a16c227d6d6c4259e8eab3a339322e65121a1f688bbc", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316283, "uuid": "b24c5c71-9351-4a31-a053-cdf166660559", "comment": "Malware payload (Gozi)", "value": "efd387b648e8af8783901e4bdd69020b9f9f1b6c", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316283, "uuid": "1624cd62-c7ab-43f6-94fb-98f8020cd9bf", "comment": "Malware payload (Gozi)", "value": "be5a92cbbb315aa7dc0c81f612046da143ce3e0db4f91510eeaefeeba89b72d908476aad3ec06b1a4af9014521708614", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316283, "uuid": "872e4b8f-24ce-4137-bf1f-ee52b698c759", "value": "T1FA34C01EB3D3EC22EAFF053744269BF66A3DE4259F30A81F6744E6740E65293123C526", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316283, "uuid": "57c2dce5-e56d-4d57-9f6b-ac3ec4c2574f", "value": "b708bc91029a5428d40eddd35d2240ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316283, "uuid": "2ee00149-fc2a-43a8-b495-60939e50ca80", "value": "3072:qHl8sl3SLLKRqKVSz3yTt3D9TcUonLpqOdDF31EULGLSyV4w16xXtExK9o7vC0Xm:u88MLIqRszbWd5xeULGLfiE8MX8zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316283, "uuid": "ace09b80-60b7-4a1f-94e9-d83453a17356", "value": 249856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316283, "uuid": "841b8449-c0d1-4f03-9cc7-5f2ab674d75d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316283, "uuid": "ae1dfc71-9eaa-4d79-9390-a97f3f3eba68", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7a9659f-61a0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DCRat)", "timestamp": 1696305313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696305313, "uuid": "fc691f60-8308-4243-a905-84a8b02c0b8b", "comment": "Malware payload (DCRat)", "value": "1c4839b68d576887aee208202d1a54b5", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696305313, "uuid": "2818d94a-e916-4536-861c-a26de56ee318", "comment": "Malware payload (DCRat)", "value": "bac9d999cc67291e72e2a3377055e4d27a9ffcacdbe71f0c6d88e1c451e350ad", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696305313, "uuid": "3c3c269a-f89d-4bfd-8cef-f627947fb0d4", "comment": "Malware payload (DCRat)", "value": "856032c21ebdfc9b71aa62e9d4d9b482444dd78b", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696305313, "uuid": "002fb37f-ed18-4661-8d2c-106cbea4f121", "comment": "Malware payload (DCRat)", "value": "1ad58505732bd63548dba5f16bc0bd706debe7d6ac1d0b1c2b5f9a5219a228178462eb63c547c061e7324e50f72000c7", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696305313, "uuid": "a9f141a4-8d8d-4f51-8133-66552ce0bde1", "value": "T1AB354B017E44CF12F0191233C2EF454887B4A9516AA6E72B7DBA37BE19123973D0D9EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696305313, "uuid": "556d7790-094b-4442-a598-3b3382d612ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696305313, "uuid": "c04f82f8-7676-42f5-b8f4-8b6aca603f8e", "value": "12288:El+4Tcyct/JWT7yckBlepmbMsBXYHOWyAh5+djVyKDGpiRe7FaS+ug82qGeJ3btU:Zyc5JWackYm7dZ1Oq2nn2qPJ3btV3+f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696305313, "uuid": "0e8116aa-27ae-4388-b333-1bf6c1b3fd09", "value": 1148928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696305313, "uuid": "b586838e-5848-41c9-8308-94ce0a67ade4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696305313, "uuid": "5fb35e60-2028-474f-b2cb-603f229b88c9", "value": "1c4839b68d576887aee208202d1a54b5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05af213b-622f-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696366459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696366459, "uuid": "d3999861-79a2-4270-92c1-4c32d4dc4279", "comment": "Malware payload", "value": "e16678adff0c94c5c107ff9e3672a6c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696366459, "uuid": "46a78520-c994-4f05-b559-b5a3ca28a529", "comment": "Malware payload", "value": "bacfce630c06766a1c54b55395b84232dfb01a99844a0c732fa45470d9bd434b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696366459, "uuid": "f129a503-daf3-4a2b-8498-0dc93b1a091e", "comment": "Malware payload", "value": "e5e5cf0a3c5d645bcbc171dfa7e1943e3be53508", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696366459, "uuid": "96b77d3f-d9e3-4b0e-ae30-6e4987317867", "comment": "Malware payload", "value": "9290d9f735bcd60dbee05dba71cba2364663abbd93d1e4b65bd39e49ad180cfbba1b5fc607e5c3c5e409fba11bb27350", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696366459, "uuid": "e617e09d-2718-4ad3-a1f7-c3958fea1664", "value": "T130D628243DFB5019B2B3EF9A4BE8B8EAD96FF6733B066469105003864723D41DDD163A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696366459, "uuid": "de720efd-c77d-4714-abe8-0f38c4d51e40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696366459, "uuid": "38f1e2a9-f709-40b3-9a1e-f68ecedf0485", "value": "49152:bK32UW/tIMGh2aiASiUyDA147Bf6w9o1grqRykI6c4V/HJY/oFTYpKA3hLAuewii:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696366459, "uuid": "07255e6f-2643-4445-a27b-20a0f098b160", "value": 13184512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696366459, "uuid": "7d17dc08-b068-43c1-b7a4-fadaca8e48bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696366459, "uuid": "01835374-f828-4179-be09-7bbaddec88f0", "value": "openssl.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3839c29-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343638, "uuid": "83596062-5dc9-4401-b57d-81ab992f0d8c", "comment": "Malware payload", "value": "043c7fed1376e7760d15f9cbf28ed39b", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343638, "uuid": "ff085977-c1a7-460d-914a-fc3340327150", "comment": "Malware payload", "value": "bb516cf5d595dbe428e48dfb383aaf014c984dbbd93e10c31154552ccc680ca1", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343638, "uuid": "58363473-4eb0-4c0e-aeb6-9a510332fddb", "comment": "Malware payload", "value": "e8a2dd06435f899eb3abe164f94344afc6506cca", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343638, "uuid": "3a56ab25-f3c9-48d6-801e-d3fd861a906a", "comment": "Malware payload", "value": "33ad9f45545ed03c9aa5a998047be72ffbccf290289f029fed419f8952cc5d4052187cd62bb6f293586a7b484c31002c", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343638, "uuid": "eff3a6ee-1bc9-4be3-b8e8-9f80e335caf2", "value": "T167B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343638, "uuid": "4e1db8fe-0ca8-4619-aab9-f76a34bf2e76", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343638, "uuid": "5c8aabdd-80d4-4d3f-87fa-b55a4e830db4", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343638, "uuid": "e4df5978-8694-40e8-b5a0-642d827a3fa9", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343638, "uuid": "c9161044-d7af-47d2-9c36-9b4769415a04", "value": "AppleApp(115).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee3da705-6194-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Glupteba)", "timestamp": 1696300277, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300277, "uuid": "acd1dd0b-e6ce-460c-aca6-5343510b5127", "comment": "Malware payload (Glupteba)", "value": "fd115bd5e4e217bf4a2a1b5c3c598a53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300277, "uuid": "9bd26d87-6ac2-4a58-bcc1-02ed4b56c2b5", "comment": "Malware payload (Glupteba)", "value": "bbe7c155c748f15faa3994f66075b46daeeac61a929d8c9bc247af0a5c2d8e4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300277, "uuid": "647b32e2-4f9f-4d03-82b6-ccf710a44fd2", "comment": "Malware payload (Glupteba)", "value": "b6f44069d06d7326d152d704946ed5f0583787dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300277, "uuid": "873942c5-70b5-40b5-b449-8d4590e4ea4b", "comment": "Malware payload (Glupteba)", "value": "b53ab0b6c3b55edb13e4e2dfeb0851121ad1ae44a37b6f8e33adca1c3fa11874bfc834d4392c73398b0db34155ee5338", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300277, "uuid": "b0f69a9f-37d9-4cba-8c2b-f891d14bb8cb", "value": "T1891633806A60A4E2DAB75AF58C2E43C0BEE8793B1564461E75DA03CB3F34B10BF55B35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300277, "uuid": "deeb0417-dbdf-4700-ae8f-de90feb44495", "value": "a7960cb042304220b44306228fd698f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300277, "uuid": "6b95af17-d66a-421d-9b96-41bcbd4e57cc", "value": "98304:tHT9o4Iv02UAxFrlDh6zWY8Mhhr/fgXWhjHIpUkMnZ2ANA:tz9402PFRDhmDvMXW9XVZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696300277, "uuid": "d1c475f5-860f-4151-857c-cc73deb9c95c", "value": 4312416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696300277, "uuid": "99397ab8-c3ad-4d26-b89b-3513601a5156", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300277, "uuid": "9ed72528-b694-4ee5-8d58-b3e92572f07f", "value": "fd115bd5e4e217bf4a2a1b5c3c598a53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6d971d5-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344530, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344530, "uuid": "64e30aad-ff17-4414-be19-c5e35560f797", "comment": "Malware payload", "value": "ff9ed4a4d3d26e81f3d735a1684aef19", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344530, "uuid": "37ecb94e-2bd0-4f6b-84a2-a2a6cde6eb5e", "comment": "Malware payload", "value": "bd036f24192d8c7429be4f26d9a3b7c4fc5a4c2b8dfb290c519cd29c53bcf50b", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344530, "uuid": "2c395f41-984c-42c4-bf71-b61e17336545", "comment": "Malware payload", "value": "aac3402dfbf7e41b7867abec99e44355299f01f0", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344530, "uuid": "ddb5e58a-1713-47a8-9767-fbbb21176ab3", "comment": "Malware payload", "value": "f7c201504ebaeea994a24b9088a9f648bb4f38559008a7fbef6eb752c0bc9f95eb6d14b15431799ed7e1fd1cf72c335e", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344530, "uuid": "d3d38da8-8460-4740-907e-c391ac7f69d3", "value": "T154B4237C993532C6DDB127B9AB5C80325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344530, "uuid": "c1f1d34f-c674-4ee2-9476-9c1fb82d2d7e", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344530, "uuid": "ad1493ed-0904-4c8c-a2ff-73d476be4db7", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344530, "uuid": "d857b117-7084-41c9-b6f0-6481a4718a52", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344530, "uuid": "5e3c9c40-d62d-499a-87fc-2c6bf6b150dc", "value": "AppleApp(113).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02b80955-61ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696338537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338537, "uuid": "3d855ce5-fc1a-4516-9343-747364613780", "comment": "Malware payload (Amadey)", "value": "8987564cba17ccd2ca7a02dd7c9ae8fe", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338537, "uuid": "f7552896-b540-4a8f-a998-0fc068e0ccd7", "comment": "Malware payload (Amadey)", "value": "bd140f5f4b34c48b653eabb035c4d4cfbc2d7f386656cec35acf03cfe6edf74f", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338537, "uuid": "aa972778-cdd7-4f00-9dab-d6e5af2faf4c", "comment": "Malware payload (Amadey)", "value": "802da1a1d055a774d41bbd5e37a3ccc270c1ea2f", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338537, "uuid": "613a7981-4bee-434c-bf20-eaeed8620e59", "comment": "Malware payload (Amadey)", "value": "390ede95a467dadbe4be43e87ae416b1f174f43d7e9c41ccfbf17e5d769d9e4a9e920166c1f03a116725027265db3fdb", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338537, "uuid": "20ea0e85-218e-4490-b1b2-ca549369d270", "value": "T1D625234367C0A432D9F5E73418F746872B367CE60F5C866B33449B8A4E726D4A1363AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338537, "uuid": "9e1f2a13-8ae1-44dd-87e4-7d2709ca99ce", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338537, "uuid": "ba8bfd70-0799-4630-b412-3bb94560cd1f", "value": "24576:PyGcOs4MkxEdjxhdUhnZZfkBvsWkoUm4PgQg8AvgC8zW5EWIo:aGcOJ4djxAFZZf4Jwgv4W5Ed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338537, "uuid": "456d6f8b-896a-4168-b443-8f370a83be78", "value": 1052672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338537, "uuid": "d4c976a8-edb3-4ca7-b4d8-e2729314a07e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338537, "uuid": "3a899303-a020-487a-8e4d-e15bf561721a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fdbe77b-61c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696322238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322238, "uuid": "f722b9f0-f7c8-4e0e-ab10-865c852cb170", "comment": "Malware payload (Smoke Loader)", "value": "e9bf4f1cd762dd0c597cb6b8aeb3fc30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322238, "uuid": "26557f90-36d9-4f31-bed2-8fc3261f0194", "comment": "Malware payload (Smoke Loader)", "value": "bd1e918a1799cf84d78ab08c96024d70c9c7e6d3eba78635170556a01b1b1d36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322238, "uuid": "bebf0db0-eebc-43e2-a519-0fbe344388ec", "comment": "Malware payload (Smoke Loader)", "value": "9a7071d8130ded69ac00046ef42a86dd8338b5a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322238, "uuid": "77cf9fab-d665-4236-942d-410e1332c027", "comment": "Malware payload (Smoke Loader)", "value": "eb1336e2273f5f4edc782f45bacae41d4dc402e4765bb3ef3f3dbf630e5557c7b5aada2067100a6440430829eddf034d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322238, "uuid": "de24cdd9-a966-42dd-ac2f-ce7ef4b4dae2", "value": "T1EB54AE03B2D0AC21D5665A315D29C2E43B2EFCA19E6957EB33583F3F59B01E19672B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322238, "uuid": "8a4b302f-0c91-486d-92be-f7a37628ab81", "value": "22101b09b25f37226d51fdc3f87abcff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322238, "uuid": "b8482d96-8bf5-4e6a-b391-f2d2ee929620", "value": "3072:rRFbU5JBC7B74sRnH8I2AwMLd/6XYbVvhK1Phikw:jbU53C974sRU7MLd7vc1J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322238, "uuid": "99aa00ec-54d0-49fe-b13d-de50a4503a6b", "value": 303616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322238, "uuid": "fee04b56-68cf-4966-984c-2891b3c75f19", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322238, "uuid": "a52a5ee1-0abf-4b12-a22c-4850432ef579", "value": "SecuriteInfo.com.Win32.TrojanX-gen.32651.23791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bbf40ff-6206-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696348860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348860, "uuid": "d6ea84ed-7d06-4a7c-baf3-055e9b43fe44", "comment": "Malware payload (Stealc)", "value": "9e0025c871ae4e48587bdec5aa9e8778", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348860, "uuid": "518c00af-1ce9-4b5c-ba8e-56e5280d2ebc", "comment": "Malware payload (Stealc)", "value": "bda02fb8758de2721d45b4e65c94bc281718b96f031f0c4e986972451f476977", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348860, "uuid": "82811910-f886-4a6c-8f1b-63e3248381b3", "comment": "Malware payload (Stealc)", "value": "435035cf548dda47c159a553828c3dd23e5cda07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348860, "uuid": "96b08652-8392-491f-836b-f99397ec9cd4", "comment": "Malware payload (Stealc)", "value": "6f9f80756221e08d0e8b615e1a3ca40c0077317f84e6328d14e77efcde89ad91c5cca9c8d8e3d9acf06d23ae7437ac6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348860, "uuid": "3a9359e1-4576-4cdc-86b1-cf8c546068e2", "value": "T152549E1272E0EC31E4625A325D39C1E4776EBCD29E6967DB33583F3B49701E19A62B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348860, "uuid": "75923e8a-6fb8-423f-a894-439bbb2b13b6", "value": "775c7d434cffd499e537a34db4132a29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348860, "uuid": "70139f33-e992-4b7f-84b5-4f61c3c2a47b", "value": "3072:2mq54YSvS5AaUV0uwppkvfoGnG7j3J+gHzp0h924A5DMlY:w54FvUAaUVippUfoImDwozWIi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696348860, "uuid": "b8ab606f-cb8d-40ec-a742-347b25f4ad1d", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696348860, "uuid": "c8957126-03bf-40a4-b4e5-a1942f3562b9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348860, "uuid": "a7f6d688-08fb-48dd-8102-7ecede552c22", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8764c1e7-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344343, "uuid": "332beb31-9bf9-495b-9da1-2aa0ea10a542", "comment": "Malware payload", "value": "c387609c051ff3440f03c118076da8dc", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344343, "uuid": "10244557-e449-41fa-be15-b992c248ce45", "comment": "Malware payload", "value": "bdcc7f66b5f1039caa2be5f9d075822283dc182219a21c67a6e5033f6428fc5b", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344343, "uuid": "d889a733-5167-480b-aea7-c83acbe7f207", "comment": "Malware payload", "value": "97dfbeaec51c168f2c1e5654abc2a635edb02ebb", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344343, "uuid": "8d75d534-ef68-4b98-afa8-b2f91bb51bc8", "comment": "Malware payload", "value": "8cff1aca95602a0b584a734fb36d9b228833eecbd49e72a0b10606220f9552e67da93f39c6461519360a2e1cd7227189", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344343, "uuid": "0979a59c-7b50-4eae-ac77-298c13f62773", "value": "T158B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344343, "uuid": "f9353864-d5dc-4676-a03d-1790aaecd5d7", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344343, "uuid": "3f47d024-44aa-4b0a-a86c-eec1307cd729", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344343, "uuid": "ef0cdd02-4692-452a-a8c1-abfae0f68d10", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344343, "uuid": "0aef9ce1-a98b-4728-b631-73ef33c355fd", "value": "AppleApp(100).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffb06a6-61dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696331418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331418, "uuid": "964d3775-da6f-4f64-9a5a-f0ff2b520c0a", "comment": "Malware payload (RedLineStealer)", "value": "017a82da7f811fc92a57a3b630c246e3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331418, "uuid": "afee1a46-0412-4cdf-b135-89ce74186118", "comment": "Malware payload (RedLineStealer)", "value": "bde70ac579d1b9ce2d8bef8c8023debec0ca1a0e3cac07ea465e25b32aa0602a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331418, "uuid": "4d33af88-3782-4201-aef4-0a8e129b4e21", "comment": "Malware payload (RedLineStealer)", "value": "0e411d8bdc009d3fd50f9983a0ca9c7d62fd8c72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331418, "uuid": "77be1f00-a44f-43e2-a0fa-e23acd8bbe8c", "comment": "Malware payload (RedLineStealer)", "value": "dc57940f7ba1bf5eac9dd7f75ebac219d7928a4de6438fe52b5d11875f12b6d96e99604313976eb99045231c179598de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331418, "uuid": "001e2098-1797-42ce-949f-5f8823936ed8", "value": "T19A152303B3E94263DCB56B705CF603D31B3A7CA69D7481271A95AD5A1CB2A80F93172F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331418, "uuid": "ea206670-0f9e-44a1-af12-315e2c6b58f0", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331418, "uuid": "8c44d5fb-1d18-4fa9-be79-71ebfbc95d53", "value": "12288:gMrfy90VY+asDkUK5UswGw6q8UJMT07e4sYuKgeAf2vFKgfheaz4ZxZWhMt5otF6:Pyb+ZDk9U3Mie4sQjf4ZxZWhntmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331418, "uuid": "5fd6e8ea-17c2-4b78-9ed9-45b766fe48a8", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331418, "uuid": "8bbb0157-a0f7-4080-a46c-45f4320527b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331418, "uuid": "96ff1feb-3d81-4187-9252-ae560dedc352", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "179fbc7c-6220-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696360046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360046, "uuid": "cc1ee16e-e9e5-4de4-b5ac-ba854a77afeb", "comment": "Malware payload (Formbook)", "value": "c17f541fdb6b3cb61be539e348d6ee0f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360046, "uuid": "e5a33ad0-5ee2-403f-8e52-ffc0c0a82dbb", "comment": "Malware payload (Formbook)", "value": "be001461acb26523b913f93761b14f56fc7dd7f256e90ae53b40f0b40dd859b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360046, "uuid": "034336c6-2a5b-46ca-ad3a-9d52bd9ee3f0", "comment": "Malware payload (Formbook)", "value": "a311ff39223cf604b033fb940f5bcb5975e1dd21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360046, "uuid": "cca751a6-66a2-4811-b69f-240c02b52dd5", "comment": "Malware payload (Formbook)", "value": "d7bfedcbe1fb94d557d6d3849b53f869b54a96660886cff1e40f8c43231ae4d50aaf4e8276d8cc371eeb89b1067ad750", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360046, "uuid": "ca6eb471-4c29-4276-8a06-46bee4fbdc43", "value": "T10464125173ACC041D96746300EB9CA3195B3892DC6B1970A97F07F5DB8B33A2973E7A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360046, "uuid": "04017d7a-8b6b-46fd-a668-3f5f49db963e", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360046, "uuid": "3e4d8546-d897-49fe-b6bf-ff774a266b49", "value": "6144:LnPdudwDzzZCMdRe6C20MlphqSWkwB8DTKvG5wAPVj6laU2Dzbnw6fJD6nHFlVwT:LnPdvz3uqphtWHB8DTKvQPUIbnML6T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696360046, "uuid": "af50f08d-0868-43cd-8d80-a64276eadd16", "value": 316811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696360046, "uuid": "34ab39df-6ef6-4d00-94ab-006cc8cd8871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360046, "uuid": "2a5c4108-999e-478b-9f39-b5798a74e237", "value": "c17f541fdb6b3cb61be539e348d6ee0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a84f1a3e-61b7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1696315192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315192, "uuid": "ea36bc1a-f1b8-47a2-82a5-f46144c5ad79", "comment": "Malware payload (MarsStealer)", "value": "ecdc2cf733787652455d2074d28e03a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315192, "uuid": "da8a0cd4-a5d4-422e-b560-ac75164febd5", "comment": "Malware payload (MarsStealer)", "value": "be84338d783291ea55b73e6e631666bcfdaf9313b680d90f25e52eb3038a3314", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315192, "uuid": "0f5e1fe6-2078-4dda-b181-39ae53e10969", "comment": "Malware payload (MarsStealer)", "value": "b64c21ca8bb8a7f882ae2c6516e01d4e1b2c3dbc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315192, "uuid": "fa3ae496-7a45-487c-b74e-fdb2977e34b4", "comment": "Malware payload (MarsStealer)", "value": "3567f13be16341196bbb73f5581c6d208fdbff833354a7253e11b3025eff94e516398f452576809b408350b36fb4c06c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696315192, "uuid": "f54f4f12-65b2-44c1-be5b-d296dff966b0", "value": "T18F54AF12B7E0AC65E4635A315D29C6E43B2EFCA19E6817DB33543F3F09706E19662B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696315192, "uuid": "7c15af49-3225-43fb-99ed-c69ea934f203", "value": "22101b09b25f37226d51fdc3f87abcff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696315192, "uuid": "1c35dc01-ebf6-439f-b142-e5ab077e90b5", "value": "3072:S1zUH54BCkBo3sCfCcJZKzt3bYlMn3FoPBp4SmxmzsmhCew:AzUZGC8o3sCfJJcz9UE3G4PUzsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696315192, "uuid": "0000c990-65b5-4359-961a-5c47f27b2403", "value": 301568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696315192, "uuid": "b45acf9a-609b-4671-be29-b1496f4abd93", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696315192, "uuid": "00abdfda-48e6-4a9a-8159-fcc538cb4241", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f53f2b26-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343668, "uuid": "6759e7fc-613a-42e8-b00c-849b5d0052ce", "comment": "Malware payload", "value": "53228fabf5baafcf9bebc68fb099864a", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343668, "uuid": "c56551a8-f5d2-4bf3-af17-cb88958e3844", "comment": "Malware payload", "value": "bec22a83e3c876e73cbbc55bcab520d32be3f12dd93250b94ffdc85571d2987a", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343668, "uuid": "3e1f4dac-8ffc-449c-bf09-1667a015374f", "comment": "Malware payload", "value": "a9b54f9da6757ad3142830e83e8c59b63a34cb09", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343668, "uuid": "4aeba2d4-4a74-4cf5-99fa-9fa92d52b39a", "comment": "Malware payload", "value": "3d5a9d1df20e8fe9f18ee55987cb5a1e6ad354f937c404257f398f2e7a134616fe6f1abe81b95a2de07d7898c80a10ea", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343668, "uuid": "56690a5e-29b9-4ebf-8486-8ae3d705b531", "value": "T1D8B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343668, "uuid": "5155e14b-e228-434a-8401-9a31eb72ec85", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343668, "uuid": "d2c4461d-fdeb-437e-b583-1838b1ac1cf9", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343668, "uuid": "153935d9-5ad2-44ef-99e6-a495491c27b7", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343668, "uuid": "f141c32e-0811-4552-a679-c6704ba9592b", "value": "AppleApp(132).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25bfd51e-6205-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GCleaner)", "timestamp": 1696348474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348474, "uuid": "cf1b11b3-0afc-4263-a88f-355b99dba042", "comment": "Malware payload (GCleaner)", "value": "4bbece3539c386657b11fb189925e6e5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348474, "uuid": "4239525d-20f3-499c-9148-2c17e74daf18", "comment": "Malware payload (GCleaner)", "value": "beca325649a048fb9d8517b206b82f94a0663138725660ee957b75e8d5ebe494", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348474, "uuid": "d637341b-ef8e-4cc5-97e0-b25594a2785d", "comment": "Malware payload (GCleaner)", "value": "4086b4f45239eb7da17fee1de155bf05f04225b2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348474, "uuid": "390ad8ab-9bbd-408f-90c3-121cce540c4d", "comment": "Malware payload (GCleaner)", "value": "a621ad9a1525b13c7b0c3a0c8eca0688a1a6dba2dfddc6912f40753c45224521d3ca094f2de63573213ccb37a5a218ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348474, "uuid": "fc27c357-9244-4674-b1a7-3605e4d66639", "value": "T14684CF1376D0A831E4628A324D39C6E97B5EFCD19E6957DB33487E3B4C701E19A22B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348474, "uuid": "fb4dcac9-fc5d-46f9-906f-ad0d7757bec7", "value": "775c7d434cffd499e537a34db4132a29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348474, "uuid": "52b311b6-923b-414f-a3d1-478e5478ef75", "value": "6144:0a66vQ6XRxLCKrznSehTpJ+/IEMg0Y2mQb:0Pa3X7WizfNp8/IEgEQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696348474, "uuid": "14fd3395-aeb4-48ed-b9d5-4a0e347f88b6", "value": 374784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696348474, "uuid": "8412bdd5-5a71-44a9-a232-53d15bda5942", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348474, "uuid": "1b6449b0-23cb-4c75-84ce-12730ab58d79", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e694ba4e-6204-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696348368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348368, "uuid": "a9d0390a-e403-43f7-ae0a-640a15ebfb20", "comment": "Malware payload (Gozi)", "value": "17bc4f11b97140cbf36234a55341c6ad", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348368, "uuid": "bdca9540-ba78-4093-af21-058229a9f360", "comment": "Malware payload (Gozi)", "value": "bf127718f51d65b4dffceba87fea35ce602bf7557e9a18411238be79bed2c45d", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348368, "uuid": "4c4d7c5b-1d5a-42a0-a59e-cba22c69b06b", "comment": "Malware payload (Gozi)", "value": "73909b4347d5702d6b2c890dd09ee8cb03988e6d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696348368, "uuid": "637d0586-5ceb-4033-9a70-bb864ccb23a7", "comment": "Malware payload (Gozi)", "value": "53f64b04f251e838e2ad93c869c14b585cf61250757014282b7e7b8b8ad0e1647f3350e81f06b23f3bf25b077f0d0369", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348368, "uuid": "23822276-0589-468f-bdad-af41557e91ad", "value": "T131E07D0595833952FA1785B438EE2B68452BDB4450C1D1774E481552CCEB39E17B05EE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348368, "uuid": "3f9499eb-9e2f-4187-857a-c782a261ad3f", "value": "6:5jRN8BEtkrvlX0D5/dJntVVGJMaOmzjBAysdzDp4wddk8JtSKlQBEIWAFu+lL:5jRiEWvy/dJn1fqWNptz3JBWEIWAkaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696348368, "uuid": "9bccc1ad-f8e1-4ee6-ac08-4d178d8e9930", "value": 343, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696348368, "uuid": "2ca9decf-90d0-4b7d-88fc-d0b71520b38a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696348368, "uuid": "d3a2c635-0e27-47d9-b1fc-ccb31c0f7ef8", "value": "Informazioni278.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a31522b8-61ca-11ee-a6f9-42010a9c0055", "comment": "Malware payload (XWorm)", "timestamp": 1696323344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323344, "uuid": "ebf175fb-0d0b-452a-b2de-804291236cf5", "comment": "Malware payload (XWorm)", "value": "31050aa484d4388f23f49fcd89769bdc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323344, "uuid": "0f401df3-cf70-4ce3-ae78-67c411799e94", "comment": "Malware payload (XWorm)", "value": "bfb5afd83e4c4962336f10655e191e0efc2b9fe968af9f37f7d84c845a27a075", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323344, "uuid": "3d792f33-2ae5-449c-b92f-7baccbbf6da5", "comment": "Malware payload (XWorm)", "value": "91c91806eb681af8ea7a1527e1849a17bfca3f6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323344, "uuid": "89260930-cc48-4d29-b244-1d77c62b62db", "comment": "Malware payload (XWorm)", "value": "217c601efad2946b05cf9e0612248c3aed1fc4abe8d3a21876858c619bb47dd07830cc9d7f7a97989c8ef17513706e12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "xworm", "colour": "#E0D5D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323344, "uuid": "b084f157-4e51-45db-ae20-aae049af0069", "value": "T1795501ACD2BDFCE6C41781F99CB6F6E5195EEA1894680A2A342A710314B33537CB5C1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323344, "uuid": "55ad69ce-760b-4db8-918e-a84eaea92f22", "value": "dd37d5107a0f5ef74aaa6f8fa4aebb1d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323344, "uuid": "37c64f09-a49e-4591-bd19-120010980ec2", "value": "24576:QEmVuHGftHwxdvmMmRLuBCjNln0oTYdji524BL4vRMAMivRNAqr2+w:0QmVQzeMmgBuvzZAMivRNHS9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696323344, "uuid": "ead5e0a7-332e-4bed-a3db-313c6fa9d8a2", "value": 1398496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696323344, "uuid": "a313630e-c79a-4f97-821a-feac28b8eab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323344, "uuid": "824de942-8114-47ef-b79c-b58e171185c1", "value": "DdMB8WLfX%u202Ef%uFEFFd%uFEFFp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750a5bf5-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696374377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374377, "uuid": "a549908a-30fa-400f-8033-291fc8d99bd4", "comment": "Malware payload", "value": "f7f33e848d9e1fb21636ff91c6d7f20d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374377, "uuid": "1a2bce63-9c7b-4b72-90bb-049659ec11f2", "comment": "Malware payload", "value": "bfe8c651fdd2cdd55964863b6cb6572c58e541127c003a7b982404f6f7c29429", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374377, "uuid": "468e27e0-ac52-4a8a-9163-5f1a5cbf96b6", "comment": "Malware payload", "value": "6f4a6cfdcea14e1df816fe23e41cd1e4bca8b2f7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374377, "uuid": "8105287f-8f50-44e5-9b1b-021d296e2074", "comment": "Malware payload", "value": "16874d78ccdd1c1dc7aaa63d64f270d69a8f88c0754493959cc4203f3d070377e163a6b105d190510d39434f7a2a7c0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374377, "uuid": "c53af2a1-cccb-4a38-9d60-be6f9ca9bcb4", "value": "T120434BABA5008E7CF88BE67ED0570945F92422A065D32F3BA36BFCA35D321585D1BD81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374377, "uuid": "4ba47eb1-b81d-4556-8378-bd27db972136", "value": "1536:FYjM1iQm2aVvPD10sSSlkUFrMrPfdInwso8UP:ug1idv5zSSKUYrin36P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374377, "uuid": "f6ed02ad-3579-4446-a15c-517670cfb29e", "value": 57888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374377, "uuid": "f050a7bf-1489-4f32-b654-40501b8d8ef2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374377, "uuid": "e1caed74-cf72-49b1-9dff-c5594b0bfa7f", "value": "f7f33e848d9e1fb21636ff91c6d7f20d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ec8eaf0-61f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696341295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341295, "uuid": "4b712f8a-3bbd-4486-8a1f-1e8d81f07836", "comment": "Malware payload", "value": "9dc2aae4cec8055d56b2926bc2ee18e6", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341295, "uuid": "007682f3-e40c-488a-8b19-880ac4760003", "comment": "Malware payload", "value": "c0a40b2a484675a09cf9a6de30cf43ce4d2a4832fe7c5b89b286fea85e90852c", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341295, "uuid": "ef5cdfb1-5bb1-435d-a4fa-d5c55aa2ca8e", "comment": "Malware payload", "value": "50c25b49d1bf270e2c2e887ffed5b23de6b20af2", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341295, "uuid": "97f3e060-1f9c-462c-a39e-b2d10dfefb4f", "comment": "Malware payload", "value": "a7f5019b186f4251376c81bbf313f673f14420e3a9934a61f445b44b4c3e1352a4fe8ff37e8b7c54e03c6e678e004181", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341295, "uuid": "cf052193-2095-4870-a2d9-96e86a05b7b3", "value": "T121B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341295, "uuid": "ded192cf-cdfb-4f3e-9536-bd2d1261bae7", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341295, "uuid": "7b5039ef-d4e8-49f8-81e1-0ab72ac2e77c", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341295, "uuid": "f819efa7-e7e6-4c3e-ace4-84c059422cb4", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341295, "uuid": "a41bf8c8-3931-4cde-8aac-3d84e9cfea4f", "value": "AppleApp(30).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f74a0544-61dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696331645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331645, "uuid": "58e212a2-e1ff-49ac-b07d-6204b9635e87", "comment": "Malware payload (Mirai)", "value": "10ddaeaae8d49e2a121b152cdf0dd66e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331645, "uuid": "63f7dbe0-a852-49da-b8fc-b7be582f59f3", "comment": "Malware payload (Mirai)", "value": "c1b95bcd4d55c0f52f30c246fda8f4b732849bfa1ae3b0745747d2ca647adc38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331645, "uuid": "e663678d-60b7-4948-9797-042da6d20e07", "comment": "Malware payload (Mirai)", "value": "3abb84365bddf037df2591f0e7a3d97944f7e3da", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331645, "uuid": "a71b9fd9-fd2b-4405-878b-1803b13e9580", "comment": "Malware payload (Mirai)", "value": "945477edaa3ca45778bff7aaa9e62dad8ac9b1c1b016fa0bb14b496bdb7244fb3889048c419d60b1e5e4bfd3c739eb2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331645, "uuid": "a98c2f3b-891f-4458-b57b-635ac9390fb2", "value": "T13803F8AAF401DD7EF40BF77E540A4D09B93077C552825B2633F7BAA3AC721961C22D46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331645, "uuid": "b6ad6be7-b716-44a5-8a49-d1d9d4b80ed0", "value": "768:lOhMe5b4lZl/uzm8WSuuxWUxvFMYhTLQM8W7H:lz24cC9SHxVvFMCTL18Wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331645, "uuid": "a0bcce11-17aa-436d-9d23-fff1b980969c", "value": 38608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331645, "uuid": "70efd904-8545-4766-88bf-7e56293260f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331645, "uuid": "a42f2d27-70b1-4bb0-997a-7934ff196090", "value": "10ddaeaae8d49e2a121b152cdf0dd66e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdb7565-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344404, "uuid": "ecd64561-e5f8-48cf-b362-25f7fa058fd1", "comment": "Malware payload", "value": "ee5f77031134f8c7da74b07f930dc4de", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344404, "uuid": "7313466b-8df9-4df6-9952-9334b442ca96", "comment": "Malware payload", "value": "c2522d5b7fa52dad04cb9cecf44c791f8434fd94e940df8a2f7ced96be5dc9a5", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344404, "uuid": "b5e03efb-7c9d-486b-90ae-8e2dfda0d64d", "comment": "Malware payload", "value": "ad0e00bed9a1172b8a6b08fae9ada1372fad7841", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344404, "uuid": "79af2986-8828-440b-a301-c2923ca38651", "comment": "Malware payload", "value": "f2ccbf2c3652327f4a3eca71de5ac10a3e850b78dd2d43621ff2041da82227f805e91a2826aa08ec0f8182105e8f6474", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344404, "uuid": "9ede5f70-1253-4023-bdd4-9ab6abe2ba4d", "value": "T148B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344404, "uuid": "a9946239-1c2f-43e3-88c3-f44c946d51b6", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344404, "uuid": "0bf21e3f-c4cb-4e22-8580-ae7d0ba05445", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344404, "uuid": "c24ca691-a2e8-4d30-bef1-8c957e386aab", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344404, "uuid": "ea8151c6-e72f-4eb4-baca-b04b2a79d666", "value": "AppleApp(123).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c623d4ad-61b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696316101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316101, "uuid": "747191e1-4632-4a89-b592-2e33f9987afa", "comment": "Malware payload", "value": "0cfd81d59207319cf41b92ca30d82ea1", "object_relation": "md5", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316101, "uuid": "ec248300-ad69-4a14-a9f7-b3b41fbadf9c", "comment": "Malware payload", "value": "c254d6eca1cb3cbcb9bf1baa98a8783d663368f57684c7b0d22d755c4829066e", "object_relation": "sha256", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316101, "uuid": "c5894c7d-6c78-4c1f-8f80-046309447b1f", "comment": "Malware payload", "value": "75ec5e9f6dbd75bd96b6fa1e56a73d7f0bad2ddf", "object_relation": "sha1", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316101, "uuid": "873f2436-4554-4f4e-8e67-e059136f44bc", "comment": "Malware payload", "value": "dcdacb6449854a16580e570dd9f28e58e35142f3ad7c2121dc721a6ff116b42f97a0d76c6421abd56eedca4f473da76b", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316101, "uuid": "47ebfdea-837d-40dc-a797-cc204899bae4", "value": "T15F4413B51452265CF3AC1F7A2CC4A9B9F61239217BACC654421578302FD79B36F878B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316101, "uuid": "4266a0e6-863c-496d-b693-44fd8da505ca", "value": "3072:BPCdm7qlNXD1AOM9z7sojJRbb7hTd3c0SdrxwkmmBChw4AYMIi:BPCIUZq9XddF7hJs0QrxwkbBCy7wi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316101, "uuid": "b0c75d60-7f0e-4eb1-bd4e-ea0091e75471", "value": 256673, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316101, "uuid": "913c7b5d-a716-40d7-a779-81e279b24571", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316101, "uuid": "cf8ca5eb-aaef-4c60-8e02-04b10230c333", "value": "Transazione_202310011583040263_3200007044.tgz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f9fe65a-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346101, "uuid": "07ad842a-7899-4884-85bd-74a0cb8916b5", "comment": "Malware payload", "value": "58ba60e57ea0614b616f0399774d4e2f", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346101, "uuid": "1901f237-c3c4-4c68-b4ae-483673e11d16", "comment": "Malware payload", "value": "c2ab0a23a811422902fa780abe613532eeebb218385103ec1f342da90c5b25fc", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346101, "uuid": "104f91e8-fd58-4ebd-9819-7848addebf15", "comment": "Malware payload", "value": "2622af9db4f46e8dcdde10d9c90012c798f5fa02", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346101, "uuid": "3209f498-629b-42be-b7d9-b677aced11f9", "comment": "Malware payload", "value": "1fdfd58d91c1c899172cf86187c2a82320f0c77a03e2510411e02c10de1c765216862917b41e6f5ef255630950b2d21c", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346101, "uuid": "337ca173-fd5b-448c-9f9a-5f0979fe6d22", "value": "T11BB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346101, "uuid": "3e5704f9-a06a-4128-a2be-eb310842afbc", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346101, "uuid": "fe75f8ff-4c11-442f-85d7-8dc2e5de3b2d", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346101, "uuid": "f5cd4c21-bb96-4b99-97e8-dc7439a6a42a", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346101, "uuid": "0061af27-6a85-440c-843e-ab9a6ff694ca", "value": "AppleApp(165).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f8a292-61fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696344612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344612, "uuid": "1ac945e2-2066-44ad-93c7-15a86fd305cc", "comment": "Malware payload (Mirai)", "value": "d7ca7c1af9d0be7855c1b9a83d62dcbe", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344612, "uuid": "18bc61df-c656-4242-9ad0-a3f9ef1804d4", "comment": "Malware payload (Mirai)", "value": "c2d826fe3297559a741d723e0ed2faf71740129a1173fa72843fef2fca0a8aa5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344612, "uuid": "28c2b707-6552-4033-a278-40eb3f3c0da0", "comment": "Malware payload (Mirai)", "value": "22d38b79dc96bca042fdb39b9eef7aff168e2810", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344612, "uuid": "88f7c34b-0c46-4c32-b54a-7c84b06c26a0", "comment": "Malware payload (Mirai)", "value": "56e2cbe8c81deee61ff069ae83634ade7b91de21491027506c644cc465befc4c022da08b3bb0f312dfe85364170cbaa8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344612, "uuid": "f20be4f0-5b26-4d9d-81b4-b944e45c64f3", "value": "T147330262676E29E251B09377FC32FC5A66AC17F99C7730DA2CF0A51573C58024EF2682", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344612, "uuid": "083ed2a8-6e63-4036-bfce-57e3736b5a1b", "value": "1536:69O/ZMAXIxNUk0QlLcPqF1aBexo4opKZbm:69O/ZNKyMlLGqFUF/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344612, "uuid": "8f3d53d6-b636-4329-9b96-a6ff3b994d96", "value": 52520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344612, "uuid": "89671424-c915-44cd-846b-762bfeb1af12", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344612, "uuid": "97d5c8f5-93ec-4efe-86e1-44869fd4ec84", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4807dd1d-622c-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696365282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365282, "uuid": "0548f144-1c5b-4be2-93ee-88381e223058", "comment": "Malware payload", "value": "58c1aa7d18894e2762d97f8f2997662d", "object_relation": "md5", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365282, "uuid": "1c843007-2ab2-43f1-98a0-d2770fa36902", "comment": "Malware payload", "value": "c358eeda046271b9301c0036ad706a3fdb8d38c7c87d9d50108aa2fa4e301512", "object_relation": "sha256", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365282, "uuid": "b05f1170-6bc2-4474-b192-8ab2830c188f", "comment": "Malware payload", "value": "07d9c181bb0e00b7fd2dfc3806941ff2a8daf4ac", "object_relation": "sha1", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696365282, "uuid": "323ab44f-d14b-4ceb-9adf-7d598e50feb6", "comment": "Malware payload", "value": "e946b47acdee7b22481789b9040dd9511c000a3483e4a27c8b5306ca486faab32513cded4b6f8e8515ef7ee3b765cf9f", "object_relation": "sha3-384", "Tag": [ { "name": "CrealStealer", "colour": "#5A9C16", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365282, "uuid": "c6a7a058-45ec-4813-a5d9-c5d72149d59d", "value": "T165B6336553945CE5ECE7A13F892B849499F5BC5203A0E18F0368D9A60EBF7E06C7BF40", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365282, "uuid": "8692c10d-5d98-4a4b-bf15-4c22a9d901b0", "value": "20d446c1cb128febd23deb17efb67cf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365282, "uuid": "76406c38-2ea0-4a50-aa0c-fd7b8ae1f6b3", "value": "196608:TAHiIE7SRpo8fy7IudQmRJ8dA6lSuqaycBIGpEKo6hTOv+QKfrOs6Telo49vLLj/:UiIE7YofDdQuslSq9foWOv+9frOna59j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696365282, "uuid": "93bcbe58-0b25-4cbe-9929-984d77cb2d7a", "value": 11210405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696365282, "uuid": "5c1ee803-1694-46dd-95ac-a1c465129f2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696365282, "uuid": "16be3c9c-e468-49d7-8986-3a29047f1a26", "value": "Creal.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23fa6e17-61eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1696337304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337304, "uuid": "051550ee-ba71-43b8-b2d0-f2d3605e8886", "comment": "Malware payload (LummaStealer)", "value": "ba97e192bb28a7da01a703f543d268d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337304, "uuid": "a5357a80-f72e-49c4-bf9e-58b983be4790", "comment": "Malware payload (LummaStealer)", "value": "c3c18c67df080ce7078698fc7e0ca38f17e53b62f9da673c5d3bb5f64de5f84d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337304, "uuid": "491082f8-114a-433f-a252-9cce51ababc8", "comment": "Malware payload (LummaStealer)", "value": "3398d34327c1c4374d56710970e096d96107be2b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337304, "uuid": "e0ff4285-7949-410c-be12-7667ac674fe5", "comment": "Malware payload (LummaStealer)", "value": "01436f79aff06e84838c183cebce409647c24618cf90fb85a5086e7d0301610a2d5bc3b53a41e6e68c46c40675e7ef8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337304, "uuid": "dd57dec0-6e48-41d8-98b7-4eb91de980a6", "value": "T1CAD59D2EAF501A63E276F575E8D62007F9A121CB23306D071ADF9348950BE9739CAF5C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337304, "uuid": "a7f14be3-ab06-477a-b971-d4ddd9953b0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337304, "uuid": "3d8c56c3-ab03-487e-b81d-16ed799ec276", "value": "49152:fbfFiBfhc9VChRL48KxkAHCgi6APvlwWgzWg0NclUZCmIFlBCFDy8xv:j9WhcUL5AHCg4P9ZgzWz4mcIIIv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696337304, "uuid": "aded11fe-5be4-4adb-9868-094a9ee97aa0", "value": 2945688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696337304, "uuid": "f021bca3-7397-4548-bb94-f4c5bb8ef380", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337304, "uuid": "6055cc99-3b34-49cb-8f58-a1507f9df52f", "value": "ba97e192bb28a7da01a703f543d268d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "875b0a4a-6180-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RecordBreaker)", "timestamp": 1696291514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291514, "uuid": "1c964aac-c874-4e3a-b51d-b1c31eec6b51", "comment": "Malware payload (RecordBreaker)", "value": "6909f15203fad4b8cd743dc9b1488f27", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291514, "uuid": "c29f95d7-f0cd-4083-ac80-0a61c5c6be65", "comment": "Malware payload (RecordBreaker)", "value": "c45a9b56d9fd1edfbefdb2b124e27bebb1f7cec2126e3031a7c0d82e3624aa8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291514, "uuid": "e23013bc-bc15-4869-abb1-1c7b620b46bc", "comment": "Malware payload (RecordBreaker)", "value": "fd946976be14dd8a9fea499138107465848d3a4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291514, "uuid": "777ba37a-a8e6-423a-afed-a0ffcb56a906", "comment": "Malware payload (RecordBreaker)", "value": "d0505460ec3e0495076146382fa2837a978c70362417231b98d143a6f54d913f4566bfc5ea6c58573ec1ac9f420f3d05", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291514, "uuid": "eda86926-ec62-4e8f-852e-b9066003bc9e", "value": "T16134D02279B1C0B2D6E745B9A870DB957EFEB9221361C15F37641A9E5F203D0AB32307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291514, "uuid": "2c093311-9a77-4c34-a45e-4630d259dbcc", "value": "a7960cb042304220b44306228fd698f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291514, "uuid": "bdb94d6a-d0b4-45e1-b621-e4dcbedcc6ce", "value": "3072:NVm8XyErZLlx6CqUV3Dhuhi4yTeGH1LxC3ny7GWNALjdpZ5+fF2n/Q:Lm2Lr6bstKyKGH9xC3y7W292n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291514, "uuid": "9b17a2bc-0b22-47ed-81ce-4e36c3341d71", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291514, "uuid": "3a6b3804-14b0-4abb-982c-900605307854", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291514, "uuid": "2866006d-3398-4660-995d-039ca6d1f858", "value": "6909f15203fad4b8cd743dc9b1488f27.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3f06bba-61d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696329922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329922, "uuid": "a02afcf5-be95-4890-b7cd-c99dc1afe0ca", "comment": "Malware payload", "value": "c273bf054cef513dd7e614f40c45b49f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "BadInterop", "colour": "#34B4FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329922, "uuid": "86fceeb2-7468-4e4d-8cac-1fb3cbbabd32", "comment": "Malware payload", "value": "c46ac6031adc55e9e393e0d7b7eb21f3de0f834aee7e0850f7713e15ca816762", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "BadInterop", "colour": "#34B4FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329922, "uuid": "e600b1f9-2142-4757-bd34-d9380c8a2078", "comment": "Malware payload", "value": "9e1266f42ccf08f3622f2c86151eb5b44930798a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "BadInterop", "colour": "#34B4FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329922, "uuid": "4b86ec35-79fe-4887-b445-d66c4d253093", "comment": "Malware payload", "value": "b4d26c10e33818578be9e3a80c72386ee8a172f44a99d13bd240a97ccdd95d9e8b2755bee18be447e950a615a3944df8", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "BadInterop", "colour": "#34B4FE", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329922, "uuid": "52c2f883-e46f-4dc5-aabb-0e801942aefb", "value": "T1E471FE0AA3E8066BF8B74736AEB3431327B4FC109FB3572E19C002596C616245A32BB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329922, "uuid": "c9521536-83a0-42aa-8713-7ba21dadac1d", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329922, "uuid": "326ce3f1-8b12-45ca-be6d-9f37491ae269", "value": "24:etGSg8+mUE7R85z7/kCDTDXYldWrdOKLtkZfFABSuuZ0WI+ycuZhNCNakSzCPNnq:6qXE7S5vkUTDXYrWrKJaYZX1ulea3qq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696329922, "uuid": "a28e9086-e69c-4b5d-90ae-f505d1cde9c5", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696329922, "uuid": "1a2c7896-95bc-4138-ac16-6315e0cb9ce9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329922, "uuid": "8461b00f-86a9-414d-aa46-99aab0b08a4d", "value": "f1j4m32g.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38be6c57-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1696313716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313716, "uuid": "4913db10-8b87-4a5f-967c-801d90c922b4", "comment": "Malware payload (DarkGate)", "value": "1bc6fdedb4b6d9bd760a7e0624175068", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313716, "uuid": "9144164f-112e-41c5-82cc-239b9be8c5ed", "comment": "Malware payload (DarkGate)", "value": "c523d51dc2bbb008d3d31f8aa1b9b366c7f3ec7fa0b25456d3ee036dd8ada8c9", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313716, "uuid": "68ac38cf-d76b-4044-8fdf-31a22e1e0d18", "comment": "Malware payload (DarkGate)", "value": "4cef7d140e42ecf80839855ff03bc86d2efc3300", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313716, "uuid": "489d5826-31e5-40eb-812e-7105d5c45dfd", "comment": "Malware payload (DarkGate)", "value": "06e9694f975c0e7d320b6c5ea5b2abc8fa8b4b25a2534e6cbd777434dc50520309cb78e477e077f2d4bc7dbd06590249", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313716, "uuid": "21fe9b42-b749-4c47-8166-2be8624e18c1", "value": "T1C441E1153BCA8B6AD3F0087798B3A321CDBBF959F932C74A01909D8C6544A00EC75F2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313716, "uuid": "063993d4-d120-4dd9-9897-c338f76355ac", "value": "24:8aSNWJCnScMtQOvA8xGARc4S+/leXmR7GYESi8500XU:8aQmt8aGARR/eXmRaYES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313716, "uuid": "3b5aa8fc-57ba-4bfe-af2b-1b03e3aedce1", "value": 2074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313716, "uuid": "4366d1a3-7835-4862-b37c-b09ec7cada46", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313716, "uuid": "0ee540ef-b10e-4ab4-91cf-41ecaee56d9c", "value": "BQMM.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2329868-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347501, "uuid": "7c8b9036-1a20-474a-9d5a-c63014f2b7d0", "comment": "Malware payload", "value": "32c4e50ec19c3d2c3a22eda90d69a6cd", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347501, "uuid": "c76d8760-48f2-4187-a43d-6556287145f9", "comment": "Malware payload", "value": "c5aeb40a18bf0959c6795533a5741c6846edc45d7328d63dfca09e782cbdf135", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347501, "uuid": "ef822040-5e02-4e7c-b72e-46b77cc60c91", "comment": "Malware payload", "value": "b0ed023df5847d75e495828d334f1b53c853e8a4", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347501, "uuid": "f5b204c5-1502-4000-bfbd-24be6b932f89", "comment": "Malware payload", "value": "c77c16e023bb3a9a31c35e76e2e728f9b9d2732915881b6b584c332141b558b11fd4a2b1c3d150d114384e5df7df0f9a", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347501, "uuid": "7ac0bffa-46cb-4e05-9824-c6a54621ac2a", "value": "T132B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347501, "uuid": "4e71806d-de7d-41cc-8151-5602781818d1", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347501, "uuid": "01803409-edec-4107-87c7-b04b1832b174", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347501, "uuid": "1dcb8d2d-e338-4af2-95db-a431fa3ce145", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347501, "uuid": "19bda999-e0ab-4616-bdfb-5200d7754735", "value": "AppleApp(251).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ee1a42-61cb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696323753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323753, "uuid": "9325ec51-3c12-4781-95f4-7f3e63119a92", "comment": "Malware payload (Gozi)", "value": "53c902bae11f6de401c37f80bcfc4e73", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323753, "uuid": "5be2c53f-4943-4a24-9903-9e307dec7fec", "comment": "Malware payload (Gozi)", "value": "c5dd5218b37478426cac0c8a1190967bee9ee752c1c4278611668f9f8a36c0da", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323753, "uuid": "9a76a06a-f1b0-4531-b165-c1997889aedf", "comment": "Malware payload (Gozi)", "value": "f5f91307faa42fcc12c7abb9795043bc5fdf6cf9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696323753, "uuid": "e3288e61-2f8f-433d-b87c-b06b32b056c2", "comment": "Malware payload (Gozi)", "value": "71503e4dd6be154d1267f8e3fb5529157a9952d129dbe62e9f1582d9beaf56e8214abd7dcf8acf79d5aef9819456a35d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323753, "uuid": "1a8dfcde-e1ac-4cf3-a33c-19cc14a65ca3", "value": "T135F37C1DB7D25131DAAF193B2024C3F15BBFF4D10F26685FA748C22A0F251B39A2D95A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323753, "uuid": "8f1f67ea-13e3-4cc4-aa1f-91b495ee7892", "value": "b708bc91029a5428d40eddd35d2240ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323753, "uuid": "4b43de63-0859-4633-b019-b9cbde20f78d", "value": "3072:uusJI93w/UgLYKFSz3yT/beGvQt5/Ciq44ITrPRUy0sl1VJa9CELqzp:wJAeUkYVqYj/ZZ4Oay0sahLqzp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696323753, "uuid": "31f9da73-8ab2-4401-bf3f-07ba37fa5df5", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696323753, "uuid": "e5397373-63fa-4d38-b86f-3a9d3145ccac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696323753, "uuid": "bf96f5f9-1438-4c7a-8250-8358edc26d0d", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d14a7ff9-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346185, "uuid": "13f55f1f-2256-4e13-8327-2d06f4058037", "comment": "Malware payload", "value": "edf2e46fcff96d76c489b9902a69f94e", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346185, "uuid": "e7985914-2048-4e68-9e4f-c1b0016d2fd4", "comment": "Malware payload", "value": "c5fbf07b82bbd108499ccecc689c56432852eb8b496c617fc5814ff2d8fc1d42", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346185, "uuid": "33bdf8f2-3999-4c2b-9f9b-1cb4281e660e", "comment": "Malware payload", "value": "2af5ad75e8322f8a04a0fceee204a68d2027905b", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346185, "uuid": "e9ac01ba-d2ce-42c2-9c00-3aaa2c105f8b", "comment": "Malware payload", "value": "c46fb3697915570fa8fd3c63a62d20c2c5e46f6576d30d5a339e121138cdd7aee5bf6b934043cf4845837ef9e979ef1d", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346185, "uuid": "a81825b4-ae80-4ed5-84ea-fe818abc050d", "value": "T182B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346185, "uuid": "22fb3355-ecfe-4c4f-bdec-653c53c8791d", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346185, "uuid": "4f1ea3cf-7cdc-4c8e-8d8c-f51abf33b6ae", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346185, "uuid": "4c4f9b6b-8167-4fe8-b603-9118b0553820", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346185, "uuid": "f301d43b-ddf1-46f4-a67a-19d6e9fb7c29", "value": "AppleApp(157).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc9b246-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696356859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356859, "uuid": "b27a3aa4-aafe-4e4a-b152-7258d5ce1696", "comment": "Malware payload", "value": "9d342dbaaada6a16b4634ebcc73f9503", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356859, "uuid": "21643b9b-19b3-4d98-a770-182ee12e9fe8", "comment": "Malware payload", "value": "c75ede3351bf51542cc957b463b0b23b5f0be234d046ffca94257c5ea7cfef5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356859, "uuid": "174111fe-dad6-4210-acff-8da505190340", "comment": "Malware payload", "value": "22cd2ed7a67025b5de86e865a2e1b451d4ae5956", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356859, "uuid": "2144a570-5b27-4a53-b09f-1783242dcf5c", "comment": "Malware payload", "value": "c6e67ee0692e56c143833c6ace92b53bec31cacf890777c3b2a97e8b0176f780185060bc11b8ced0f146c023957e075b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356859, "uuid": "5ff20f96-8d9e-4cfb-9491-e7eb29fc96ff", "value": "T121843A04265CA6AEE1EF9B71103295E1C913D76C61A4693CF2E36077BEF0FAB510E217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356859, "uuid": "e6d02df8-bd9a-4e3b-8546-3e683f94278f", "value": "f707ada0aac189999ec6eb4a5a71dfbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356859, "uuid": "2ee47cdc-a370-4149-93a2-f7b178776dd0", "value": "6144:OoyQrQakAGfCz35Jw66RPalaYNx2aDPUJKpn7jmb5kNkzJ43r7PSAxxOJYJfs1TU:uQUD66RPQnx2aLUJyfmb5kSPZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356859, "uuid": "ecef9567-0be9-453d-b057-11cee0967345", "value": 401409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356859, "uuid": "8a4aae71-623f-43fb-9dc6-bfcd0b24684f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356859, "uuid": "60e722ac-b252-45ad-bb71-021bbc86fb23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2ef336-61ee-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696338957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338957, "uuid": "ec61d08b-340d-4385-8b0e-53b8ab223b77", "comment": "Malware payload (AgentTesla)", "value": "9ecae039ff7e74e184ea9d1a85f19193", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338957, "uuid": "94ac47be-1a88-4478-9e51-8fe29bdbdc85", "comment": "Malware payload (AgentTesla)", "value": "c8298ea15d9737ceb275406b2d50919d012195a4e9a0f3be1f514fc364348b9f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338957, "uuid": "72db6982-eaa2-44d9-bd3e-c5c40434a1ed", "comment": "Malware payload (AgentTesla)", "value": "0c47dd3f189d2a82ac1b7ee81527c66e51317f80", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338957, "uuid": "68b29678-3377-4402-abc9-e0ae51f1a799", "comment": "Malware payload (AgentTesla)", "value": "c5cc03c5c177464db6e34846d3680bdc16813a47a13304f48eb13d5d4f66bb9b5dda987366b9ee22748d8e4d266b8d5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338957, "uuid": "35f939de-ddc9-4131-9413-e614f7c6be81", "value": "T13C2533F69F293EFC567C471C68BB6E8502A9C4D3ED4CA889371D595311B2D03022B8AF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338957, "uuid": "aa67525e-bdb5-44c8-8022-2316b91d820e", "value": "24576:n8GMSchpW98EOD2CwBzCF4LqPc5AhS9REGfYJEL:08biYS+AO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338957, "uuid": "0d5d3500-2be6-4b70-8b67-02348f7fdcb8", "value": 1038390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338957, "uuid": "f4115bf5-4ae3-43bc-93c5-e815948fa5ea", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338957, "uuid": "a710abb0-ed89-4295-b887-218278844042", "value": "PRE-ALERT SKLZ2112352 00 SHANGHAI.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50bf76e6-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347257, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347257, "uuid": "4f75515d-7b8c-4a01-a8cb-cdccc1e08024", "comment": "Malware payload", "value": "40475a0d83aca13bdbd7c243a747480d", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347257, "uuid": "7a351fff-ddfa-45f8-bfa0-7e6c2a0e724a", "comment": "Malware payload", "value": "c832413d7942d9920536fa82c943c664a598d44e2e6e483e35e9b157db252174", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347257, "uuid": "fdbfa68b-90df-4ba5-9200-d31d38febaa2", "comment": "Malware payload", "value": "218268661234fb6ad81c115a06719d0ca2d9129f", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347257, "uuid": "1be3179c-46ae-422f-be7f-44b3a1565f0b", "comment": "Malware payload", "value": "e7a3cfb0d43cc8e04a7d57e702b2739c6a7182ca8ec401c1835b75cccc66a33cca8c6e525f594e56a5808e18bffcd08d", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347257, "uuid": "3e7578ce-0214-4fae-9fa7-759496615d2f", "value": "T194B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347257, "uuid": "e23be958-d118-4ee0-8097-957e757a8298", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347257, "uuid": "b366ccd7-1f94-48e3-ba3d-dc3763d1b2fd", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347257, "uuid": "c500b72d-0a25-4319-845f-81c1d955929d", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347257, "uuid": "caf04cdb-3861-4f0f-8699-7d8e0ba56438", "value": "AppleApp(209).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "577ec97f-6234-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1696368744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368744, "uuid": "388e2d99-91f0-42ec-ac77-1afac37c53ed", "comment": "Malware payload (MarsStealer)", "value": "d62f1da7d666dca070d68ea56a4564c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368744, "uuid": "af304102-8879-4018-8660-dbf25f044360", "comment": "Malware payload (MarsStealer)", "value": "c88f359aba9e44593d5143bab7b3f9f3937585deeffbedbbba8422dacbe5908a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368744, "uuid": "6dbcf396-89b4-466b-9d72-e6c8da112b74", "comment": "Malware payload (MarsStealer)", "value": "2e65895061d916850b104e4819253b493639813c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368744, "uuid": "43880b78-287d-4924-a4c7-1278edd5ea94", "comment": "Malware payload (MarsStealer)", "value": "1da648b9666853c6538c0a391f3d5768d3a9ca5fedea3de7d0cd2a61d24ddc6c337b7a3f7235e2db0c22eee9ec3ee63a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368744, "uuid": "4a7ab952-885a-4e40-af44-3f420945f7b2", "value": "T1BE549E13B391AC61D4729A315D39C1F83B2EFC618E69579B33583F3B59701E29A62B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368744, "uuid": "5e151299-d232-42a0-8566-9d6e2d0e392f", "value": "775c7d434cffd499e537a34db4132a29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368744, "uuid": "fc5fc9df-6d50-4d6b-b5bf-77dcb6ccf887", "value": "3072:lCa3bpjSvYHSaUN2v/9IlAVi7YSydxpjZlAY7rGBK5MHDFY:l7LpevkSaUN2X9IlFYSqZllr8KuHD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696368744, "uuid": "de0f9315-5fa6-49ee-b8dc-41ebca2ce4ed", "value": 302592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696368744, "uuid": "b515e474-4478-4921-ba0c-0a7a8a710f8a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368744, "uuid": "846f1e93-bd7f-44b4-8aee-44145fffeddc", "value": "SecuriteInfo.com.Win32.DropperX-gen.9364.279", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4aee663d-6232-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696367864, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367864, "uuid": "07719482-d103-429f-bc05-d034db5269fb", "comment": "Malware payload", "value": "41286f0e34c67d8ad8f1d5884d16bd54", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367864, "uuid": "6f6dd57e-81df-47e1-8259-a98b7436ec74", "comment": "Malware payload", "value": "c8ab48ea79e4f5698015fd1111ab411d8917466660afe2731c5f65ae6b479caa", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367864, "uuid": "004cfdc7-5841-412f-aa6d-5e634f3e4ff6", "comment": "Malware payload", "value": "4deb95c9da4ae1b39860d194156a862bcbd1003b", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367864, "uuid": "a300b5f7-4654-400c-8900-aee831b2c8a4", "comment": "Malware payload", "value": "e761204ae71984e54430130dc9c61aac08dd6855d20c4cc2525d553f95b4726cbfff33ebafee23ddf67eef846d6e2e01", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367864, "uuid": "73a88b19-d872-4a98-9b68-3877fb8c6114", "value": "T1B133ADB18DD04C63438E9B77C73EEFF4A57383A091616B9B96B0F9484259E27410EE98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367864, "uuid": "43ab265d-f122-40e6-af88-f3dcd38da010", "value": "1536:CYtI3P8IVbfUz/au7q0QOTQk0tI3P8IVbfUz/au7q0QOTQkj:CY+3hVfOhQz+3hVfOhQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696367864, "uuid": "cdde57ea-ec3d-414b-8e8c-a1e9f1daa36c", "value": 55075, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696367864, "uuid": "2e69946f-8431-4169-a154-85a84eb1b931", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367864, "uuid": "9a01507e-aadf-4a1d-9306-1ae15257ca55", "value": "Zip_Factura_Digital_QR2Q7HvJiU2.HTA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0b8ad9a-6232-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696368088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368088, "uuid": "cee53804-7a35-45ab-994c-f2cfa69bb778", "comment": "Malware payload", "value": "d5ddee694a51d4da14809a5afb64fb96", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368088, "uuid": "1cee6277-a6f3-424a-9132-9631173d49bb", "comment": "Malware payload", "value": "c8f6fd3176be7532d842ee998be0b02ff878781b0a61d7dc5e569b0b0f8fbc6a", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368088, "uuid": "5c13ef5c-1173-4ed6-b01d-66013b14232d", "comment": "Malware payload", "value": "f521783e3d7050cc6dcb0aeef48cf15028fef72e", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696368088, "uuid": "0615c24f-a721-4176-9a7d-3ffe2de0e7b0", "comment": "Malware payload", "value": "68bf2c6c4c63ec25fdab83dece1ea25101803a6decfb6c377f6c7c7e4db983c21e602ab591d95f74f557bb9bd9b2ff2a", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368088, "uuid": "65696b06-0ce7-46f4-929f-a7b2fe9cf9c4", "value": "T1C1339EF95E850CA393CFDA736236D7B861F38A66D54077C78278F98A4252B23C40ED49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368088, "uuid": "a7fc59ca-ab0a-43dc-946f-a41867dfb6df", "value": "768:C3EnEW+SqmivKmqPpcTANywspOZQkrfEkEnEW+SqmivKmqPpcTANywspOZQkrS:C3EnEv6edzqzskEnEv6edzqzS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696368088, "uuid": "2a3dd915-94ed-4199-b339-2192cea67bb0", "value": 51389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696368088, "uuid": "63828483-5d24-469e-bc34-2c6d64d80638", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696368088, "uuid": "498055ff-f12b-4a6a-95cd-939d52b57564", "value": "Zip_Notificaciones_03102023_ZEtlXbZzEUWNVw.HTA", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f7e895b-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374394, "uuid": "908b4804-0ca8-4ba3-9d6a-0e1480a467ec", "comment": "Malware payload (Mirai)", "value": "c1c3a750ad41bb21fec2508137c41e3e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374394, "uuid": "21c53b82-0394-4da3-b268-f3fbebf65434", "comment": "Malware payload (Mirai)", "value": "c94eb9255748df852919a3247232239e8a9eec20f871189a81d70ab58192b615", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374394, "uuid": "0825bb6c-35b0-4115-99aa-408c35f61b5f", "comment": "Malware payload (Mirai)", "value": "c290eb0d19b24e4512ba386daaab14dd11bf80b6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374394, "uuid": "2eef6f21-44c5-41e8-8e7b-81576cd3952a", "comment": "Malware payload (Mirai)", "value": "b48545080cd386c01e9b755d2005e9abdc92c5cb566227ecd8c08da2e9a11cbb6d09bbd87c985e82a4958cb29bced16f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374394, "uuid": "bc2f6bd3-908b-4ade-bc80-4f875d03fa01", "value": "T1E5433A0272180947D4665EF0383F1BE083AEFDA121E4F689794FEB568276E371186F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374394, "uuid": "4416599f-071a-4d6e-9bdc-ca4f471b8804", "value": "768:NNz17q6wDsfR6hVY5+Bbm6eJ5EUyrKc+MwRuMyA1OaY9qKlb:7x7pZ6S4bm3EJX+MwR77YcC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374394, "uuid": "81e8110e-d647-48a6-ab52-ae6c512512f4", "value": 55592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374394, "uuid": "6c3d5d25-6a39-49cd-8010-cecc73df3c10", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374394, "uuid": "6773227a-b35e-4094-89dd-439e90cff774", "value": "c1c3a750ad41bb21fec2508137c41e3e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4dc75d4c-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347252, "uuid": "cd290549-1375-418e-b16e-e3178b55c9fd", "comment": "Malware payload", "value": "2efca5490e20b3e0b039008dfded1bf1", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347252, "uuid": "a473d03b-8fae-4f8e-9e8b-28e65d0c05f0", "comment": "Malware payload", "value": "c97c07df98699995fa8f4c8fe5bf4a7b8de2ba9b53f4676478c38ef9b6a7963f", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347252, "uuid": "3ddc8f38-f4ae-44f6-a029-94bc57bf6f03", "comment": "Malware payload", "value": "719744ef1811063c8587aafc217099e0e35e5e10", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347252, "uuid": "d427ef7a-b67d-4b26-a6cd-937a41f18f5a", "comment": "Malware payload", "value": "95cf7ab2fb0a4b478616b2fb97fc697da85067ad43864b8a6eed05406ab64029431d80c3f034aeab123aa8b60b5622c5", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347252, "uuid": "70d5faaa-72c7-4d66-b4c6-8ada07decb0b", "value": "T1F2B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347252, "uuid": "ab8f2862-a5cf-464c-8605-aaed78e11b92", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347252, "uuid": "7b796325-de1d-49fa-b3aa-53d88936239b", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347252, "uuid": "d63b2f84-9646-4e88-9a1e-2f0aded15d3f", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347252, "uuid": "9a417608-6a0e-4440-b439-714d2ab8fd5f", "value": "AppleApp(233).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c607e4f-6200-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346391, "uuid": "815ae440-6083-4852-ad55-7e264e9b7546", "comment": "Malware payload", "value": "9e944f179c22b480a682092116492cc1", "object_relation": "md5", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346391, "uuid": "133aa7cd-8132-4d03-a859-f93ea9336031", "comment": "Malware payload", "value": "ca0fedc82a173af6ba4e5764bce4c98838d59babc99fdea3c9325f54ade2f649", "object_relation": "sha256", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346391, "uuid": "123596ca-34c7-4b03-8d99-2c369646ea9a", "comment": "Malware payload", "value": "f69e83d31c8e252aac92ff7e233b548591b2c8c3", "object_relation": "sha1", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346391, "uuid": "6142556a-cf32-4f96-bd30-e5c0a22a3e5f", "comment": "Malware payload", "value": "9319a1b5e41b44bc2fa057bed8e59ebdb238538c8d5670e99ff6f71f1ca73640dcab548da51c8ce503e0a1c1da838d9d", "object_relation": "sha3-384", "Tag": [ { "name": "Pikabot", "colour": "#4EF562", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346391, "uuid": "af97613f-e503-4455-adc3-67616b971424", "value": "T14933275BE39321FEC5A7C27086A75372B570BC245120AFADD790FB756F25E80AA2D700", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346391, "uuid": "049f3048-2374-4c0f-b823-2cba553dd0dd", "value": "f599f6d6eed879ac9612841c28ee3418", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346391, "uuid": "8dd0b591-932f-42d6-9988-10541c4c2c16", "value": "1536:M7pxSJsy6Nh5wFHssKjrtN/5jqzyCNwGXGhr2c450XN:oYwNh5wFHssKXnxjNCNHGNXN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346391, "uuid": "9bb285a8-4dcf-4c20-9f03-3908630403d3", "value": 51200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346391, "uuid": "e26e828f-0a52-422e-b282-69caedc7c939", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346391, "uuid": "aa46ef01-3ae7-4ae4-877a-cbae32f5f089", "value": "8O.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ae70f0b-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1696313317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313317, "uuid": "487f2990-38ba-4621-88c8-df96aee4091a", "comment": "Malware payload (SnakeKeylogger)", "value": "2f7967cefedc5eb6dca68286a466984c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313317, "uuid": "a45939d5-d692-4e54-8b27-5a984a84fc69", "comment": "Malware payload (SnakeKeylogger)", "value": "cb84aa32b87319aceaca7792a356f57030077830811a7fa0ea045a67afa62b5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313317, "uuid": "a1ae3abe-a46c-4f38-937d-da07a179e337", "comment": "Malware payload (SnakeKeylogger)", "value": "27afb566469074ab421e10ba7b269202d78ce3a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313317, "uuid": "b3394a08-8df3-4f4d-a957-95eb13a9d986", "comment": "Malware payload (SnakeKeylogger)", "value": "036814311f8b7d27db654061abb0cff1fa6e002e6471cd512ab7e0b0122dee5dd2946c60e757c86cea866392f0890219", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313317, "uuid": "a151a902-9871-4e1b-a017-0ed80faafdf0", "value": "T1FEC402093ABC0A7DD76ECA7E0672044203FF21097E54D79E1D4A68DE2DD33A25B06B5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313317, "uuid": "016741c6-10f6-4faf-bc23-309cb74e0143", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313317, "uuid": "913fb5b7-878b-462e-8771-afdf64a9ad2c", "value": "12288:hLTiSAx5PWPQIOlAiayAlrjDBEm0tWSd+IglYI4j8a4:hv7Ax5uPDEsVjHEgqbj8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313317, "uuid": "6b629357-3245-48c1-9884-750a2ffae3f8", "value": 585216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313317, "uuid": "9d8d04c5-2cf5-46b3-92e9-1439109cd27d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313317, "uuid": "42568ed4-0688-48f5-a9fa-9e65d0b81ea9", "value": "factura.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "509590c1-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1696313327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313327, "uuid": "638a09a8-6994-46aa-b3a9-b52aac423951", "comment": "Malware payload (SnakeKeylogger)", "value": "ab223640df9d11428d067abc28d48f31", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313327, "uuid": "49b7d4fd-cf5e-435c-8eb1-8985bd2e7bf1", "comment": "Malware payload (SnakeKeylogger)", "value": "cc45e233a0a65ac709ad161ec0e2f86abe56228fb871ac25cd546663c192e0a2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313327, "uuid": "aeaf31b8-3286-483b-8134-d8f4df2614f7", "comment": "Malware payload (SnakeKeylogger)", "value": "3dfd2eaad22f3c45eae8ced1c722a44881571ac9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313327, "uuid": "5b4aa6af-289d-4826-9d42-741e46c259fd", "comment": "Malware payload (SnakeKeylogger)", "value": "b05a8c8885d93a7ff08ab041a3b94697e412e594d73678128d3aac7d562d685ceae422d3ab942f0ae7d2bb0f88b4106f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313327, "uuid": "bb98cab7-3b06-478a-935b-c6cb891fa20f", "value": "T18CE4020A267C8AB8DB1DCA3F11B6445503FF6108BB14D69A1E4F28CB2D933935786F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313327, "uuid": "2b188d0d-fd04-477e-83a8-27e8e7dce4ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313327, "uuid": "5a39d84a-21ee-4891-9e33-9ac69e7f0d1b", "value": "12288:JcfiSAx5PWPQFq8rqAMR9KJjfVLsvwv6Zpd99NGyht/j8rFNgmF7isj80rWzuA:JI7Ax5uPM7qAMRk9ivTd9iecTgKmsj8L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313327, "uuid": "3234bd1a-46b2-4e6d-9467-35969a9d8d54", "value": 699392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313327, "uuid": "71b5e951-74fc-4317-b9fd-54277bb0fcca", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313327, "uuid": "a97a018c-94ad-4bd4-8441-d69dfd32048a", "value": "SQ230000000828186.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153f01e9-61c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696322247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322247, "uuid": "c642f391-4834-48b9-a7e2-3158f2a430cb", "comment": "Malware payload (AgentTesla)", "value": "0564dcf513b20d19fcd0ef38c51d6f99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322247, "uuid": "f21617b4-4013-4b38-8bd9-e00ca030709d", "comment": "Malware payload (AgentTesla)", "value": "cc673a79555d98784c291ea3077a7e11be6e79e386c8e14419fe93f4d851cfcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322247, "uuid": "22d72c2e-63d5-4250-9a55-8ba51eb16c84", "comment": "Malware payload (AgentTesla)", "value": "542576833b9c80642b6526b0e9222551ea7f9174", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322247, "uuid": "0d2e3d58-319e-4a55-b77f-4f0c49cad137", "comment": "Malware payload (AgentTesla)", "value": "9b8c9717663ae4a1d50e601b8c7b8a57c2cedd5d9422798827c4f8c109084744fcce4ba2f1c2e7617930549da9f5edfd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322247, "uuid": "a2aa80b8-e3b2-4831-9a0c-928c4b1affb9", "value": "T1B6C4CF3D31EF2785F13AA7B5C3852F99C7E9F2E6633AF61B2E9605424410F40DA13662", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322247, "uuid": "fc99ba72-1466-4b22-be3a-fc3e01e0c480", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322247, "uuid": "c58a2da7-d846-45b0-9bcf-ec49e3542eb5", "value": "12288:jjDc1m2aXoeJJ5m5Ki6ebKgM2/pLPDXaY8boUQ2TXYRLPzWBh/KP5+X:nY1m2aXfJkKGNLXhBbW/cEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322247, "uuid": "fd244a8b-e3e3-4c99-8cc5-4ad5a906cbaa", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322247, "uuid": "f7931926-67d7-48c0-8a0f-200e4aaf57c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322247, "uuid": "1029fb3c-489f-4041-98dc-95d9d34607d8", "value": "SecuriteInfo.com.Trojan.PackedNET.2415.24255.2295", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e56405-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696357178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357178, "uuid": "cf715e69-5fe0-4088-9608-c2a0015bfb33", "comment": "Malware payload (Formbook)", "value": "f328f1d6c69059f08f15ab3dc8695639", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357178, "uuid": "65c42087-c46a-49a2-9838-b8f165d1956f", "comment": "Malware payload (Formbook)", "value": "cc74e95443838d54168e736be39859926097fd7da7606b6ef4d8bfb794303eff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357178, "uuid": "e6f4eee6-fff7-4484-bf3b-704ed6308f4a", "comment": "Malware payload (Formbook)", "value": "a02e19ef7cea7ef5cdc7ecb05146e9b509df80ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357178, "uuid": "5da1d286-a004-4437-9d57-4459d2a15ed8", "comment": "Malware payload (Formbook)", "value": "756ddb00d16f1da3f414f172fe2d9d1657c157affe4b6edee3b9e7eb35b5beb5cf038f7c9ec25677d8d61b231387528e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357178, "uuid": "a64a046e-abd5-4105-9209-6feea9d76120", "value": "T1D905F005326C81E8D52E87BE52CA48B553BE0C173974E94F6E263CEB3BF13914582F99", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357178, "uuid": "2fdebf8c-bf69-414f-9584-72042a3bf491", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357178, "uuid": "4f107f1a-d8f6-4276-93f3-ca58877a755c", "value": "24576:uX7Ax5uPybFZxVHjvGeniSqFk51dh3fn9Y:uXMxA+JNGPAvh3f9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357178, "uuid": "3e08565d-e7bd-4a0f-bc24-8b88a846d6f0", "value": 873984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357178, "uuid": "f0c5c3e8-b93f-487b-9770-9e6f318dac55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357178, "uuid": "b1daf9db-38d2-4094-82e8-d84a187ece50", "value": "41570002689_20220814_05352297_HesapOzeti.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faa4b752-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696356991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356991, "uuid": "445571f5-0ef6-403c-9686-9134357e8dbb", "comment": "Malware payload (GuLoader)", "value": "2238b57707604a6ad39b34702fb9eadd", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356991, "uuid": "de609e33-8759-4b4b-a033-9677f79a7752", "comment": "Malware payload (GuLoader)", "value": "cceadc4ae7cf0bac19ee1991dd9310014244afba3f29922a3ccf346409219a1e", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356991, "uuid": "8b221c16-ef15-483e-a23e-1584a5ca3b8c", "comment": "Malware payload (GuLoader)", "value": "fb1bd8a3f9dd431337c194c334421a19c50536eb", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356991, "uuid": "daf672c3-53fa-4b6c-af45-5f6a23192fe4", "comment": "Malware payload (GuLoader)", "value": "237af256d71fe0b905705787ec11f69d50921eae6c7abbec0fba0f5cb1a24ed9f6a63ccef055a21717424a2e3d34edde", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbe", "colour": "#90A20B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356991, "uuid": "e035c295-7c11-4483-9eb5-19a9b67f65f9", "value": "T15CF24CA1EA59165A4C4B2AF6ED04CD918679812B15220027BEDF07CE523BD5C83FDF2F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356991, "uuid": "b87b364a-6f6e-404c-ace6-ef6a98a75f96", "value": "768:9ZccYg1DWqqBAP9mWS/lCAr73qDL4sDutoGFzkEr1RgMmHf6GUxO+Xy:9Mg16LuQ373iVD6bg6RgEpC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356991, "uuid": "1db70fb4-7002-4331-a839-ceb03fc02d5f", "value": 37278, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356991, "uuid": "532cf724-27d4-4094-bb73-2a5e470af73a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356991, "uuid": "9ebd3a59-0a42-4246-8049-c37a9bc73e4f", "value": "Misteaching.vbe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94ae357e-6203-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347801, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347801, "uuid": "5c301a01-6c55-469a-b82f-eafb2e34035b", "comment": "Malware payload", "value": "dbb5d9d288b40ae07ab5b468b405f9f8", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347801, "uuid": "c9af1315-a29d-4d7e-8e5c-817a9cdc5772", "comment": "Malware payload", "value": "cd902d1edfeb9d9e76f65061b6f13b72271a20028061167e3db939d71aad2b36", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347801, "uuid": "797e9ea3-f16f-4c00-9985-bd51fe4ad8c0", "comment": "Malware payload", "value": "3e851f440f14f4e7c2354fa50d3e1f6d29941732", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347801, "uuid": "94b3ceee-f3de-4286-b241-74d57817d305", "comment": "Malware payload", "value": "2d67aa253e4528a9f94dcc7a4c6234caf348077c131715e897e6be5862fa77056128df550f18f7c8e49cb697b711ef8b", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347801, "uuid": "60e6445c-8412-43e4-b53a-e499befc6fd0", "value": "T19FB42338112D3CDBCE5356F7AEA42B729CDB85E729B4129001B242658C6FB4AF9F444F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347801, "uuid": "160c0059-37eb-4bb1-950f-ae74ad311b54", "value": "12288:JMGiNz/PUAg4Nq474U1ue65dRDwdFBg+3oEpVQaoKk:mNzkyqi4UQ7m3BRo5ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347801, "uuid": "f31e61ce-0822-44d2-8b0e-a297f7401894", "value": 500047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347801, "uuid": "5e68b027-b263-4e7f-a833-b8cecf8e4fb9", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347801, "uuid": "b502506a-8dbd-4590-9bda-7ce08737a461", "value": "Installer_v2.1(2).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "009029bd-6199-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696302026, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302026, "uuid": "f0085f33-3015-451f-bddb-5729015579ec", "comment": "Malware payload (Gozi)", "value": "b5553dcc74a1f928f6619cff575c0568", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302026, "uuid": "361e8a8e-17e6-4746-a234-cc4ca3b2ba78", "comment": "Malware payload (Gozi)", "value": "cdfcfae61a588ac434b33e8836f7796c1512c2926a7439e6a92c32c4ff4fa4ad", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302026, "uuid": "faf0587f-4821-499b-916f-8282f1386553", "comment": "Malware payload (Gozi)", "value": "74d15b6d882d64fc3d21bcc47f9a99685a6705c2", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302026, "uuid": "63ce7c16-e6eb-4e39-adc1-8eb22580cc87", "comment": "Malware payload (Gozi)", "value": "ac2621955441cb609493cdb9db28a4bfec66a0475190d4a894b40696dee0fe670ff0f75e6ea8c29060f4b3f77aee5acf", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302026, "uuid": "792dbd8f-1209-4273-9711-be64ffebffdf", "value": "T119C022184D4EC0A2C00215068098FC88AC0EB00429E2E8981684DA8A9C810E5EE08AFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302026, "uuid": "bb600730-d42d-42e4-afab-5a525b7c4662", "value": "6:HRYFJb/5sZOA5xwovQvyc1yc54vVG/4xHn:HRYFJDpA5xyvhy3VW4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696302026, "uuid": "1113da0a-cdaa-41ee-85b6-49bc8d60ae05", "value": 193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696302026, "uuid": "9dd882f0-6b6e-4f15-9874-a6ceffe85ca0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302026, "uuid": "0a18c013-1fba-4e96-bc03-93f32b2d3ecd", "value": "Agenzia_Entrate.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "423e1d92-6217-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696356253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356253, "uuid": "79238a15-e98b-4486-a11f-c04a30dfacc1", "comment": "Malware payload (GuLoader)", "value": "396c94231d73ab10465a964b916ce852", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356253, "uuid": "039a4558-9866-49f8-aa93-478bd49cb813", "comment": "Malware payload (GuLoader)", "value": "ce60a25dcc7d1a7dbc66cc33351268b6f536128d0fd88926b02ba8cce6830ff4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356253, "uuid": "0b636289-3629-4b30-a312-7c90c7ac688c", "comment": "Malware payload (GuLoader)", "value": "515684489057fdceaf03ed39b7db2be54beed2d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356253, "uuid": "28ee7b88-ca3a-4ad8-b5fe-6e63957db412", "comment": "Malware payload (GuLoader)", "value": "9224b99a4c559df4ae32a5399dfded2f2a02e3c026d91aeb34fa8f0e42d7a73cc16b2da34e5bb062ca53b41678f2d896", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356253, "uuid": "30d13957-cd53-4afd-b527-44ac7ee233b6", "value": "T15BE423685FF9C872E99105B18DF01E76AE78FC00A5847A4F13091F6E7D032CAA9457BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356253, "uuid": "3b9a03f9-a3ac-47f0-ae9a-45059798cc1a", "value": "7eae418c7423834ffc3d79b4300bd6fb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356253, "uuid": "ab7554ce-a393-43b8-ab0e-f8ccd4032367", "value": "12288:0zOKbOoNFV9UZsjxmbtmAQiwrczJHvU5Ji/9Xc5uR4sdhSlkas+QkRc8zlv2HF1P:iOKaoPHUZsjkbtmNiwYzoJ89XBR4Mogx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356253, "uuid": "f94318af-95d5-4dd5-9aac-ad9078d4c341", "value": 719392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356253, "uuid": "a96c0c10-bf27-4136-b651-7ce97b696c62", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356253, "uuid": "6dd7ce3f-88cf-4cc7-855c-88869853c4fb", "value": "Danseorkestres80.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a71da21-6210-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Backdoor.TeamViewer)", "timestamp": 1696353394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353394, "uuid": "a2547e99-0479-4bda-947e-305c3cabf0a8", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ac44b929208f5a446728bd5fddef7390", "object_relation": "md5", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353394, "uuid": "99b5f561-e324-46eb-9345-801298e318af", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "ce6b6c8ea7fb50823f78abeb4eca078365869c5d05b973ff55deb121bb696d05", "object_relation": "sha256", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353394, "uuid": "c386e1c1-b8c3-4d6f-98df-4c0f8fb064a4", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "c9897cbc023634a9078a509a6c35395743311bf1", "object_relation": "sha1", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353394, "uuid": "138361f0-a8b4-42e8-b1d7-465042bf6291", "comment": "Malware payload (Backdoor.TeamViewer)", "value": "a4f9c877e15fde3e1f575d96220c2fc113148cd20386b568d0794bb1dd250f3711f2d35683f90883933e2b0f062c0515", "object_relation": "sha3-384", "Tag": [ { "name": "Backdoor.TeamViewer", "colour": "#CDC4B5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353394, "uuid": "32338eb5-609b-43d8-b66b-56a8959307aa", "value": "T141652303ABE1A572E9F57BB0A0F602C31F323C660934966F33A56A551DB2254EC3176F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353394, "uuid": "2cc8e349-8b50-4880-9907-0376467d69a6", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353394, "uuid": "3758cb52-5b4b-4d4c-b631-29c5dd754fbf", "value": "24576:LyLvSLjPg7yM5kbU88g0dYwV8N9FShRbtb5ctRX+bSyjA5ZyZj0dJUM3sagA:+LvMGf5BGwWvGRbtdctRXkEUoUMtg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696353394, "uuid": "8a49aca0-a444-40b6-b005-83d5185084b9", "value": 1496576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696353394, "uuid": "defb9e60-6d88-4934-8fdb-7bc545b177a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353394, "uuid": "cac72ae4-0d98-4e61-aa44-2f277448ddf3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1efc763-6187-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696294646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294646, "uuid": "8a1b3120-6d53-4b7c-9546-3265f5f3c029", "comment": "Malware payload (Mirai)", "value": "aaa13bf67690461012d02d3962d7e6b5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294646, "uuid": "d8d35020-1d9e-4ed1-be9c-02119c0316ba", "comment": "Malware payload (Mirai)", "value": "ceb7e79fc76745deeb67d27470a303507aac3da0d366cc250b40aaf54fc74cd9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294646, "uuid": "cc014daa-5249-43ed-bd5f-448210d377d4", "comment": "Malware payload (Mirai)", "value": "b69593af877c1c4e1e4c4c8c8efe4c6d01e06fa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294646, "uuid": "54615a76-ac2f-4ba1-83cd-16a3d8dd0bbb", "comment": "Malware payload (Mirai)", "value": "6a3f84b14b08eaf28dc7bcaf29f2997e2a67a8b0756e7e064f67a1e34277c265155323f111750693a153aa3916209939", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294646, "uuid": "2d24d528-6776-4e7b-b98a-623469728a88", "value": "T19AF2E1D88FF5BDC6CCDE14B984AD0F75298A75A636C7AE5C1B10484CBAAD40FB08917C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294646, "uuid": "ace31637-ffee-4d1a-a88e-6f0eb589a042", "value": "768:bh7h9DFUoK8s6luoD3RGBA+xWLYmKKe5eNj0asIQBWj:tDFU58smt19L5teG0tIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696294646, "uuid": "a9b3faa6-adcd-4fc5-aebb-57a2f2319a39", "value": 35428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696294646, "uuid": "c80322ba-f261-4727-b82e-b2cc87186ff6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294646, "uuid": "87ed5395-11e1-4f14-a57e-51a0d28e7c50", "value": "aaa13bf67690461012d02d3962d7e6b5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6a2ebb-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696356969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356969, "uuid": "b9950b89-a686-4b33-990b-a70967772f03", "comment": "Malware payload (Formbook)", "value": "ea95b4d0c8a74d3337cbb59fa1cf4f3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356969, "uuid": "0d68fca7-73e2-4c7b-9326-6baffdcb5b04", "comment": "Malware payload (Formbook)", "value": "cecee88a7617e74a94da62a630b47509785f2d0dd45bae200fba376915eff317", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356969, "uuid": "0ee06c51-0dd6-4052-91dc-912a53ac9f79", "comment": "Malware payload (Formbook)", "value": "5994d3855a1006314db68780b802c964aa7b9f16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356969, "uuid": "01360dd4-f5a1-4ba5-8701-2e9c37a2bc01", "comment": "Malware payload (Formbook)", "value": "308122dbeb6948130e3a2a2cb6aac99c7e96528fb1ce6c91a71fdbef56a7d46876d7397c087a630f97265431763fbabc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356969, "uuid": "d4630ba8-4d8d-4cd6-84d8-0ea276bb9ba4", "value": "T182D4F18437F69515F7FE8B324DF2CA884774A8233711CB1E5C96A7AD4A323864640F6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356969, "uuid": "6be467d3-d3c2-432c-9376-8f7b1023dc0b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356969, "uuid": "1103b955-fe0c-470e-8a0b-214f636611b7", "value": "12288:8MYnQ3j67SESV1eXl8OhA90pVh/3d//VBBNhk37OU/sBMa8yMg9cFHP6Y15+LzNM:8BVVjsb0BMIA4atVRR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356969, "uuid": "93326330-da46-4f19-b264-c005b00dc90d", "value": 611840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356969, "uuid": "c0eaa827-8448-4c72-a4e0-531f5f2ef377", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356969, "uuid": "a8463984-c486-4e16-9dbb-33c3fdcc7fe9", "value": "Halkbank_Ekstre_20231003_081214_543422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5193d228-61bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696316765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316765, "uuid": "ffbb76bd-5ab0-407c-afc2-0daedb112cc9", "comment": "Malware payload (AgentTesla)", "value": "e71e9eec04c8c630e9c61b65ee9e7084", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316765, "uuid": "6d46e02a-48c9-4191-b006-30085b736e16", "comment": "Malware payload (AgentTesla)", "value": "cf5797da06040d6659675168e7b872d0cc149c4080d0163806b5bb730df46a7c", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316765, "uuid": "fc1db82e-c894-45be-b42e-0b5b33dd8680", "comment": "Malware payload (AgentTesla)", "value": "c746f09cd36b3b3198b3bdb752493a9a12ebbd32", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316765, "uuid": "b69811ad-fac6-43b6-9a6e-30ac43e1bddd", "comment": "Malware payload (AgentTesla)", "value": "a734d837c01aa7f114f1c67c9b37b80c9b5591ad296b6d1170a640419fddfbe6e27f1ad5acfe5a01a709c1a26ff1f6b2", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316765, "uuid": "f9d80893-b00e-4129-9936-fae66651a710", "value": "T171F4235C3B34D3DF4B9481DFCFA9B45EDDEA258B5DB0D0126C0DD88682D2F82242A5D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316765, "uuid": "c53cd172-5bd1-4756-ab7f-80d1d73d2725", "value": "12288:dQclbagfDfZQr0nshaS9iDPWkm8wORLXH4J9LYHMOATsbkKT3jVgHx8lGJCaL:FfTug4+cW4Jh4ATsbkKT3xil", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316765, "uuid": "5d891483-ecaa-4f75-abfc-376071f163ba", "value": 746494, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316765, "uuid": "90b7118e-4a39-4414-9e35-0998d3bba152", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316765, "uuid": "da5575b4-42a0-4703-8797-208b63cd482d", "value": "Order.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a5b56b6-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344321, "uuid": "aac3623c-e909-418d-af0c-42ffe3b0843e", "comment": "Malware payload", "value": "9892487876007520ed733491cd6e2bfd", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344321, "uuid": "4ceadce3-4ee4-488e-9a6a-59b42e1c4785", "comment": "Malware payload", "value": "cf63d337116dc1cfabe743767d5278022ea1e5dd56a50127088ffcc86e441ec0", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344321, "uuid": "99d4d8c8-1f87-4eb8-9e72-3d4edf72f720", "comment": "Malware payload", "value": "ae93e718c2b481427c164d66f12f102ae8f627df", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344321, "uuid": "6ec36bf7-5cf5-417e-a7aa-c93f543a5765", "comment": "Malware payload", "value": "43cb1fd6f5197204dc92105ecde538080e138170dd9f2de5f0de54101074c2358b5afe47d725597e136bfc2ea5f8c16c", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344321, "uuid": "9600a479-d308-45c0-93ed-ccf5b6e1eb75", "value": "T1E1B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344321, "uuid": "447e6012-1577-4140-b7c3-dcad10cf25b0", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344321, "uuid": "af0285b3-6344-422f-ade1-11a74498a6aa", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344321, "uuid": "18bb14b8-cedf-408f-8dd5-c8c77e16a878", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344321, "uuid": "0b438c5c-77e0-437f-a370-ef52c74e96e7", "value": "AppleApp(145).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e794bf82-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343645, "uuid": "55a67726-abf1-4683-beb4-84cb1dc3009c", "comment": "Malware payload", "value": "0014da8651ab32e65b4aa4febbeb5cf4", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343645, "uuid": "f7311e02-589d-4c29-86b8-4ceaeac6f9da", "comment": "Malware payload", "value": "cf8757f42a5a3186535a28632b5b8705c6332c83992b9976409fc62b523c70f1", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343645, "uuid": "bd5250f6-f85c-4fa5-8b6f-5b86006ec429", "comment": "Malware payload", "value": "962002fbbc2c9e9b16a87e0ddac795121e9158cc", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343645, "uuid": "5c783d44-0aba-444d-9a34-715ab914472e", "comment": "Malware payload", "value": "925a4b89ee99316ffa0fda7e3a6b3751585717fdce5fd882cd9e7c527a2cf44c6d7bee9920ec944f22ce26b381252104", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343645, "uuid": "ab8952ec-0e5a-4650-ba3d-334a2634bd0e", "value": "T1E4B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343645, "uuid": "68cb52e0-6c5f-4dd1-aaf9-2ba3e568ae3e", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343645, "uuid": "20cc39f5-1f85-43b8-9b2f-7518d2007529", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343645, "uuid": "5eeba0f7-5e1f-4515-937b-d4f2b8c8106c", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343645, "uuid": "c84705f0-8966-48ef-8adc-dc1501546972", "value": "AppleApp(124).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "010fc351-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696357002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357002, "uuid": "f89cde5c-a150-4153-b2b6-1ec3ebfcc05d", "comment": "Malware payload", "value": "ea380b883439c8e615ed569d421209af", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357002, "uuid": "8d64f818-e05e-4d4f-9cd9-336d9d623977", "comment": "Malware payload", "value": "cf998b9f5f929427f0a6a62a978eb93d27eb4cf91fb1d3c9eb67ec849450daa7", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357002, "uuid": "19e80065-f649-4f02-bf1e-e51a9cb524c3", "comment": "Malware payload", "value": "c2af27c1e5d26c5897a9b3b304fe89f7c01336be", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357002, "uuid": "16dbd9af-2e9d-430f-8400-db7dfb125dd9", "comment": "Malware payload", "value": "6ee8abff54476f8d1314ba93bc0d73ce05d1031434e46985dd1af7c2797169459fd1f3449b67adc4fe28da48656441ee", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357002, "uuid": "2dcf017f-15bc-47fb-bd01-c717e5715581", "value": "T1CCE4F0EBFDC4A378C313B3361C665D37996CADEA8CC1D486417B2801D894949A7C9BCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357002, "uuid": "32bf186b-d5fe-46b5-8edd-f825d2b8ba3e", "value": "12288:WPgP5iM3DkohWB+N2+EAKU5mAHWPhFABBXRkIo6gF17iwsNHq:mgcM3DMB+NMelqcIILgTiwsNHq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357002, "uuid": "1f14d6a0-1051-4c85-83b7-208f6011f062", "value": 685647, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357002, "uuid": "a3fe4f52-8b4c-4132-a637-6e972911533a", "value": "application/java-archive", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357002, "uuid": "418d168f-a60c-4618-ac78-7fc748c84a9e", "value": "factura.pdf.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e560b92-61fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696344569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344569, "uuid": "c940c32a-cea9-42b6-9c77-a0a88a48b99a", "comment": "Malware payload (Smoke Loader)", "value": "ae64093ace1cc2fff329aaef67ddb45c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344569, "uuid": "ff6f0c44-4b52-466d-8afd-4fbc0f2e47ab", "comment": "Malware payload (Smoke Loader)", "value": "cffd464c619d2c73f67f2a91dbe1a2d59d27e5e85ea05e45458ceeee428c853b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344569, "uuid": "aaef3017-00a5-4e08-b305-d26db2ccf25c", "comment": "Malware payload (Smoke Loader)", "value": "1e48baadf2beef13aa0da610a8d86a420e8d641d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344569, "uuid": "dd96f85f-8467-4454-8b67-967c216a605d", "comment": "Malware payload (Smoke Loader)", "value": "b0ace54df99d6e6574966fd57fb1f9daea3d5985dc62c682e1cbbf0ab65db2ea3c1ff59c8e8b02a94bba8cebb0403c69", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344569, "uuid": "0ecb792a-ddb5-4dd5-b487-98ff28cc1c87", "value": "T1376523E2E7CA2031FAA527B064F612E31778FDA18C64466D6243FA5A4D717C844723BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344569, "uuid": "87b8b759-5a76-4944-9ab2-0d575e64640b", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344569, "uuid": "daf61b94-8c8d-47a4-92c5-ac57b7e91a6d", "value": "24576:fyOQElU1OcwctQimcZ7nxeEtkTeU4NtUMvcNWBvEK+ZHfOR:qvElU1Ocwc3Q+t4eSZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344569, "uuid": "689d26a9-e69b-457b-b6cd-7b9eca132fba", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344569, "uuid": "5b8c1706-ae0e-414d-a5f3-026955d5e424", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344569, "uuid": "abe528cf-92b5-486f-ab79-f23bd1853b2f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79048a61-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374383, "uuid": "f43eec4f-be18-45ff-89a3-711d83e09d41", "comment": "Malware payload (Mirai)", "value": "665f6fc8b87719d360698c48e5ad1cdb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374383, "uuid": "b800ba45-4480-4467-8b66-a32ab0a27d93", "comment": "Malware payload (Mirai)", "value": "d0b2c39d9f3df6190f50ccfb469673dd7a793a8f23b94160cf7e895448956d66", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374383, "uuid": "76f7f419-d518-44bb-af42-311786cd1e41", "comment": "Malware payload (Mirai)", "value": "ac1a0af5cde030b4fbd1f56fa30abd2312730532", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374383, "uuid": "aecd51dc-aac2-4aac-a29b-6c7d1b31f7ad", "comment": "Malware payload (Mirai)", "value": "8f99980a2f143f6c0cc5d6ea19a4e38dab22ee270bd1a1e82d338904c4b71bb5fb46e52e00d4f2593cfbac7456f4b6b9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374383, "uuid": "c7abca89-7f86-4c1f-8075-19424410ef4b", "value": "T12C433C97B000DE7CF98BE6BA80574A45F63532A065931F2BB667FCA38D321584D1E9C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374383, "uuid": "d3d06ad9-0d05-4ea4-9c8a-d13ce95e3e45", "value": "1536:vPC9JasK/u0VZ2HphgU3bMrnjmIKO978/:vK9UVkK6ortKY4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374383, "uuid": "703236d1-c4fa-4f22-b139-59837c9e2408", "value": 59372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374383, "uuid": "e96482fd-b1b8-4904-94b0-df74e0923eae", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374383, "uuid": "e1722e44-a7d9-43ba-a084-e3d948d8e9aa", "value": "665f6fc8b87719d360698c48e5ad1cdb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6697d5-6217-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696356219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356219, "uuid": "40c7a528-4b9e-4a35-aba1-4abce6d1aade", "comment": "Malware payload", "value": "39a61f0fa2749c7fb48cad560c738555", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356219, "uuid": "ce62da54-3d0f-4672-8a34-72546064310b", "comment": "Malware payload", "value": "d244f5cbe0e5216fd844051da74daea1fda47c288ef2c21c18452de5a40e7524", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356219, "uuid": "dd7ae933-4e31-4b86-837e-24b3de77837b", "comment": "Malware payload", "value": "d8cebf8e6746121430daae941be720db34e39302", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356219, "uuid": "2df4dca8-f099-4a15-bd1f-82bdb1160f47", "comment": "Malware payload", "value": "b725bce954cfcf094cb2ef65b514a342eec844f1beb1c2e51b77c7ddbc873d149f6b5bfae0b21765e1ab286304e1f611", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356219, "uuid": "c20765d9-7941-468c-b0b4-5ab0b4a11b00", "value": "T1A0652393A6DD8E31D8E267B04CFB02831F36BEF145B563577201982B0CB3595A8357AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356219, "uuid": "1e35c84b-954b-4ad5-97f4-b257d1fe05c5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356219, "uuid": "71bdb842-54a0-4718-9712-be6a57859bdc", "value": "24576:LyrodGINdJjM/SjuZiFb9i5XSVwYwsdNkIh1OOixXRQlyc5srKlP7hNs66/cu:+ro79usFbEtSGYwsdNpI7Kly1rKlFXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356219, "uuid": "7dae00a1-ab3b-4bea-af27-4ea7f02c471a", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356219, "uuid": "37ee0f26-897d-4d17-be4b-16cf0c7f03bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356219, "uuid": "3f94034c-6700-40f0-a12c-c5ba2a6cca2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f23ec726-6194-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696300284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300284, "uuid": "3e634d01-1d47-4089-a977-51d0bd5abc11", "comment": "Malware payload (RedLineStealer)", "value": "a7e5dd9ea31f866fdd0b425165f90915", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300284, "uuid": "607b12f6-01b1-4364-955f-684ca13b3d04", "comment": "Malware payload (RedLineStealer)", "value": "d2608d6f7e2001cf70808e3c89bf702484c13f85ae19037a1de33fe957a3233a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300284, "uuid": "afec392f-48c8-44bc-8b67-20bdf18ba5e7", "comment": "Malware payload (RedLineStealer)", "value": "41a823a0840b08795a22dbe1a7e35c47c1995086", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696300284, "uuid": "b04ddb3b-001b-41d7-b974-a3cdbf8e82b6", "comment": "Malware payload (RedLineStealer)", "value": "8429bb1098b67e4ed51fc5a8aaddd56b98630c464da1b3135ed3bd0a03370013950401565fe99215136d06e824ecc196", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300284, "uuid": "692f4151-9b42-4d7c-a97c-7541d8fe8498", "value": "T1AA058C0574C0803EC67269B10B75F2B187AEB2729B1566CB37D835292F74AC27F25DCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300284, "uuid": "be0a2a4a-6339-40f4-9b92-b6f819737dde", "value": "034f0d020ac1c43c0a84ba23dcd4c85a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300284, "uuid": "d2bd7564-1b2b-4790-b57d-df28c67ae2aa", "value": "24576:DpRaJkjIFluoFg9BA0/ho7svms7IcRvJ3:lnIFluoFgZho7XsDRvJ3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696300284, "uuid": "00f32a4d-7d1b-496f-a563-53e8f0efdbf8", "value": 836576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696300284, "uuid": "1413a182-b8ae-4374-9edd-ad0ead8e9f42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696300284, "uuid": "2218f2ef-7262-4cd4-b566-6507c80c8608", "value": "a7e5dd9ea31f866fdd0b425165f90915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da759b02-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696356937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356937, "uuid": "7225a774-9453-43fe-81e5-d589ea7e21b1", "comment": "Malware payload (AgentTesla)", "value": "1449bd5e337dd6a1b1e625221122994a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356937, "uuid": "bb5c6bd1-c794-4316-82e2-4601f86dc085", "comment": "Malware payload (AgentTesla)", "value": "d280867c2b2aa11cc6b512aba4f1fc98542ee81b089d3cbabd1623db840c4bbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356937, "uuid": "49b21eb0-b36f-4e4d-9bbe-f6e304ef1e9c", "comment": "Malware payload (AgentTesla)", "value": "6f304bf76537615c0c0db31722d9825808156780", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356937, "uuid": "ac521c98-3f69-4bc6-80b7-ec9d64fed28a", "comment": "Malware payload (AgentTesla)", "value": "02b7a0b21b1d1fedb778ac45be88b7282441dc6b2276c86cd0a3964a78dcc70c4bc156c1c478c4c95f1db9d8e09b651d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356937, "uuid": "55010d59-e2e5-4b3f-979b-0f594de40f45", "value": "T12055E00B9410AF86C00943F86E2339D91E1E7F19E7C569EF14537B8B3E317A219DA29D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356937, "uuid": "200b65ac-565d-4680-98e0-aa8ef09ec2c9", "value": "24576:5WQmmav30xACoZyNw6VsAXZSPLdwZyCw6VoAXZSNNBbp0ITIZGDjHaPnw+x:IQmmQ30A56VrEoe6V3EBpbTPHafV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356937, "uuid": "0946fecb-ac68-4509-bce6-191898779b36", "value": 1375744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356937, "uuid": "d3144d1d-ec59-4e9f-be54-e9f7e6f308e3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356937, "uuid": "1eecd247-f397-48a9-ad2b-f5d01a9abaea", "value": "221036299-043825-sanlccjava0004-6531.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e64eccf-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344381, "uuid": "ed242a95-e986-43bf-9a2b-aeb714f739f9", "comment": "Malware payload", "value": "e53f656b17ebb1458bca1401e5e53dea", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344381, "uuid": "639b80f7-a69a-4dc8-b4eb-820c6fc13a20", "comment": "Malware payload", "value": "d285e23f1e4c490aa4c851dad0d153c10490635c1354315f888672cf28f92313", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344381, "uuid": "4876bcc4-baab-4d0b-b494-254bd1103efb", "comment": "Malware payload", "value": "44e9eae4bb3d5a495a3387d3c77c1bacb200ddca", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344381, "uuid": "9cbffe38-9cbd-49f6-bcd9-37f37011e348", "comment": "Malware payload", "value": "ac527920fb26094bcbe52d2da99f07859821b4db5ecedf0a684e0585ed3b97386d5ce13d90d4a52eeabc8e1798ffacb2", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344381, "uuid": "ed043759-a647-4a0b-8ff2-57ef16197c60", "value": "T1ECB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344381, "uuid": "6e618d47-3fe3-40a4-82a3-7058ed285429", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344381, "uuid": "23396b05-bfb8-4fdf-abc4-72adc289aba3", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344381, "uuid": "84e74b27-7346-4bcd-8d7b-9a445b51ac29", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344381, "uuid": "94539d91-b974-45c1-af28-a92c74329bf6", "value": "AppleApp(130).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e234c30-61f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696341321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341321, "uuid": "0774a1cd-5605-441a-95e1-7109567122de", "comment": "Malware payload", "value": "b15be26d541ad329a564321e635e0fb8", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341321, "uuid": "c5686965-2f7a-4221-80b3-6c36f9668d3d", "comment": "Malware payload", "value": "d2fd350b82d8bd0d2b6ac9529a5816bfbe5df3e119449b799765ab8d1022557f", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341321, "uuid": "1327d653-ae67-44a3-8866-e0ba504d75ea", "comment": "Malware payload", "value": "4b88b8ac548fc7d639285b4e47804e73995c65a7", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341321, "uuid": "e510252b-ac37-46a0-a058-858c11b902a2", "comment": "Malware payload", "value": "576b21c15fc4dec02d580707bf7743d381f56f8f364f840a02ca46f3f24b80cf2bae6bc2aafb655a8177f76805093fbe", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341321, "uuid": "f0010ac8-6597-4379-8687-42700294ca91", "value": "T122B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341321, "uuid": "3f4bd832-a796-414f-b814-a411a3db64dd", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341321, "uuid": "0b4dd669-14a1-477d-8632-119807ad64e8", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341321, "uuid": "7ae87996-2df2-405e-9cbf-7b3a54c857fa", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341321, "uuid": "b5690868-090b-4104-9564-276e7ec4efaa", "value": "AppleApp(74).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32c06d5d-61e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334322, "uuid": "3abd1302-3caa-4b1f-9ad7-f147ccdb4813", "comment": "Malware payload (Mirai)", "value": "1beb7be842f4640f8e825ef57db024ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334322, "uuid": "75b1fe26-287f-4d4c-8e96-bd8ff98b3b8d", "comment": "Malware payload (Mirai)", "value": "d306cffeeb73e234ac1359cec4730e4b67d5744fc8ab426fe5fd66f854b33ba3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334322, "uuid": "cd5e612a-287b-4fc4-ba72-1f544e988ef9", "comment": "Malware payload (Mirai)", "value": "057c2335b1644154c28df7b626739f118dd89e32", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334322, "uuid": "e01961c8-875c-4c02-811f-ed81861e4b45", "comment": "Malware payload (Mirai)", "value": "db71c37f72140f7a9d7b6efc56a718a4deb25218bdf36b7b5604026b3771b829585d0ad2a8a098f4522de41bc0c1529e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334322, "uuid": "7492b209-98ca-4ef5-9ece-e660a789f4dc", "value": "T16AD2E11CC54D7E05CA9D3DB951CE56B9294CB0C1A35DA6CE17238454F627A9BFC070A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334322, "uuid": "dbb29c20-54ca-4906-8fc7-2cb717cec484", "value": "768:11uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNBRJbiWU9:1bDs06t4BEub4sU/MbUBRm9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334322, "uuid": "c6ce0b4e-d7fb-4eda-a13b-06ab8ce27b79", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334322, "uuid": "795c93a3-e8e1-46f9-8eed-908eee14dfd7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334322, "uuid": "c1a93eac-9f2b-453e-ba56-0307a3f4b217", "value": "1beb7be842f4640f8e825ef57db024ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3622e26e-61bc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696317148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317148, "uuid": "f01aabbb-4b93-4f3b-b2e6-9ea461aca0e2", "comment": "Malware payload (RedLineStealer)", "value": "33ffe47617ab65e5fbb0b2eedf0b5b4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317148, "uuid": "e80e4188-f73a-4576-bb24-d01d5b409bc0", "comment": "Malware payload (RedLineStealer)", "value": "d316934fbbc328ee5764cc3ffad8342ebb530df25f43e3f46e0e27fcc8f7067f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317148, "uuid": "4bccbdc7-c3c4-4689-8a1c-a70e83e766f1", "comment": "Malware payload (RedLineStealer)", "value": "394351007b7fa83b84a30c66b84083ba9af66410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696317148, "uuid": "df222f48-0491-46f4-acc4-469b356e1696", "comment": "Malware payload (RedLineStealer)", "value": "f6add2e14dbadfb13624ac2fdbd1d0d791cc4212bc8afefad1357798699a8aabd7017881434488f549745a1f499892d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317148, "uuid": "9feaee6d-fc89-4a2a-97fc-13a21cb02a2f", "value": "T18F0512257491C0B2D8BB513144EACA395F7978714BA0C5EBB39C677A6F203E1A3392CD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317148, "uuid": "dac59f42-f804-4e19-bc04-a6adcbd3fbbb", "value": "bf5a4aa99e5b160f8521cadd6bfe73b8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317148, "uuid": "66ef1358-9e97-41f9-899c-9c86915a3245", "value": "24576:mk70TrcKMs8ftsubdunEtMif2Fo0VANdUKsm1:mkQTAZsubdunDif2F9Agw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696317148, "uuid": "74cd46d0-c677-4420-83b8-11588bbcc795", "value": 855104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696317148, "uuid": "bb2a2a83-c56d-454f-a060-1fd2ace446f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696317148, "uuid": "9b50c046-bda7-45c6-bdc7-feceb05cfcd9", "value": "#PO_Teklif Talebi - 1523 Dmreklam ltd sti 0%01% pd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0625fa1b-61de-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696331670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331670, "uuid": "a97d1cfb-e259-4279-9e66-76afc8d6d6b7", "comment": "Malware payload", "value": "ba190f3a5fc5829a4e2d27d881ff1c50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331670, "uuid": "db40ca1c-c412-43a7-a7bd-92fc9cf73698", "comment": "Malware payload", "value": "d46128d36ee427ca70046af345535199fb2d63bf8caa60a0712fc2c11e5446a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331670, "uuid": "c0af27c7-1c16-42ac-af84-2f6f3211fd2c", "comment": "Malware payload", "value": "dce8cda567cff94077cf39f59439d0583d7edc06", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331670, "uuid": "6efd452a-356c-47df-a4a1-25e49752cf4f", "comment": "Malware payload", "value": "587ce891325a120a3993b73c6be65932d00dc553c24302d265deb05a71a12b713f6bd665ff57a13ee497f68d9acc2cdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331670, "uuid": "d768f4e8-e76e-4620-b399-eab71eb8b6ca", "value": "T15782E167820D8A01E17B663B95CE41CFFBC74D9522DF8AC740CACD1AD1D03218113BAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331670, "uuid": "ac5044e5-a65f-4af9-8481-f0d162dae5e7", "value": "384:7x2/TG4aj3oKHegvnh9OwvGhNeihvyeZqfpSKQAF4Qa4du5l:7xcRUdeAnOwvGhBhqjfpSdAuv4M5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331670, "uuid": "12252a54-e6d8-4629-9996-21bb57dc9971", "value": 18512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331670, "uuid": "76b41400-33dc-4b45-93ac-d818df39a725", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331670, "uuid": "97168608-4aea-47dd-9275-34da338d9784", "value": "ba190f3a5fc5829a4e2d27d881ff1c50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfb3b9a0-61eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696337565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337565, "uuid": "c4db9c4a-118a-4ba3-a8be-8da1aee6dbbd", "comment": "Malware payload (Gozi)", "value": "b54e56a2503ac379bcd8e61852d5e861", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337565, "uuid": "019edc97-6a04-4349-8afd-552a3154db0d", "comment": "Malware payload (Gozi)", "value": "d5c77653349176a796c3846dfc596292563d0588564eabf542c978b61597278a", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337565, "uuid": "128b4d33-94a4-4232-9e45-388d9b641418", "comment": "Malware payload (Gozi)", "value": "abcfaff56afa6239ac8efaf8e36ef22b6cc9e8d9", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337565, "uuid": "d89f8bd4-61c2-4cc3-bc3b-ce357dfd22bd", "comment": "Malware payload (Gozi)", "value": "07f5797379c4ceb29fbd79b80f35a5fb0c04d2bce9c60317d271beb48c4db154f46faa73bfc314167594d2135123a84e", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337565, "uuid": "ddaf7812-d26f-48f9-94cc-6c32a7997e5a", "value": "T17F549E0267E0AC71D4625A319D29C6E53B2FFCA19E6857DB33583F3F58701E19A62B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337565, "uuid": "33b7e605-960c-49cc-87ee-73c1e44e0bf8", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337565, "uuid": "572cf853-956e-432c-a01e-7e7e5e34d17f", "value": "3072:w6JyBmvmBEayo1tFHtWl0VnkDS7cW6VnYR4UhsyT+dNIY:xJyIv4EayofFNVtMns4y7T+r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696337565, "uuid": "7be3318a-b2af-4a27-9466-8b78c31b3b78", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696337565, "uuid": "73db548b-bcfe-41d4-bf29-970594c55d1e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337565, "uuid": "f908d8c1-2278-49af-b1e9-3d6058a89945", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ffa4129-623c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696372274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372274, "uuid": "a29fd7ea-4e2b-47b4-8ff0-448aaf3e76da", "comment": "Malware payload (IRATA)", "value": "8b867fa9566e870426d42369446702b5", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372274, "uuid": "1ae8393a-6927-43b0-841c-a23908dbc527", "comment": "Malware payload (IRATA)", "value": "d5d6df0eb2697e457b29c9ca8c4026a8adcaa83f502fbcb33757a6e49829e6b9", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372274, "uuid": "3748e7e7-8668-489b-8209-7f33c7c521ef", "comment": "Malware payload (IRATA)", "value": "b0497ee5de22023f3329321f3328b2893e2e903b", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696372274, "uuid": "9d57f3c9-a44e-4e2d-b601-da7c9cb225a8", "comment": "Malware payload (IRATA)", "value": "389177b96ffa76adbe4dc971c66c5a015e7395ddb745aed3db473bc9a30c778e64f29b61555b17953fb3efc44414c165", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696372274, "uuid": "367c76a2-1da0-4767-897e-dd28c9c63987", "value": "T126F5BEDBF7E8592FC87750B289AE52B562574C028E87AF436C44371C287B6D81F49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696372274, "uuid": "3264580a-a50d-47db-b793-8fb54137df9a", "value": "49152:zze+fKk10sDKQcdzsh5Kx4ZNjU9MH3rzbsdun9p+ugLCrgpWtLtMHj:zzTvDKQXh5hNU903nbeuxgLCrgpgtMHj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696372274, "uuid": "b679c655-6b2e-4b52-a24b-0f5812b5a32f", "value": 3365425, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696372274, "uuid": "9d11a510-fbf1-4896-a8e4-10f0aec4a040", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696372274, "uuid": "080a8662-5fb4-4738-ae75-e6eb82a31488", "value": "app-release.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23b8ccf4-61f3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696340739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340739, "uuid": "1d2775de-ef1e-4e6c-87ea-7d6ac5e4d1fe", "comment": "Malware payload (AgentTesla)", "value": "9e5f0a7ad4c7061edd9e8d998f597bc7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340739, "uuid": "f849bd12-32e2-4ffe-a83a-d456375230d1", "comment": "Malware payload (AgentTesla)", "value": "d5e566c32400a7a5e90603f057f875b6f09f3a59a1d7e16feba426038ddf5696", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340739, "uuid": "092e1194-a98d-4c2f-9b17-e7e135a11028", "comment": "Malware payload (AgentTesla)", "value": "66414192923efbdab703d161b93a1e3b1f838c4f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696340739, "uuid": "2500e0a0-ead2-4277-92a7-087b85efa231", "comment": "Malware payload (AgentTesla)", "value": "58841c794c96fda27581a920631a5cd804140bbe158a45f966f2836814796bab6698798abe330fd5d82a33b299e050ff", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340739, "uuid": "63f48f4c-ab4b-4a47-a42d-05b6a3cf7b39", "value": "T13AC4F161E2F1A94CE1EF88359E11A3F5E3722E662623E311DC91F50A757C0EB8AC45D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340739, "uuid": "62789827-6e10-491e-bff5-4fb89bf2e012", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340739, "uuid": "53b64473-8237-4bce-b7c2-0d8c8ed17c19", "value": "12288:oEY4S+RVqOgyaDt9XF9awbREK/u8syvA8rxU5fnN1fyQl9j:81y8z19TyK/udx5V1l9j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696340739, "uuid": "0da86710-2241-47b7-8707-7eccb39ae125", "value": 588184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696340739, "uuid": "db102505-d616-4997-a22a-f41d0c39c511", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696340739, "uuid": "365883e0-2a14-4e34-bc73-11e5e3f88851", "value": "9e5f0a7ad4c7061edd9e8d998f597bc7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77b0165e-61d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696327995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327995, "uuid": "3ecb3022-b7f8-4de4-a6e3-cf1605ce20d0", "comment": "Malware payload", "value": "5695b3db2fe50050277cd74e3eb89a9d", "object_relation": "md5", "Tag": [ { "name": "2277756885", "colour": "#908E74", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-voluptatem5702391", "colour": "#455E54", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327995, "uuid": "34f2ebf9-b26d-4da4-ae63-4aa0d430a16b", "comment": "Malware payload", "value": "d60eee597b3ae4b4865c2ac51986f9045704ef1e41a895b67b071b2016e93db1", "object_relation": "sha256", "Tag": [ { "name": "2277756885", "colour": "#908E74", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-voluptatem5702391", "colour": "#455E54", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327995, "uuid": "337ad344-562d-434b-9925-d4166266ffec", "comment": "Malware payload", "value": "3dc8400537a7463709d9cdbf2e19db571dd3429e", "object_relation": "sha1", "Tag": [ { "name": "2277756885", "colour": "#908E74", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-voluptatem5702391", "colour": "#455E54", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327995, "uuid": "2125d79a-e36a-437b-947a-fb42aa54157d", "comment": "Malware payload", "value": "7d8f96d0c083692333ee0a2830fda2b6a42e983f06ee12ecdfacbd2585e480227a3b0b50e945f6a816fd3198afe4e25e", "object_relation": "sha3-384", "Tag": [ { "name": "2277756885", "colour": "#908E74", "exportable": true, "hide_tag": false }, { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "pw-voluptatem5702391", "colour": "#455E54", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327995, "uuid": "0abbf809-34ae-4912-80ad-214725e8b6e6", "value": "T1CCD3123C8A76DDB79EA76B14EC48F397C93F592410852981D0C1B50DB2464A64FEAF0B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327995, "uuid": "69034eac-3a76-4e05-873b-1fa7db3098a2", "value": "3072:cP421pTQkLEDXJoAsiiU62qUYxFa59Cjbf0hu3Or/QURU:OxbWX1Jiv2q3xE5QjbfAu3gYUG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696327995, "uuid": "3a62241c-4559-491c-ba06-5bf9e4a8dd05", "value": 134938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696327995, "uuid": "428de96e-992c-4b4d-96a4-8fd342f7d6e8", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327995, "uuid": "3cd86fdd-fd35-4f61-8457-d029f18f3173", "value": "716.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a3b9092-61de-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696331892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331892, "uuid": "897fd8b4-f14e-417f-92b5-a71c75330ae0", "comment": "Malware payload (Mirai)", "value": "a1127af6b3c4610e0624a54489c25065", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331892, "uuid": "34b01176-a206-40b8-8c08-66f77700ba48", "comment": "Malware payload (Mirai)", "value": "d6b5f78fa5a0d0824db7967a6a4958d06b58b0cc0044e90aaeda9b9ab10f9de4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331892, "uuid": "0bf68f90-2081-47c4-a581-e91b53a1b5f4", "comment": "Malware payload (Mirai)", "value": "6168d5343966372734a9047236dd3e1aadb399de", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331892, "uuid": "9fdbd1f4-c660-4fba-a456-ec8dfe067b60", "comment": "Malware payload (Mirai)", "value": "78bbccde0fa9f7cf57d22a23a96a0f82693740cde276895ad7edecf80fbe268b8e0e8efed07654d93d142249c798f0e7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331892, "uuid": "775c1bb7-41c9-4c64-9831-3c864908a1f8", "value": "T148D2E18EA0522215F3EE8131ECDBF3091049F05A7078C6ED3AD4A4378964BDC7698975", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331892, "uuid": "b23fc7eb-155e-4770-be0e-b98ccf7a5f83", "value": "768:YEHjqfP4j1FLt2M4SaHdsQYk4g8nbcuyD7UHQRj0:BHu4l2M6HddYlnouy8Hyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331892, "uuid": "d22b12cc-6be6-4ee2-9ac2-de0f1f60b424", "value": 30416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331892, "uuid": "3f60de56-a07d-4919-9c22-e958f38ad91c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331892, "uuid": "34835eb8-3eb1-4d46-ae54-f6a787f3c3e1", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "216405a4-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696345889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345889, "uuid": "fc98b721-5ea1-4110-b9a8-b144a4099489", "comment": "Malware payload (Mirai)", "value": "2010879ee8e1f1c19b5df0047261c493", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345889, "uuid": "a23c4d1d-6e3a-45ff-9a79-4e939dca0a5c", "comment": "Malware payload (Mirai)", "value": "d764100273759f280487f5fa705bbd72d916032f3a9f99240bed70dc39874fce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345889, "uuid": "101f4546-0557-4b27-8b5e-4051831f49ca", "comment": "Malware payload (Mirai)", "value": "62ebc4243d274a9a71a14a1c38d5a1bf47dcba7d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345889, "uuid": "4e9db3ac-be6b-4660-98a8-ca98848d0626", "comment": "Malware payload (Mirai)", "value": "58b3f9d1c00c49f7734b8f6d0864098c96921184589adb99477fe61f3114c7cc4efcc8c868b2b7d88b27e49433bbec63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345889, "uuid": "32f5a2c2-f165-44df-b83d-b0aae23e642c", "value": "T186D2E02CDA9D6D05CAAD3EBE50CE96B5298CB0C0635DF6CE17234448B61BB87FC071A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345889, "uuid": "f13cb465-a63e-4653-9949-e62af8531063", "value": "768:k1uUtLrVDsAp6tLkF4FuetwEub4sU/M9g36KNLJrwOJbUWUJ:kbDs06t4BEub4sU/MbU6OYJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696345889, "uuid": "39835143-f6a4-4aed-a4ff-c34974762ccc", "value": 30324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696345889, "uuid": "61b9d8f3-d853-4660-9a88-e2f59ba1c0d2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345889, "uuid": "bfcb5bfb-b20a-4be0-b3b0-31ed2946e696", "value": "2010879ee8e1f1c19b5df0047261c493", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0444f498-61d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696329520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329520, "uuid": "336eab4f-1721-40e7-9e19-4440d2973775", "comment": "Malware payload (Mirai)", "value": "6468c24f5cd10ee34ba09e952e4f3e17", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329520, "uuid": "7cedf530-c0e7-4c70-bad9-a9112236f05f", "comment": "Malware payload (Mirai)", "value": "d77c3e11f53b1237efb4d7363ce329a225ff3d32db644cf031a3ca42652fbdd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329520, "uuid": "15881d1b-265c-4f2d-9d35-0bfba1012f01", "comment": "Malware payload (Mirai)", "value": "5db934144e2dd7aee9b970fc9894a519700a28aa", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329520, "uuid": "edb34ba2-2286-4b0c-92ab-e740b178f9f4", "comment": "Malware payload (Mirai)", "value": "d2f082aa393482712de7b777553bb81e00abca0a26f729c6651539206ccc911d016d5774205c5731bade00175763fd47", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329520, "uuid": "826cb5b8-8793-4977-a696-30198b24d7c3", "value": "T183D2E1AC5A01A0EDF8F999BC9B94037259745311E803DC1FB84E7B934E831E27249EE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329520, "uuid": "75035911-85b4-4cb8-ba99-f063ad84534e", "value": "768:d5hjXdBnIay2+KECRnXQUvuYSISTJi5/Hzi5JgGlzDpbuR1JP:d5Ffn3y2+KtnAHK5/HzirVJu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696329520, "uuid": "c152dec6-0f9f-40f0-bc53-78b1974df73a", "value": 29520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696329520, "uuid": "fd9bce68-2bc3-41dd-93b0-849087744f03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329520, "uuid": "938c8519-e03a-451c-9e2c-0688cba23e96", "value": "SecuriteInfo.com.Linux.Siggen.9999.7321.9779", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae7ed137-620d-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696352139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352139, "uuid": "98671531-acb6-48c3-93c1-1213536ddb35", "comment": "Malware payload", "value": "6bd24b6e91c48d2eab5e4f081e2adb07", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352139, "uuid": "d78adcbe-9a14-4ce8-91fd-da09839caf4c", "comment": "Malware payload", "value": "d7e5c07ff361b7d497c4a0d543b1a319a6da2508ac2b1e1cfcb97f7b26cf7489", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352139, "uuid": "a44db71f-591a-49ef-acf2-5fc1248b07b3", "comment": "Malware payload", "value": "b08a27496b2cebdf16c8d100e7f37fca2d00cb59", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696352139, "uuid": "b4213861-0603-4a4f-87a9-2582f2a24da4", "comment": "Malware payload", "value": "665cfa3aae42ebb6e37a584266b48dbcd0a1c9ad9a7c6035e73e7561c3dd7de571f0de34500400ebd79ab4cf9e55cef7", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696352139, "uuid": "afeef9e0-e793-4457-b78c-3f85dbd2aa03", "value": "T1A7D42364D73269549D11A30E623C9CF7C63F876E93680846EF152E863A7CF44AD782F2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696352139, "uuid": "6ab6ba63-a474-4c33-84bc-69aebc8c7082", "value": "12288:ua/82ARTki8zTCJpY3EYrQPKnUpEQ1wT3RZ9iy/Un8HamuL+:p0VRTkRzTJrnU5qZDcnJm3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696352139, "uuid": "e338d726-389b-4902-b527-dbf1dfa690b1", "value": 621240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696352139, "uuid": "550903d1-8b69-4a9b-90e5-4931e6d69fbf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696352139, "uuid": "e82b4af7-f5e8-428e-8081-2ef453619bff", "value": "Revised CI.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974af737-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346087, "uuid": "2c093120-882c-4cba-b66f-73a19250677c", "comment": "Malware payload", "value": "1d3e979318be4e4f81f41c77e36f50d3", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346087, "uuid": "7e32930d-3ffc-4fff-a9e5-aacdfb3481d4", "comment": "Malware payload", "value": "d88c8cc149bb529ada87ea787d21d0ac13d2e84722a166be8865990c3953c1bc", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346087, "uuid": "f8feaeae-960e-41f3-bbb2-948eedc62e74", "comment": "Malware payload", "value": "c74c05a9a9f9a83b294f68d0409da9826dfaeffb", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346087, "uuid": "7632135d-ec27-40ba-95cc-6e8ccf4408a4", "comment": "Malware payload", "value": "832fcd4a88444b9ff543b8243236210d1e16ca30f228c481ef58b73b0425953cc08f891c4f5aeaa9e6c198b3c47dc56d", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346087, "uuid": "cf2c4b3b-38e3-4095-b534-234fe5420acc", "value": "T1E8B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346087, "uuid": "3b9ea26e-bd30-40e0-9abe-b34bead25a38", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346087, "uuid": "05f23635-7507-4d25-bb30-5e3867d62f15", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346087, "uuid": "335f9a8f-673b-4dbb-a4b3-e4e149a01691", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346087, "uuid": "41789f55-6a55-4198-a479-8b4fbee7026b", "value": "AppleApp(192).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47e2d6f9-619e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696304293, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304293, "uuid": "a647ad83-4a64-4ef6-adeb-0bf5044fb53a", "comment": "Malware payload", "value": "5d1cb21e54f5484636fb644ae2d59f9e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304293, "uuid": "fc1c6028-bd31-4ae8-a553-fd1e6da1bfe7", "comment": "Malware payload", "value": "d8acc97b759f1add2776024cf52c011edd1ef214dcaadef001f8c0ab9050e141", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304293, "uuid": "1aa48da8-262c-4e03-9e6c-7f0b4e48aa77", "comment": "Malware payload", "value": "7ddb601d612b32bf8d6575dd611078102615fdae", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696304293, "uuid": "0ed87574-92e7-415a-82df-6006cff36974", "comment": "Malware payload", "value": "97534d672265b460da5f80859a92e3dff720874f12e345867addeff6fb7ef2c71e3f362ec6a357855facb3e1d4346dcb", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696304293, "uuid": "1430c498-a0dc-4dfe-8152-dc2c39bda3dc", "value": "T153E07D70861B3A10D40B8ABE107E11F9D7F46A5664A111CF5441C5211C9B2952E5E319", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696304293, "uuid": "82fa45d2-30d7-44f4-94ef-f68059fa5e39", "value": "6:5j/JltImGiT5udTjufa5nl0r20LU75JBZ0MJS2Jlts9M2gllFu+ly:5j/JpGiTUyfa5n1JJBZ0MrJWzay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696304293, "uuid": "9df1a573-3cf9-4035-9b7a-6c32abde68a7", "value": 336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696304293, "uuid": "634e8265-e873-4c67-92dc-57a591520830", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696304293, "uuid": "50ad85d1-ec3a-4bd8-955d-4d6a16b27a31", "value": "Funzioni369.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27a7d5ae-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696313688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313688, "uuid": "a7352fe6-07d9-444d-87e4-3c63dde5e931", "comment": "Malware payload (AgentTesla)", "value": "999034e51b1d44cf1a1f8e2503311822", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313688, "uuid": "45a0f45b-e00f-4cd0-9847-eca7c3df203a", "comment": "Malware payload (AgentTesla)", "value": "d91ffe38f69e9fdf3979a0bfdf442b94221108f281afb275591e6ba96d000237", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313688, "uuid": "991bc8e7-c411-455d-8c9f-8710eb1fdd84", "comment": "Malware payload (AgentTesla)", "value": "4d94e6a47f9c0bb8a4542bd9cdbc2b56412b3518", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313688, "uuid": "18df923f-883a-4bee-9d5b-876393c78a03", "comment": "Malware payload (AgentTesla)", "value": "9bdddf97b7da50fa639c3474591432f3b2f6838c435eb7a867936a0cda46b197307cd4f14340ee23fc6cc5d6d3119110", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313688, "uuid": "72354077-2e0a-4f95-b08b-580c7f654fd9", "value": "T1B305ADAC355079DFC81BCD768A981C64AA102CBB570BE217901735EDAA3DB97CF142E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313688, "uuid": "fc939e93-3d5b-4624-9038-7df353e2e1ad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313688, "uuid": "ab1dc933-89dd-4c37-b335-143060cfb1c8", "value": "24576:QIAYIhyhJvjmvDKMpn+RZq03l+ewC1PueLPJ:QcbmrKMaVrueDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313688, "uuid": "6d6b1d72-e3c5-47a5-8b8b-f9a09a93f357", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313688, "uuid": "1af4e791-ea87-4744-a634-0cd51f0c3ac6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313688, "uuid": "6e1a0c8b-62a9-4e92-b143-e1d4ec55a3aa", "value": "Halkbank_Ekstre_20191102_073809_405251-PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52b8dc6c-6211-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stop)", "timestamp": 1696353703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353703, "uuid": "2008d8d5-da68-41ea-85c7-ebdf1ca22b2c", "comment": "Malware payload (Stop)", "value": "9a1a72ddc2c7a5e59c8fabb798266660", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353703, "uuid": "9c210fab-d1bb-4a25-b773-9812ebb70bf1", "comment": "Malware payload (Stop)", "value": "d97ae44665ac32428a6f1d8b20225e1f6212d8115718d84d0bf1a4b57d5be7f3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353703, "uuid": "3908542f-5b92-43fb-9555-0c0bb7222531", "comment": "Malware payload (Stop)", "value": "48c1fdf3a18aa5938dd147bf701518424a26c8f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696353703, "uuid": "02411b95-75f9-4719-a1d0-c3089daee7ee", "comment": "Malware payload (Stop)", "value": "eb3b083264682b9aca7109776da739643f09cd8b7f14bbfaa4b8954e930b26f4b043901709e0cef6d419f4691edd4a23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stop", "colour": "#A68AE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353703, "uuid": "69fa3faa-bc27-45fa-b5ae-2142ad2cfecb", "value": "T1C005021237A0B835D5665A324E3AC6A53B1FFD51DF6967DB73086F2F05702E08A62703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353703, "uuid": "029dd399-9399-4edf-9a7a-dc129d8fbe59", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353703, "uuid": "0ebe78a9-e7f2-4601-aade-2e7c49971d4e", "value": "12288:/7Iyjosks106agjxJ+NWK9LJyatLKmDf8L06iOnBH5CP1KNto2Z+l:cPskK/N8NW4JbKvLTDBH5+UXZ+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696353703, "uuid": "adc77be3-5ec3-4051-bf79-4e84ff3de3e8", "value": 822784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696353703, "uuid": "68d38009-6020-4579-aba0-865179bde79c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696353703, "uuid": "967085fd-6b77-4ee1-ad53-5a1c370bfddb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b57116c-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374387, "uuid": "d59d5120-b310-4e87-966f-ce8444324982", "comment": "Malware payload (Mirai)", "value": "ecf020dca519d89078fb5532f575b9e7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374387, "uuid": "64b4be68-bd42-44cc-a3b3-0da62d5b71c7", "comment": "Malware payload (Mirai)", "value": "da2091ce1cb3c3e39ee08d8dada5fbfd99adb7533a7224f39a9c55a30e1cc4bd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374387, "uuid": "8dce6228-8e64-45a9-8cc0-6fd6d7dd18ef", "comment": "Malware payload (Mirai)", "value": "f97e2d67c1fca822f91791f4151397a5b0f6a48b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374387, "uuid": "bb3693fc-35df-4498-9143-2f5f282240d5", "comment": "Malware payload (Mirai)", "value": "dd19a314ce7f8ac9186812826e8312b030fbd111a5d130d8d94e94364b0fb6332e834fe89e12d69f8e8604922b9ebe09", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374387, "uuid": "3d897e47-3ad9-441b-ad5c-21675aa922b6", "value": "T1ECD34B46FA818F13C0D5177ABAEF41453323AB64E3DB730699189FB83F8669E0E63505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374387, "uuid": "4e25c701-4e6f-41c6-86fd-a8897fc6b0ad", "value": "3072:SeaNakENn18EF2RfSQdGi2xNRixvMY7CdYM/9YVD:3aNaVNnlchNdGi2xNgxx7CiM/9iD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374387, "uuid": "339de8f4-7b95-4246-beba-017e41241b58", "value": 130706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374387, "uuid": "82923ae9-c4e4-4463-8bc0-00b84b4873cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374387, "uuid": "e7e7fc58-7803-4bb8-ac90-917a0aa00bd3", "value": "ecf020dca519d89078fb5532f575b9e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2322d048-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696313680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313680, "uuid": "3c52a081-1c43-4b66-9973-871da4cac5f2", "comment": "Malware payload (AgentTesla)", "value": "bfc21585d9c68ae4992a1f6f75b64e84", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313680, "uuid": "1dcf9a1b-7625-400d-afd5-4b9295a9585c", "comment": "Malware payload (AgentTesla)", "value": "da316c99baf4e8e8e2df0d6d52a77774edb23a7375393a7b0b9414e8cb7b04a7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313680, "uuid": "cd6bd27c-0cd0-478a-a9a6-234908b71869", "comment": "Malware payload (AgentTesla)", "value": "bb1c65c007eaa34eb7d27606197f27876feec294", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313680, "uuid": "6f35ec06-b676-4032-ae7d-9821a548a9a4", "comment": "Malware payload (AgentTesla)", "value": "72e346254401dd636a173110439f535e6d792791673d5143ba625cba91c29261db3c67548fd7ee6ad69763becb7b59e1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313680, "uuid": "989b5a3c-fb9d-4c9a-8054-8385029c4e70", "value": "T132D4AD1827885927C25F1A34D1F7614CEFB5CA378B8AA78E5C8076B99C533C9D9834E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313680, "uuid": "c4b3a6dd-1bf4-4cd9-9b3f-6a9810b9a033", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313680, "uuid": "e061fe53-80a5-4293-a7bb-ab8456b262f2", "value": "12288:svwDL7mMBsePbzk6CTvLWFK0xMIgC6XuNDmWaQzyX:waLlBs2YFvaFBMfPeNkQu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313680, "uuid": "42fe901a-74b9-4415-88af-5502e8a5b25a", "value": 633856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313680, "uuid": "49936342-7dd6-4a3c-a95c-a83d10257e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313680, "uuid": "3e23190a-4a77-4b08-a5eb-6cca56e39d0d", "value": "DHL \ucd5c\uc885 \uc120\ud558\uc99d\uad8c 175955...exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c737429-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696374362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374362, "uuid": "3b87c03f-2a24-46a5-85ec-77a7d06c4d23", "comment": "Malware payload", "value": "82ff9933fb431d648fd9acb5651c52dd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374362, "uuid": "d395d2b9-d0ec-44bd-aaae-3fb72dd3bb11", "comment": "Malware payload", "value": "da7bf056a0d9e9f1a11aa1b41bf0ba7c8e5284a22604a746a0a1f1d3a1ef55b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374362, "uuid": "2ec0eafc-d8f8-45b2-aadf-1135cffce802", "comment": "Malware payload", "value": "da7b9b61f04534425fa760b3e1ff3604eb6c4f59", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374362, "uuid": "a02419ec-404d-475e-8561-2003cfaed2aa", "comment": "Malware payload", "value": "be96a69705b8cc27e88ab73de36663c2b798be93dff5ec69be33193792a8c77ea85a5749ff47fcf77d50a85edce26f82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374362, "uuid": "21897e65-ccf5-4076-928b-d190afba8793", "value": "T1D273C71E3E25CFBDF76D82355BB39E21974837962AE0C180E69CE9011E7034D641FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374362, "uuid": "5d061eb0-6148-4bb3-8647-7b96914aed17", "value": "1536:U4YvjUUSD09sIsqOTneyO3nqiJ1JgLj/kkAecxsi0sKEy7Kx:6vjzSo0na3fJ1uwe3i0sKEeKx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374362, "uuid": "d5d4670e-f1b0-4667-84de-cf7683df6876", "value": 76044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374362, "uuid": "516653c5-02bc-404a-9ab4-7229d360ac37", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374362, "uuid": "a8915e49-9e0b-415f-bfaf-34e255b9ff5f", "value": "82ff9933fb431d648fd9acb5651c52dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d54ec54-6235-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696369129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369129, "uuid": "227697b1-6001-43b3-b841-b3bc9874b40c", "comment": "Malware payload", "value": "4d1fe0a1752f2405de5802aef37be7e4", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369129, "uuid": "d9c7d1d5-399b-49cc-a63c-9b078a595005", "comment": "Malware payload", "value": "db20a7e5e6da87473dfd4a71d6e94bc16b116afcdb33b5da67048c31716a926c", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369129, "uuid": "cf9d8e0e-6dd2-40bd-9ea3-add009da4aed", "comment": "Malware payload", "value": "7b0f523763798939b510f29437aec76e8bf7388c", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696369129, "uuid": "084b27db-2208-4c16-95d4-cb41e8930d93", "comment": "Malware payload", "value": "aebd5535709fd445a2755cd5c2d0c597b0808b94feacf98b616b8c96e305c51eeb808497632628ccc9aaf5511c423897", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696369129, "uuid": "f37b4264-c392-46ed-b217-13b8ddb0447d", "value": "T1782523B19FD92D335A78EB3010031E2F17D96FE29C6CA5EAE649A1D6164FFC4413B029", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696369129, "uuid": "0a802bf6-ab1e-4ca8-98d3-3ae347b91e07", "value": "24576:M102QokUMfJmlfdaedmp+hohWzAlXl/Gju:yUy34WnAXn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696369129, "uuid": "0d5ae948-cac7-49cb-978d-a7d58e53b27a", "value": 1042318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696369129, "uuid": "e7a87bdb-9415-4a9e-b138-f15a0267ce96", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696369129, "uuid": "abf851f9-bbd7-4a0b-9c05-37dffc72d1a9", "value": "New Products Inquiry_RFQ_Al-Hattab Group. Qatar_Pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda098c8-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696313617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313617, "uuid": "3dd9a265-a655-4880-9127-8d3670726e92", "comment": "Malware payload (GuLoader)", "value": "8b9e1cbe331f18c8d86c2416e95353a6", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313617, "uuid": "c3d6b6ef-b979-41d9-ac80-7e5f6b4593e0", "comment": "Malware payload (GuLoader)", "value": "db5e71460a2362ee3aac177133b2d39df51b184f45dbc75568ae696a2a27b4f5", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313617, "uuid": "33c35df1-7971-4c6d-ac41-29a2c8e8164a", "comment": "Malware payload (GuLoader)", "value": "4edf24f59759e9b469ea27a3a49e08cec4b4525a", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313617, "uuid": "300a80e7-2e06-46f2-834d-768c5e616bb5", "comment": "Malware payload (GuLoader)", "value": "d6b430c153ae35b38fd36fc7b3ea05a12a9c8470bafc50ca0f59df056cc461c3108a7ee05a453b8624a08d4e1ad6e606", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313617, "uuid": "7eb54155-f321-4e1e-978e-b4bff2019e42", "value": "T12B235CA4DE961409498B22F3CC8C0876C5F5897705361031BEDDB36E964BB68BF7CA1B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313617, "uuid": "c3635bd6-fa32-4594-aeaa-aaa53db89b2d", "value": "768:9EccYgUDW+q3ASRmWyihCArl3QL2o+olAEP3Er+b1HDQF180QGNXveU9DO36VytG:9HgU6nwsrl3e/+ZEffqzQYfeU9KsyzS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313617, "uuid": "09873cad-ad79-4fad-905d-e010b54c3a69", "value": 47294, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313617, "uuid": "07c2bd49-bc30-4e2e-87cf-51dc3ff68c40", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313617, "uuid": "8f062d29-0513-4d94-8bd4-6ac9c6b81214", "value": "5272354716_INV_JKT_WJG_001_20231003_620140.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "345d0722-620c-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696351505, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351505, "uuid": "dad4d785-defe-4121-841b-9688a07cbd4e", "comment": "Malware payload (Mirai)", "value": "cdfc27bfd3214df1375b82af984ac848", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351505, "uuid": "8d758696-32bb-43c4-8c54-25d110cd5afb", "comment": "Malware payload (Mirai)", "value": "db65de50f98f7352627464f8b747384ecf92758d7f62aa5114b4e7f712349980", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351505, "uuid": "f29b1ee1-dfb5-4c96-a8c2-24effd98bd9b", "comment": "Malware payload (Mirai)", "value": "1ca844023e4ff62fec5d9945186b8d3762bca987", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696351505, "uuid": "a5b061d8-b8d0-40ad-8960-2645417ba8d4", "comment": "Malware payload (Mirai)", "value": "37058940e9e5f01218dfb2ca37edfeacdc178e5453eff3f8c32e91e824e2a083d657f5afbe88a8aa1c2930ae639aecf9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696351505, "uuid": "6d8f7f79-8284-405c-95ab-c6b64389c60b", "value": "T16D735D24A9792E26C0D4A17B61FB8361F2F6230E2570D65D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696351505, "uuid": "bc3d67f1-cd68-4ef6-ad1a-082a2c3cf343", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8v:YwfdNu4cmZvFqI3w7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696351505, "uuid": "6b1f683e-0b9b-471c-b44b-caa3985b4950", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696351505, "uuid": "3294b718-9bc5-4e4a-bef3-88befe062f8f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696351505, "uuid": "d8c9344d-7da9-47ed-ad5d-74637e3cef01", "value": "cdfc27bfd3214df1375b82af984ac848", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab4f3e5-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1696357153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357153, "uuid": "d7a9f459-b0f2-4d3a-af64-a8b7fecf5b16", "comment": "Malware payload (AZORult)", "value": "3e19dde26e787c4e94c5be1ecc9f613f", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357153, "uuid": "f5e56fba-4a10-4986-b6ec-8baffa3f245d", "comment": "Malware payload (AZORult)", "value": "dbc966bebe3e0c0482db9fdc1d5676120cc8d7252a8af463d4b539260a86a9a5", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357153, "uuid": "928cf052-1a7d-4e2d-881f-004ff42afc37", "comment": "Malware payload (AZORult)", "value": "a07bf01d862f5ac56e138e6f84751ed89bd63037", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357153, "uuid": "7eeb4ef4-7a3f-4d84-84af-a4c1f7150bab", "comment": "Malware payload (AZORult)", "value": "832886056645c8a1a8ed40e7109b0fac25ce36824b673b18d84584d8866d5d8635b1e0251e264de2bb3a1f3b45695533", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357153, "uuid": "51c24fed-b3fa-476b-8529-7af8494b51e8", "value": "T1443512133A54C527D38507394C1AE3791A47BE65AC01C9AE77A0FEAF39F2351590E2EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357153, "uuid": "1f5a24d5-4df5-49c0-a984-d7b99f4d9447", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357153, "uuid": "c2b1d7cf-0f2f-44b6-bf7b-d0e08d151d3d", "value": "24576:LN9+kioQTmkpDRfdLMUvGAu0IoIn2DEV0X1z+At4Yw6ZbWW:LN9+kidRlMUvDu0U2g+X1z+K4by", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357153, "uuid": "18057eb7-440b-4b6c-a9d5-f5daf326be0c", "value": 1089851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357153, "uuid": "0707858a-e3df-4ea7-aae4-9013ea6529c1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357153, "uuid": "f3aba7cb-0546-433d-8632-279db6df0278", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fd28dc7-61e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696335606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335606, "uuid": "e62cdca3-8451-453e-896c-760d4b400b5e", "comment": "Malware payload (RedLineStealer)", "value": "54c65e90d811108be950f37a489ea6fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335606, "uuid": "cf8fbb20-a64b-417d-9653-ba7a9509b536", "comment": "Malware payload (RedLineStealer)", "value": "dbce6bdd247474179db59137515436785eb03193f2ef51244d62b1d5762fd933", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335606, "uuid": "c044ba3b-fdd6-4967-b850-41fa5bd99fab", "comment": "Malware payload (RedLineStealer)", "value": "5e040f2eaa3e149e9e0e48ea83a96d1757b33fd2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335606, "uuid": "928972b3-2f36-4533-ade1-15a80010d44d", "comment": "Malware payload (RedLineStealer)", "value": "9f139d52d45f202c276bc8c1e146e5b5f681ab9f1df1bdcbe3f6258122278a459474f5a2b34ab267db468e354f0209ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335606, "uuid": "e847b252-e313-4faf-ae7f-3f0e81a8ed96", "value": "T1E96523439FE86026E8B61770E8F607870BB57E506D78C32B2604D45B1CB2A959EB3737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335606, "uuid": "02edb930-cbb3-4ea2-91a8-c196af75bda2", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335606, "uuid": "7364e04d-51ca-46fa-9188-7151140242a0", "value": "24576:eypkM321g5jPOFwQ4Ts+NMztQMV05hKWGcN1aAID8yuRpPdq5JQPk/9w3Zqw+6Cy:tpki24GFwQcsdQU0TK5cN4nDQRpPdEM7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696335606, "uuid": "cf01192d-bd35-4831-adf9-77981adbc359", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696335606, "uuid": "7e9fe425-a5e6-436f-b4dc-a6d4503189dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335606, "uuid": "bb71f225-acca-4102-9c76-644e72cd351e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba02310-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696313668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313668, "uuid": "33f1baa8-47d8-4092-bdf3-1eccd654c824", "comment": "Malware payload", "value": "4d55bc5abece2347b6d6d5aeff30762d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313668, "uuid": "781ea7cf-583d-4f5c-bd3f-95c447bcc70b", "comment": "Malware payload", "value": "dcbc8f19ea881e76630d0371b6818b9a06e398934598dc31007e35d4df20ea10", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313668, "uuid": "81e9cd6b-48dd-4630-b510-263a988743fb", "comment": "Malware payload", "value": "2463aa8fd7892570129419a6bddc666e2a958e40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313668, "uuid": "4f01abc8-821d-48be-91d7-ef05f1274b9a", "comment": "Malware payload", "value": "27a44a5bea5d29ba513e4ed3cef3eb9e0f8b81240d305c3d965675a7a9b1d1cf06ada67997c7be50e736c62b93fee463", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313668, "uuid": "3fbb6ed2-f4ae-4443-be54-892f55633da2", "value": "T12494D002F7C185B2E57319315939AB12AE397D202F24DA2FB3D4496DEF71181A235BB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313668, "uuid": "0e3f3c5c-a795-43a8-aeeb-ec3ac1d60376", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313668, "uuid": "a376bb86-d003-456b-a9ed-8228ca3f8ba8", "value": "6144:tOYGXaPNxdgSdcq2pVZPOJHAbK//Ufjfd7Z8llqXEdv8tT4:pGqN/XdctpVtkP/uDd72d8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313668, "uuid": "b494ecfb-f660-4c64-80b9-a6080b72973d", "value": 439169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313668, "uuid": "4f596ac6-49eb-4429-9ae6-e19acb7b0d57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313668, "uuid": "7cb89990-97c6-4f7b-a75c-bf8d6f3f443b", "value": "\u0410\u043a\u0442 \u0441\u0432\u0435\u0440\u043a\u0438 \u2116534-23 \u043e\u0442 29.09.2023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beb92662-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696346153, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346153, "uuid": "74e1cead-caf3-4fea-a225-0872e9d88599", "comment": "Malware payload", "value": "b5dc8eff1ddc1d9e663818883a32ba14", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346153, "uuid": "2fed6352-170e-43d9-ba65-5dd2bec94182", "comment": "Malware payload", "value": "dcdcf60d3d174026ba75828af5422d44d235082d99e75ddc51ac4554acd1e7d7", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346153, "uuid": "82c443a4-6e9c-481b-9f25-bcdc1fa12fd9", "comment": "Malware payload", "value": "e3097b314c7fca88e8b11f6162ff9698c6526006", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696346153, "uuid": "c7f4a021-1f49-4f25-9148-a4c2071cae96", "comment": "Malware payload", "value": "81829fba49f1bc37fada2c76191540be6c045cd9c0db72c3459cb279aef99d0db2da4c1cf51067663ffc62fb2f8d13e4", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346153, "uuid": "ee30cc90-ba96-46a7-a753-1f4a82f55339", "value": "T154B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346153, "uuid": "723b02e9-1c02-4dba-8b67-894f07c379b0", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696346153, "uuid": "24945269-3fdf-4302-89f9-d57631d25e6a", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696346153, "uuid": "59488bec-5693-480f-a9ad-a52bcc200f04", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696346153, "uuid": "9f3ab186-bd40-4488-a393-d76e250847cb", "value": "AppleApp(194).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48336e68-61e4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696334358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334358, "uuid": "47f41184-a6fb-46af-b5ed-a063635bf5bc", "comment": "Malware payload (Mirai)", "value": "9179f572749caac2893b738dcf6c5732", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334358, "uuid": "e7a6f32f-8548-4884-9c98-d0b94211da4f", "comment": "Malware payload (Mirai)", "value": "dcf94a456fd00d70480b8357a6d696f33c276c62e6472bb48bb994f25bf4f2dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334358, "uuid": "c95f912f-8917-40b5-bded-61b484d12709", "comment": "Malware payload (Mirai)", "value": "0fd67acda3625de2c5361082d1ea76848701ef1a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696334358, "uuid": "6af4267c-bf8d-45f1-95fe-81aab4f5e443", "comment": "Malware payload (Mirai)", "value": "01961706ef12ce8b25559709042ac016c1b4af985b70a1cde7fda1a6e857328781c46d576646da7818e069d616f96e7a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334358, "uuid": "f46b2155-6874-45fe-a499-71b6cfccfc4c", "value": "T16A3329539E168F06D15BA6F0A1F28E315B62FC2A09970EFD6275EEE85143DC8F1063B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334358, "uuid": "6d5b3719-dca0-49ec-ba5f-bed66da00bbd", "value": "768:7izYT0y5GRsouZUKodWY9OafoFA1CKmKV70rdEfV7x4wGp2II:7iYTl5+soLKodWC5wK1CKhrV4wq2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696334358, "uuid": "a7cef5f8-e1dd-4007-a62d-d4773d135196", "value": 53376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696334358, "uuid": "7bec23e3-4b56-4d34-8d24-51a6207cf089", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696334358, "uuid": "227bba6b-cbe3-4b82-b291-fd1b88322f8f", "value": "9179f572749caac2893b738dcf6c5732", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81602c1-61de-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696332023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332023, "uuid": "b5181621-3206-4e43-9cad-d3d8c892d384", "comment": "Malware payload", "value": "7ca3897ae90106d8eb4ce36919306905", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332023, "uuid": "a2096f2f-448b-46ef-a96b-234e3c58d4b1", "comment": "Malware payload", "value": "ddb9c70c6d9428409e70efc80dab34a1e18378c3bb73ed6ec24507e998342052", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332023, "uuid": "071b7dd8-0303-4541-949c-0d2a3641c548", "comment": "Malware payload", "value": "fb8769dc6a5a4f8818e8f94682180de57ab51051", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332023, "uuid": "cfd4a0e0-779f-478a-9f76-bff706c502a3", "comment": "Malware payload", "value": "3a31756f97d106d39f37fb3d31180b134228379affbd197784a8d892ef210bab4894d9aade961a09b4fabb7938f4d6f4", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332023, "uuid": "81901c4a-d934-4a51-8af1-763cd6ca5f80", "value": "T147D40205F1B5FD16CC128AB0D8A236C3C357AC5A9E1DDB4E31D3730E4A362E63627A56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332023, "uuid": "ffc97e38-10b4-4ac5-8484-5b2c6305cdfc", "value": "12288:u8lMMFeGfxkGhx5ydiaPjSAjbiOSzJ2OHCwOkx:1MMFeGMdVPtjbiOZKCw3x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696332023, "uuid": "b77e3b57-20be-460d-b3b2-d852ae179435", "value": 636928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696332023, "uuid": "ebbe5ddd-4abb-4b4f-90c2-b717f5d7a4a7", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332023, "uuid": "f8211d0c-fcda-4495-b52e-5523b8d3d917", "value": "New PO.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e159eb5-6212-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696354205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696354205, "uuid": "1841d06f-dbe8-44ff-91b9-0b9e79870268", "comment": "Malware payload (Gozi)", "value": "f5830dc3fe80761eb82a0754b1697e6b", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696354205, "uuid": "e002ecb5-f606-410d-bae7-714ab20777df", "comment": "Malware payload (Gozi)", "value": "ddce7321ecf07394badc64ef8b5fc6000b56c517f7ed6dc1506e4c6c8b4b29a6", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696354205, "uuid": "2c5cc58f-12da-45ad-a057-9b1dd711f19a", "comment": "Malware payload (Gozi)", "value": "9f25e979cb2de3857278645b60c4afa37d0e6702", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696354205, "uuid": "75b401ee-3ef4-43af-a3d6-bfb060f178d5", "comment": "Malware payload (Gozi)", "value": "20367335c2d300c1b05498bce8c54070514c71a2fb9290aa263684c891496463230eea0dbfcc295da0cecf5e2dbd0acd", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "isfb", "colour": "#93835D", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696354205, "uuid": "8485e1eb-ae33-4547-8b5d-b07ecbf38448", "value": "T173549E1276E0AC61D5671A315D29C2E47B2EFCA19E6923DB33587F3B5C701E19A32B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696354205, "uuid": "61949060-0cad-49a7-863f-b73cbffd389f", "value": "775c7d434cffd499e537a34db4132a29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696354205, "uuid": "dce3c837-4920-40e0-ba97-197597162fb8", "value": "3072:YaL9FpSv0N0aIlzHMyXxpJD4xXvw1h+XKwY1a/I6RMxY:tpF0vW0aIlf+/w1hIr2aI6G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696354205, "uuid": "e203592a-938a-476d-9bae-238e7a44a788", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696354205, "uuid": "fe822b53-03c4-4be7-8938-222066d36b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696354205, "uuid": "1f4b963c-f1a8-4f85-8457-0e39deee64a1", "value": "client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980cca87-61fb-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696344371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344371, "uuid": "e06d0645-14e3-4458-a57b-16cee59081e7", "comment": "Malware payload", "value": "db09590beb492d3c1732c58e10bd09b0", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344371, "uuid": "15283257-568c-4805-8b8f-4805528ea08d", "comment": "Malware payload", "value": "de32bb667f056d0e3d6678fd313545aab2b4756c6a461f4f5797e3c682044f81", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344371, "uuid": "2e200899-4af4-4193-aa2d-51e3e6261232", "comment": "Malware payload", "value": "3cbada13c1a22e35f9be44b87a8f6aa29cb1c251", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344371, "uuid": "808a43a6-30ad-431a-94ca-3f694c751ace", "comment": "Malware payload", "value": "d4eb1b00ffdc76141f4c7cb0c8a3cd4d6cab99316e43c8b84b7dffd688c228643c3ca38e23c39d4d5d1ef94dd583ea45", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344371, "uuid": "7f71e8e8-acb8-4bff-baf0-8f7fdfdb3683", "value": "T16BB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344371, "uuid": "2dfe13d2-76fc-4af6-868c-7be0275f01e6", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344371, "uuid": "885faddd-c843-4144-b8fc-1b02e8ca9743", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344371, "uuid": "0afa0d01-72b6-406f-b0d7-e1168d34bbeb", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344371, "uuid": "f941bac5-7444-47b1-8d3c-7a911649288f", "value": "AppleApp(126).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d6ab93e-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374391, "uuid": "210e939b-a0b9-40d9-88d1-5c66b1b745ca", "comment": "Malware payload (Mirai)", "value": "afe09b21ac1bec1cc6d02599eb4bd914", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374391, "uuid": "711d92ee-c3af-42c8-91dc-93ad2fda1e58", "comment": "Malware payload (Mirai)", "value": "df1ec1176214335261939900019b59dbb8de3efe78eb7e58ac8abbbb2c8b796f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374391, "uuid": "d2b63dd5-4aa3-4681-ba9b-7130924fb47c", "comment": "Malware payload (Mirai)", "value": "0a352b1877184b4111b6c798d3d07b7dd98d9992", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374391, "uuid": "65a5c110-c8d6-4c0f-ba7a-3d6630160558", "comment": "Malware payload (Mirai)", "value": "9a6bbe0f1dae8068c93b8a8f591428aa193ed878a67d623ad4e58df8be7e50cbc7d2448ebc97d878eca82c69cc6883d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374391, "uuid": "d3145647-d790-4666-a185-d1af7b20ae86", "value": "T1F733490272180953D1525EB0383F1BE0D3AFED9021E4F789694FEB5A8676E371186F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374391, "uuid": "0c1111ee-14c8-44d9-967b-1b49decf2ac1", "value": "768:q7zmYGmhQR4hgXpUBg4lL1dKfDEMoWMEf8qYheN/T:kyYZSEnBg4lfKfDz5Y8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374391, "uuid": "a294bd17-7e3b-49a8-879b-3b0b6a2a94fa", "value": 55112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374391, "uuid": "7ed7d709-ae2f-448e-840f-f8e8fb9f7cf5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374391, "uuid": "62b29882-4998-4f29-8b35-258b16127445", "value": "afe09b21ac1bec1cc6d02599eb4bd914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a33b59f5-6180-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291561, "uuid": "5ba91c62-8ea9-4cd8-a5fa-75a240675eff", "comment": "Malware payload (Mirai)", "value": "8251b1e3a9039304b649de4dcc07ec03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291561, "uuid": "5ab64f9c-1ec8-450f-9f3e-71a0fea9ef12", "comment": "Malware payload (Mirai)", "value": "df20b4ef78e260b8d47a44dfcf205d4faa735c3ed4cf2d9463a671299ab97f6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291561, "uuid": "38252fe2-b4b5-44bb-8ef5-6f27e33bcbf8", "comment": "Malware payload (Mirai)", "value": "da961e48f4d7d9b8822215e024c9c0d9f5b4dbec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291561, "uuid": "965fc5aa-9d2d-4bb4-aa15-015b6fcbc266", "comment": "Malware payload (Mirai)", "value": "8350020583e7b23eb80b25fb7784525f580a83e431e774dfbe4819d039317eebea60cd7e092c3bee2edbee009bc22ad3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291561, "uuid": "a56fd740-c7d6-4e02-a763-91bf1c3653f5", "value": "T15EF2F1ADD2F0E578CF723932EC7E28DD26559360C071B5C23D10D4BCBAA4AC91AAC6C5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291561, "uuid": "e82c5d74-f4ce-450e-8517-1a0e53605891", "value": "768:pWmPG9YlXTvxKindu1x+xDiHFUPDROiUiUl6Hjas1Y9q3UEL1t:pJP7tTpdnI7CiHU9TZDD1BLr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291561, "uuid": "693a31d7-44c5-4698-9df6-5ef6ce616328", "value": 35312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291561, "uuid": "a6e63b32-90b1-43ad-8eb8-694401158ef6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291561, "uuid": "16863e7b-15e1-421e-9867-09b088a69168", "value": "8251b1e3a9039304b649de4dcc07ec03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6122a556-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696374343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374343, "uuid": "72844b0d-cef2-4d74-8e13-5e346e522708", "comment": "Malware payload (Mirai)", "value": "3de34b540ff68be7e56c30e0ac16d406", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374343, "uuid": "fc7c53b3-0739-46fd-ab2f-9ea786227eef", "comment": "Malware payload (Mirai)", "value": "df76a54b1ab0a11ce4ebb6dd1105fd5da3d836728d7a8cc6863f3515f093ae85", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374343, "uuid": "7d948873-b96e-4d0e-9089-b007cfb1d5ca", "comment": "Malware payload (Mirai)", "value": "7f06c7808f3fecb373ed03552d6818e81d516170", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374343, "uuid": "bffd22c5-8e36-45f2-9978-753042325a6a", "comment": "Malware payload (Mirai)", "value": "89f79bcdf04f77a96f110d17601453f1d60dc6172208f2e4ef3fe8dabf8176ed819d4f269d66a663c3298f92359630ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374343, "uuid": "44d15e50-91fa-4724-993d-9de7b8d90bbc", "value": "T12D333AC1A883D9F5ED0505B02077FB329A76E53E1169FA87D799D932FC42A41E60B28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374343, "uuid": "be7bd0d0-a32b-4331-b820-072cac27e044", "value": "1536:iLc2MDaL9nkqJsRNXmxwAF6ejZ7JOJ+z+FX5/kedOrBuI:iLc2O09nkqaROwAF6eN7JOJ+4XRkrrk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374343, "uuid": "8fc39ed6-fbeb-414a-9875-83a7023eda41", "value": 50908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374343, "uuid": "7a798cdd-42b8-4937-bdb0-a62497c98352", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374343, "uuid": "5f701a15-e8fa-4633-bb0a-9c99ba90dce3", "value": "3de34b540ff68be7e56c30e0ac16d406", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bb5d02-61d5-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696328071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328071, "uuid": "8ac4aaba-cd78-4040-90bb-edd10e0394f0", "comment": "Malware payload (AgentTesla)", "value": "f343a32f9345e03a7149ad402803ac49", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328071, "uuid": "331e2ee3-67cd-4768-a57e-f695db897be9", "comment": "Malware payload (AgentTesla)", "value": "dfa88b6a0c9166bfea4847084f31e471ce9d0a3a180456bd2f961758abd32d62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328071, "uuid": "e5ce05e0-fc67-4819-8e89-da8cada3d29f", "comment": "Malware payload (AgentTesla)", "value": "08f91c34342462b4510a770b8cdfa4d77efd14a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328071, "uuid": "79371e63-398a-4c71-aea3-03ca941c2bd1", "comment": "Malware payload (AgentTesla)", "value": "aae1113cbb3d3136126c7c94f328138caace624130d48d8418d04dbfa69e4399aec6a59f7da940889c0b28867fd5e633", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328071, "uuid": "eadc5014-063f-4340-8431-440abc6a82ad", "value": "T1EBD4120AB6FA4F20D6396FFB11B0149527B5BB262E30E74E3D8431FE6521B585E09B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328071, "uuid": "fb44d4b4-baa0-4e38-b9a7-f9bb8e5a02b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328071, "uuid": "dc76921d-1448-40b2-a06b-3eefee3e47ef", "value": "12288:lCiSAx5PWPQhxHeqfiEPKwPe6Jd+AWQdmZBvGx5m/oQmwlW:lC7Ax5uPKfSwPeu3WgmZGucw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328071, "uuid": "2c36c7e6-77f2-44a0-8c4c-88a7294725d0", "value": 625664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328071, "uuid": "2fc3d73f-5425-444a-b390-d0c50b889fb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328071, "uuid": "1401c3b9-d2a6-4b39-8649-735965a7e08d", "value": "WYSOBIFB.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fcfcd97-61c6-11ee-a6f9-42010a9c0055", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1696321620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321620, "uuid": "cc8d359b-8c35-4b16-b534-1090580c436c", "comment": "Malware payload (ArkeiStealer)", "value": "7392975f3a93ad57583d78bc32d2c053", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321620, "uuid": "7f32ac25-639e-4f00-a97f-daea4d001041", "comment": "Malware payload (ArkeiStealer)", "value": "e065676a6d3fd822fed9b2a99771a1355035f63873142fa3999cb69659a984d8", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321620, "uuid": "cce89c70-826a-4d37-9fb9-ca527a81c6e3", "comment": "Malware payload (ArkeiStealer)", "value": "f7cf48ece7fc4ebd6b39c5f8165e19b9372ede2c", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696321620, "uuid": "0048b96d-d21d-43ca-b2f6-d42edb8e6db5", "comment": "Malware payload (ArkeiStealer)", "value": "f59421ee35a0484d386fbbbd261d5347d39f014c209a92dc5930137349c11d0bba934c18310985dc2d9725725ba0f871", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321620, "uuid": "08bfe1e5-a409-4122-9c96-9239e94fbaee", "value": "T178E5073CDA259B23A275E13BD089550BF9A11587F1399F0E15CB4B896A0B6433FC9F8C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321620, "uuid": "769a61e4-ce8b-448c-bbb9-a64a2eb2c9dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321620, "uuid": "9838bd29-ac74-45ca-bc6e-74ccc12ed9cc", "value": "49152:cQ6skBCD29kd4cTv3sVRjQHkti3z+X4aZTX3s9K5TtHxsve3J:cQhy46RU2K7alXoK5TtHxF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696321620, "uuid": "b45108fc-f50e-4351-9a2a-213545d8d012", "value": 3158528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696321620, "uuid": "d320cf52-de66-4e2f-b9bd-cce6612f1937", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696321620, "uuid": "b1fd2f78-66eb-4ba8-a422-d135b0272c49", "value": "indicat.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49646e75-61f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342091, "uuid": "5675ec4c-c867-4f3a-a094-b589069b0d18", "comment": "Malware payload", "value": "d707fdecf8a701f4244d3c6b0761a802", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342091, "uuid": "2bc697a6-82bb-4231-9697-fc891c3c319c", "comment": "Malware payload", "value": "e06753bec282ca2061510035c0c3aac9c120435d6a21f994e7a2bf01d48f2853", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342091, "uuid": "26d45520-5edb-49a9-9d98-680d71d710c9", "comment": "Malware payload", "value": "d0cf2827c9610736636b8c09b10530fd36bf3e4a", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342091, "uuid": "f34a5f46-63c8-4bb2-b82f-632aa8742328", "comment": "Malware payload", "value": "80759bece4cb1899bd2854d318c93a19f4eda51c66b84ee05b907e585085250cd91a8d5a03099219eca7f4c2cb0688a6", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342091, "uuid": "b63cc717-79a9-4722-a82f-de22131643b4", "value": "T1B1B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342091, "uuid": "ae64f261-29cc-414a-9841-6c40a58b6961", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342091, "uuid": "c4eea65f-f4f5-42ab-be4d-c5ae73fef825", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342091, "uuid": "22d0794a-d8ca-4a8b-810a-a0320cfe4cc4", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342091, "uuid": "0d343ab1-62b4-4b19-b857-1afbbf46f6d6", "value": "AppleApp(18).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "127605ca-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696313652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313652, "uuid": "3b652a59-4965-4a69-a5fc-bb86813901b9", "comment": "Malware payload", "value": "2bc4aca6380a7b1833dd3c892a21b225", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313652, "uuid": "9976ed2c-6f7a-48e0-9fad-9b14e6f34305", "comment": "Malware payload", "value": "e20c1f3e05a778a3ef777cacd388c0fc2a9d22129dc7993c413871693536730c", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313652, "uuid": "48201c5c-3cb5-47ff-8bb8-f94d4c1a7b61", "comment": "Malware payload", "value": "16f788f930196018f98738c32cadfd2aac8eee2b", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313652, "uuid": "b004f664-734e-4b49-b672-d83fd53155e0", "comment": "Malware payload", "value": "c939654b89100abebbe060ccc11bb6de5ad10ff7987c6e690b0eb092be6f4d3fe6ab615dc753db0ee317fef795761fc7", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313652, "uuid": "fad345ba-5817-4aac-9895-d1d1bfb6b542", "value": "T174E27DF9EA5915690C4F37A9DC424C86C9BC41590937016AFFDA038E512FC8CA3BDB5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313652, "uuid": "d60a95b7-ee51-47b0-9814-65b98073bec5", "value": "768:RPJkLxR+FwpIlY2YalfZeoAg3Lh7uDFsV+oCh:wRsw+5J+FA+t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313652, "uuid": "e60458b6-b052-4949-a9c7-312273b68209", "value": 34215, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313652, "uuid": "56f0ba7f-d557-4f96-a36b-e0403e3a7f72", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313652, "uuid": "09c70c90-2154-4811-8e8a-3351163a8830", "value": "Invoice.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "452d1be4-6208-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696349815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696349815, "uuid": "9d04ddf3-ea3a-499b-8e07-ae33111964a2", "comment": "Malware payload (AgentTesla)", "value": "5f96ca1cb69ffa48bc90c22e83a33eb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696349815, "uuid": "9c06a0a6-aa67-490a-8df5-2fc09429e14c", "comment": "Malware payload (AgentTesla)", "value": "e27e63e6096a727c94170fc3459661fe3fda9d396d5451ae253015880b37c9d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696349815, "uuid": "e1a55476-8cbe-4178-94b3-776ddf4c4619", "comment": "Malware payload (AgentTesla)", "value": "87115d2916f51e0f4bc11725a5d11c86e3064c02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696349815, "uuid": "6e05dc25-1b98-4e90-9cf8-bbdb013e7b01", "comment": "Malware payload (AgentTesla)", "value": "ccceb1e17671999de6e92c64f4a71e5ace51b31c49c0641249f9fd0be5a7bfa93bcd4b681dc0ff0ea16024e5ca9132ea", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696349815, "uuid": "471984d3-8532-4a36-807b-10d9029c04d0", "value": "T10AB4AE2530EB1E87F03BE7F643982945C7EAF2F16F1BFA1A7D8117868421DC0DA56621", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696349815, "uuid": "947d722b-3609-4f33-a6b0-2a6f2e526f40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696349815, "uuid": "4c167637-aa9b-4676-bedc-a1b32e3d619f", "value": "12288:bFBF5Z/NKh0xapZn0JKZvoa1T0AUh7LhNWIr:RnsJXm0w+XUh3W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696349815, "uuid": "7d951116-2950-4ce7-b679-0cf90b75dd86", "value": 514048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696349815, "uuid": "b61c099f-9f7c-4ad5-9c8e-15b6032173e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696349815, "uuid": "5a888fb0-642e-4f46-a0e5-1166e134ce0c", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "968da137-6229-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696364125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364125, "uuid": "c8bc0730-005b-494a-84b0-b816ae766a92", "comment": "Malware payload (Stealc)", "value": "661f21fa79064d41c270176ad38c1866", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364125, "uuid": "a3e0e3e1-8d3e-4517-9872-2fe786a64805", "comment": "Malware payload (Stealc)", "value": "e2e015230a608f7b25b7aa03527afcde2508d1d83616319c4335c0857dc5c6c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364125, "uuid": "87475425-0323-4b2f-b823-06682b7dae8d", "comment": "Malware payload (Stealc)", "value": "d9e3dcbb11baefbc9f15281a3adf8b9bf7c61d1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696364125, "uuid": "ca0954bb-af99-49f8-b31d-e7a40984ffed", "comment": "Malware payload (Stealc)", "value": "26c0bf26fc9a77adcc85c83cc89c9aed60656f7af31dc0f38f23909bd6ee963c0c69d7eb6d3129e58aa96f43bc7269ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364125, "uuid": "45ef3a89-8e02-4e2a-ac0b-2369d67146e1", "value": "T17B549E1262E0EC31E4665A325D2AC3E42B2EFCA19E6957DB33583F3F59701E1D662703", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364125, "uuid": "c8100872-21f1-4db8-bfbc-3291de55fc05", "value": "4a68060be2303bc791c841045bc41876", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364125, "uuid": "50db9d9b-85aa-47a2-a728-4aed73673bab", "value": "3072:ivbS6PuZE/Pkwlp7qWDtEHOvrU5kIXpwP4lLFWrAY:+bSuuS/PksSXpwP4lY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696364125, "uuid": "437e8533-52bb-41aa-bff6-ca3c87456bd1", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696364125, "uuid": "eff5bed6-c77f-4299-b96a-786982187a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696364125, "uuid": "9b6bf264-8ad4-45aa-874e-dca0ed79b0b0", "value": "661f21fa79064d41c270176ad38c1866.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cff6746d-6187-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696294643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294643, "uuid": "e02a98a2-5839-47a7-8f30-21d7c8cb3a89", "comment": "Malware payload (Mirai)", "value": "bcb166ecbbc3428936d6166e3f396734", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294643, "uuid": "9d5258d5-e8f7-42b4-b1c8-d732923d4bfa", "comment": "Malware payload (Mirai)", "value": "e334ed89ac3d1399e0ce452890b7680679a6621664cf0d7a002865e1f761db8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294643, "uuid": "86311d88-1b2d-4731-bfef-07a9a252496d", "comment": "Malware payload (Mirai)", "value": "efb42261ef452eac11419aef6676ba5decce42ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294643, "uuid": "5f3f158b-9a85-4c94-93e3-cc19276b27e4", "comment": "Malware payload (Mirai)", "value": "be4afc4843b4b71f8e74ffa7d0de59f6df108a7a3008d1e712e8465d79ca7eb33f6e3a2453e74503906408212b837e18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294643, "uuid": "6102dcbb-fe6f-4c58-a571-eea52956bbf3", "value": "T11D4301D2D6A5AC61C5730D3BB733865F3956C7E8A09860917E39533AC3720E288FC869", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294643, "uuid": "4add2007-079c-4579-9309-3a69cebd3de5", "value": "1536:PH5y26fmsww0AQOfl7VkuY1aJE+PLMbDz/eT63uUgva:Ph6fmgQVfoLMnjw6eTva", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696294643, "uuid": "581a55bf-7197-474a-8c0b-35949b8b214f", "value": 59100, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696294643, "uuid": "3ec67fe9-3a94-4379-b5c3-3eaba3b5c809", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294643, "uuid": "0163207c-a38a-4056-acd7-b76cf7e74dd8", "value": "bcb166ecbbc3428936d6166e3f396734", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "960923de-61cc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (IRATA)", "timestamp": 1696324181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696324181, "uuid": "bc4b7531-b193-47f5-8198-78f77aac2ccd", "comment": "Malware payload (IRATA)", "value": "f2f53fc307074cef1fbf3832c8c5fa7f", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696324181, "uuid": "f1209b2b-21ba-4a08-a6fc-34aa6cc9ea8f", "comment": "Malware payload (IRATA)", "value": "e3fa34b03f0244bc09649212dc977e3fa115e0f82f4c2b896a9b9ca543c75c63", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696324181, "uuid": "70352ad0-aa08-4065-b047-c01a68c4cff8", "comment": "Malware payload (IRATA)", "value": "5a430720f88cbf02f59f416a814838757ddf26b7", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696324181, "uuid": "d8634f90-4a9f-4a69-b88a-e02ef324cc8d", "comment": "Malware payload (IRATA)", "value": "509808e92cce157d333fb3a5c78674c4790aae53dc618be307b0e9a0e3e4c9fe2f63c2176e0561750eb5f3e21a3c6132", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696324181, "uuid": "1aecb3db-9ac9-4319-9610-d0559e1290f4", "value": "T160E5BEC7FBA8692FC87754B2886E52B166574D028E839F476C48371C287B6D81F4DBC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696324181, "uuid": "b22cf3f1-eb7d-45b4-9abe-7fa15d9d60a9", "value": "49152:pFqPbSS82LLsc94qH9ZNjU93gL3eY9p+ugLCrgpWt0:pETyELsc94qHvNU9wL3JgLCrgp5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696324181, "uuid": "1d322c76-ede8-4c9f-8086-fb77a9096daf", "value": 3098681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696324181, "uuid": "331585fe-3bac-49ff-93ac-620cc949c8c8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696324181, "uuid": "c38e99b8-54de-484b-a8cc-a6be9a45f3f1", "value": "app.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07db5de4-6185-11ee-a6f9-42010a9c0055", "comment": "Malware payload (LummaStealer)", "timestamp": 1696293448, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696293448, "uuid": "ba2ff66e-ab90-4e2f-b667-d2470afd1d02", "comment": "Malware payload (LummaStealer)", "value": "dc576c06afdbe021603e34331de2979c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696293448, "uuid": "60c1e524-ebb1-445a-86e7-e0fe0fcd7708", "comment": "Malware payload (LummaStealer)", "value": "e408ddb8edc1a1d7699825ceecef3d47d380fc2747a174c9652761235f7c1763", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696293448, "uuid": "c6b06561-bc75-4fc4-b974-4bfd5a36cc68", "comment": "Malware payload (LummaStealer)", "value": "74030e98d4915a7336d4f4030549fa9d8bf7630a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696293448, "uuid": "323ee5f3-ac24-41f2-a991-61efd4ddd10f", "comment": "Malware payload (LummaStealer)", "value": "61834dd787358fcc0605bf69b0bcc6968098d2ab69bd868a31a2a937fdb37cbb6f8f02dc1711dc09d668177682bd4a5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696293448, "uuid": "08f5f503-280a-4150-ad82-ca89eb56c790", "value": "T19B650101B4D28072D576163209E4DBB65A7DF9314B658DEFA7D40F6E8F302C0DB70AAA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696293448, "uuid": "9729a892-4268-4f38-b130-1f67ed2e9795", "value": "fc892b222cf8669539a9f722e3b48fd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696293448, "uuid": "403a6165-409d-4141-b10c-fefe739668ca", "value": "12288:Shv5Hv+C2rzLY2LQmPyAn3KiF9uh1l26kzygGrzYY6yHuS0sI4m8oMaNl:SnvGrY3c4kygGrzY+r0sYIaH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696293448, "uuid": "e5b59689-a317-4168-8cee-885e9a7e9f16", "value": 1476608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696293448, "uuid": "74b8befe-54f6-4811-9da6-3c38bce6c676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696293448, "uuid": "aa28d73b-810a-4497-ab2c-35f5194c3811", "value": "ROBLOX\u0415X_debloated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8283102-6186-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696294173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294173, "uuid": "aee57305-ecff-446e-87f2-596504205c0b", "comment": "Malware payload (RedLineStealer)", "value": "4619f014958049156d3668c3cf71b0d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294173, "uuid": "27734edd-7c8a-46af-bf65-9395c6f437c3", "comment": "Malware payload (RedLineStealer)", "value": "e4aa13a28d8809b5fbc58400d02f0c3dee7f99b884b935c68059254c992948a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294173, "uuid": "d44b28af-1487-43dc-b79c-d46990f2602f", "comment": "Malware payload (RedLineStealer)", "value": "4cedb9da4343278cfbfe16a2f13153f30ba82193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294173, "uuid": "40f5b853-5406-4e8d-8ab7-923013ae92fb", "comment": "Malware payload (RedLineStealer)", "value": "e5e021a4e792425d7f973f35608b50f089e626fb31670ca518860dbb4b7fae79e5313bb09af55df4f0e9a3cd34531e93", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redline", "colour": "#71EFB8", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294173, "uuid": "30240a17-3f46-4b9c-8d33-abc74d630af8", "value": "T1F155AE1EA2974AFCC1785971DC321C599AE24F27A831D2B9F55E34D72F31B273A002E5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294173, "uuid": "1a510ad6-e3c9-48ab-8353-85d819793b3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294173, "uuid": "413b1e74-491e-40d0-83fe-bef4e5b14272", "value": "12288:zGa9O989894z79PhkQBVSWAuKWzbCj9O9a989Q9EnC:ztYOO4zRPi0VSWBKWz2pYUOiE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696294173, "uuid": "d5021fcd-e65e-4df3-829c-6b1ca66335f1", "value": 1292288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696294173, "uuid": "280a68a2-8f03-4997-ad05-5b097d2c3d6d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294173, "uuid": "cbc1238d-b91e-4754-8408-9e2c3df8e4b3", "value": "LauncherPC_debloated.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2548bb24-61c0-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696318838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696318838, "uuid": "220438e7-93a8-4839-b1ce-63182afb34da", "comment": "Malware payload", "value": "b13e9a52da3051bdef59cda7f93a7017", "object_relation": "md5", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696318838, "uuid": "21f75bfa-0e61-4e50-aabb-34f961292866", "comment": "Malware payload", "value": "e4d4629c731353e4928ce1ac7b557c82c860bffc11494ef4f592fbfdb8ea7551", "object_relation": "sha256", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696318838, "uuid": "eacc4ac3-c23d-46b4-b6a0-1aace2652069", "comment": "Malware payload", "value": "92d5b8972c0484e395e9da1f0ba2a02d648f5213", "object_relation": "sha1", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696318838, "uuid": "17aca318-e1af-47d3-b537-a00bcf48e1be", "comment": "Malware payload", "value": "68c56da4e67a0fd98fa888e62f015157c762d3c4930f9a5fda83e9ed328cbca8a75ccae0dea0f009c0b281de249255d3", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentratericevuta", "colour": "#978D72", "exportable": true, "hide_tag": false }, { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696318838, "uuid": "03182e28-7b55-49ac-a948-e8ff3045aab4", "value": "T154446ABC74B5B95EF6C4837FC6892CB2DB2CA580D7983C9B8E2041567D8310E5F7A861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696318838, "uuid": "0f5dc651-6d8e-494a-992d-cd144d43a4df", "value": "3072:y5aLugjIQLuLvr6KQRvXAHDlb7BcO1h1EgbhFYHRZHzCal:K+fWr5QRveDt7BcOh1zbh+xZ+al", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696318838, "uuid": "0c315cbd-f30b-45c0-95c0-b8692bf9da35", "value": 273461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696318838, "uuid": "b985d63a-0164-4264-b93d-9aa97b91bb9c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696318838, "uuid": "1b6d885f-e5d9-462c-a301-4186bebeca36", "value": "Transazione_202309291583040263_3200007044.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f79190b-61cf-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696325431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325431, "uuid": "67cf0d07-a6c7-4ec0-8e20-5c53fe5a5998", "comment": "Malware payload (AsyncRAT)", "value": "2160e7fcf5819e58a56ff11da1573885", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325431, "uuid": "39b4cfe5-3e86-46f4-9d25-c7bb8ffdb6ce", "comment": "Malware payload (AsyncRAT)", "value": "e51cfc4ccf015ea240546459a25884b818594916e04d987c08fa5d2b2e12aa30", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325431, "uuid": "d51be49a-481a-4993-bc99-a271fc032a8d", "comment": "Malware payload (AsyncRAT)", "value": "11d0713439a76a144cba8e27cec3656e1a768fb4", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696325431, "uuid": "bb83eed5-e76e-4d3b-816b-a81e106b0e64", "comment": "Malware payload (AsyncRAT)", "value": "443f96d493738a4ad20021998769c92e666eac9aa73a8f9bdac752cd808b34891c91caa7af92679d0cff25c3d851554f", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325431, "uuid": "bf99b7ad-9af5-439d-87b8-f7a3f6b16aaa", "value": "T19A4437B9D3D385719B80D6DD977D71C0042FB04F9B9B09A379CEEB396A2484E24B850B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325431, "uuid": "97724a2c-6926-452d-8c2c-109756a906b0", "value": "6144:gRtFGhfHHPwtLhanP7Kwd+ApMhfMWk/vGyYv/misXHAqyOd5MZL/Zw952lSS8oyb:gRtFGhfHHPwtLhanP7Kwd+ApMhfMWk/H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696325431, "uuid": "96bef323-a8ab-4e97-967f-0040b8470b7f", "value": 263423, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696325431, "uuid": "3ef1e355-3959-4888-9769-0906c238d4a5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696325431, "uuid": "4a8f2223-4de7-439a-ac18-9508b4128697", "value": "ReklamX.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742bef4d-61f4-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696341304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341304, "uuid": "2e3e2c97-9c9f-4306-93aa-f00aa65f7e25", "comment": "Malware payload", "value": "ab7a3b48892f6cedf436b97dae927e67", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341304, "uuid": "6df40053-5e59-410d-9eb3-3ff88b08b540", "comment": "Malware payload", "value": "e5324e9462e8fafde66de50014a3858447e2b2e98f07d66b584ab347ff211c66", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341304, "uuid": "dc78d038-5490-45b1-9451-451379a0d7f1", "comment": "Malware payload", "value": "1752555d9ee98802e592df366ea21cbe7c16f479", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696341304, "uuid": "3489b53b-e887-46ee-90f5-01f7173b4508", "comment": "Malware payload", "value": "42578d5d8747fd24c39556b3615c1c86ed7d204b96c7b39313cbd6f37a4cd958f5a7e46d3409ac4a322fed477f201c6f", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341304, "uuid": "7d9e12f1-0100-454d-9163-dfd1902b7b40", "value": "T1ECB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341304, "uuid": "b2d982c9-ac94-4fb7-acbe-72074be877ab", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696341304, "uuid": "dd4e36b2-9562-4d7d-906d-44145ebcbcf6", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696341304, "uuid": "293144c6-e0a6-4232-845e-57a23f9dece8", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696341304, "uuid": "8ac10638-7cc5-4d16-a930-0f41f8dddf9f", "value": "AppleApp(6).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b52c8016-61b8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696315643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315643, "uuid": "746c24ee-b1ae-4308-a988-81392f739388", "comment": "Malware payload (AgentTesla)", "value": "ec980b2eaacb57ec35da3995f975d283", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315643, "uuid": "3ceb342f-478a-4785-805b-a5408f2ec628", "comment": "Malware payload (AgentTesla)", "value": "e54c15ea5da3277ce9ce7c4242db9b7e1248acc7fed2b84be6dd4d9abaa2e92d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315643, "uuid": "b6c65a91-0f71-4302-a45d-744875f8ecb1", "comment": "Malware payload (AgentTesla)", "value": "76c281f8deffa691c07d822554d8dcf98fe59c3a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696315643, "uuid": "f8cbfe6a-5c9d-48d4-85cf-df8796ae263a", "comment": "Malware payload (AgentTesla)", "value": "2543f6d5a67c0208db054dcb401691d02ed67124d8f517768f5da8cd4b152a08c079cc2f75ec806ab1e1d6492b3d2e55", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696315643, "uuid": "23e33fed-06fe-41b5-9009-277283c9a324", "value": "T120D4122233C94705E979EB750A27A460563CFB3F1A79D72C1C94A1CB0E32B095BA2F57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696315643, "uuid": "46f41e56-12ed-41cb-9101-5a88abb67f7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696315643, "uuid": "4526d971-7dbb-4e67-bd12-25762bdee3e3", "value": "12288:oGaG5jfdincG9udbntW3khdcm9SrwAlp0iIjavCyXTSJ3ykVZ/65LqRVNumB0:Br55Cudb03khdch5ImTTUykX/qLqRuy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696315643, "uuid": "9c6f99bd-776f-4eab-96ee-82da8ebdc344", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696315643, "uuid": "933b43cd-397b-47d0-b334-6e50d18a621b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696315643, "uuid": "40030237-2cf1-453d-877f-3a7d982744a5", "value": "Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2e2a9ff-61d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696329920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329920, "uuid": "0a9bd766-8b47-4341-894f-363af50ff4eb", "comment": "Malware payload", "value": "4ffeb6756b3aaabdcbf47b493fc01b2e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329920, "uuid": "47e5cbe9-6f79-48b0-9fbc-17624a85f8ee", "comment": "Malware payload", "value": "e59c253b886386004673e23c15ad111e99a5fce7ae0c155ec4bebf1720129234", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329920, "uuid": "0ad91de7-fd22-4aef-a219-f7dd13526b9e", "comment": "Malware payload", "value": "18ff14460c54f1994940b381b7ce8be4c2fd529f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329920, "uuid": "51dd7746-33dd-4292-9bdb-199902135dff", "comment": "Malware payload", "value": "1d7c086254562840611090096783d6ea4df068ff8197c5115cbbbd060c59b350391b5159c1012a532fafc26df094589f", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Rozena", "colour": "#259A6C", "exportable": true, "hide_tag": false }, { "name": "ursnif related", "colour": "#1A6158", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329920, "uuid": "f7a79246-2973-4034-adaf-3642ad85eb08", "value": "T11B71111A93E8062BE4B34734AEF3471227B5FD545BB3871E59C013196CB5AA05E32BB0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329920, "uuid": "9b4e0edb-6491-439f-8e06-29e46ff35fcf", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329920, "uuid": "1ca5b71d-50e4-45ae-8495-77115cfb860f", "value": "24:etGSg8OmU0t3lm85HGXjEVElu04pdrtkZfI20DVUWI+ycuZhNlakSTPNnq:6aXQ3r5mgcuNd6JI20R31ulla3Zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696329920, "uuid": "a40371ef-b8d5-40c3-a6cc-e11f08ed802f", "value": 3584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696329920, "uuid": "fd9b95cb-f0cc-4310-90df-10f29050465b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329920, "uuid": "e2022d9c-ab54-4a47-bcbc-72109e143f68", "value": "ktij2bx3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83c7222d-61ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696338324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338324, "uuid": "d2c87466-54ac-45c0-8cae-a4327f137361", "comment": "Malware payload", "value": "6755070ca98a0824a495ec6952305bc4", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338324, "uuid": "e318301a-6ee8-4902-be02-7a77d327020c", "comment": "Malware payload", "value": "e5bac5f935403b884a5a1e2fe5767405f0618dd687bc8c6afc7de31ed68f9645", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338324, "uuid": "723f899b-a335-4956-811c-9fb2b21417dc", "comment": "Malware payload", "value": "2ec1b4328abb8e68b9bdc3b42f6f9c35816ed1ac", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338324, "uuid": "4fe3e5c3-339e-4a30-ba21-17c28e832700", "comment": "Malware payload", "value": "0e0fca0f3798a59c265769e623aaffbe5a7430326565f65a6c0c76d691e6486bde21343e0c623f678b87d104c76b7f86", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338324, "uuid": "29b52ec4-b420-45e5-a996-b7b3436bb136", "value": "T1C3B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338324, "uuid": "a0fce745-f1de-4b2c-8614-cc9489db9308", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338324, "uuid": "c743cb0c-0763-422f-8d29-5db4eb27dac5", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338324, "uuid": "5f5a40a3-a462-4c0b-aec5-2cba09462379", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338324, "uuid": "f63298ef-c34d-401c-b269-1682a9a422c1", "value": "AppleApp(90).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c03c0ed9-621e-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696359470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359470, "uuid": "6f39972a-4455-4557-9e02-2aeedcfe1398", "comment": "Malware payload", "value": "4961900123f16c14afd6e93dae087d86", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359470, "uuid": "d8c7c9bc-89df-49de-93e4-e0e458eb0512", "comment": "Malware payload", "value": "e602e182e5109c89e3044697204ad5d09c66fcb6760d9fa320cfc704167e5712", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359470, "uuid": "973b7596-a123-49a9-8261-093f67ed48b9", "comment": "Malware payload", "value": "f3018561d7a05b5156aa8e53f3df5ae0accc0a9f", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696359470, "uuid": "b09c3fbe-6b25-4faf-9fc3-275bd9f5b543", "comment": "Malware payload", "value": "35a8f1ef0cc52bb8b38ca7e429b4944d15ea007ff4216cf1355fc22209d2dc98232cb83c9be0df45fbc0e6e343b0fbf8", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "MaguZ", "colour": "#9E247C", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359470, "uuid": "d92b1a65-7bcc-4c2b-8e79-6a92492e5822", "value": "T1975477CBDC72A7A8C9B2B1771C67B58C89BDE2A3C0E89740E59BF5D62581CD01B1F094", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359470, "uuid": "0c423c71-36ce-4725-a5ad-4bff2265abc5", "value": "1536:ommmmmmmmmmmammmmmmmmmmmzmmmmmmmmmmmuZmmmmmmmmmmmDmmmmmmmmmmmamQ:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696359470, "uuid": "6deb08ae-d907-436d-b7bb-ac99c037f524", "value": 284672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696359470, "uuid": "54556214-815f-439c-947b-a6160fcd8eb6", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696359470, "uuid": "5025536f-56f0-4e4e-896b-80300bb79927", "value": "tt.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87ce8c35-6181-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291945, "uuid": "6918c5ef-f131-4326-9a27-0198b33cd2f7", "comment": "Malware payload (Mirai)", "value": "1d5346c57ec1d222a4c72210fec4e670", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291945, "uuid": "d5646658-f3e3-498f-8381-4ed645a38e28", "comment": "Malware payload (Mirai)", "value": "e65f993e56627ddc348b63b652599fa88bf7d4c68d2f94246a8f044560bc5f45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291945, "uuid": "e16f0b9e-0c27-46e5-b2de-f17b0c3ecbd4", "comment": "Malware payload (Mirai)", "value": "5183dc5af8e2f599dc10da222759ceb2df8007d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291945, "uuid": "70afd331-561b-4eec-b102-deb89352ba7d", "comment": "Malware payload (Mirai)", "value": "fca4c29e4b7e0a0462ac2e6e77fd77e9ad2744fdb8cffc34ecab8ff84b6d945249717bf4f39b6763f40a67b7a1b95fa5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291945, "uuid": "f6315772-baf9-464e-b209-9fd8f07d3303", "value": "T18F735D24A9792E26C0D4A17B61FB8361F2F6230E25B0965D7C760F8FFF2464468162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291945, "uuid": "e18ddae5-9207-474d-9272-c7e3971cd6c5", "value": "1536:5ms+geQfvznpCR8ee84cNsAUiAvFI7IlNnws8T:YwfdNu4cmZvFqI3w7T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291945, "uuid": "20766776-53f6-4267-af8e-0e63cbe7f7a7", "value": 74752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291945, "uuid": "d0388807-6684-41fe-94e0-5cb72da2fcfb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291945, "uuid": "920e534b-f463-4b6a-9ea9-2514ec35d37c", "value": "1d5346c57ec1d222a4c72210fec4e670", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60e87802-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AZORult)", "timestamp": 1696357163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357163, "uuid": "a3eeab91-f5f2-4ae8-a26d-905400ee258d", "comment": "Malware payload (AZORult)", "value": "3db16ffd68a4f0e879acb31c63f76ea9", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357163, "uuid": "142b3e73-9ed2-4ee1-9b4f-97f513917f4d", "comment": "Malware payload (AZORult)", "value": "e68d5ceca9a1135c2cb20a660d7d4807bb91cfd7f8ab0a3d8ba3e376dca8c2e0", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357163, "uuid": "734d9d24-6837-493b-acf8-cf74d47fcaaa", "comment": "Malware payload (AZORult)", "value": "14784b0ed15bea3aa4164d278516ee9934b03c6a", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357163, "uuid": "e57bef97-7f9a-48f0-9a4c-8d9fbe73109f", "comment": "Malware payload (AZORult)", "value": "3f10eb5f416c5372c64076ce9f5b3dc001e8b359d26e3a0c80a5d46bfc15e7043201f16acdbeaa2e72e3a971366b475a", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357163, "uuid": "263788e7-71ab-44f3-85cc-00cf2d9f332f", "value": "T1073512537A948877C3860A7C4C19E7796A43BE64AC10896E3694FE9F3DF2352150E3EC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357163, "uuid": "2a6e00f9-63ec-4732-9251-46513f4f5598", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357163, "uuid": "b2174ba2-65ce-4133-bc00-0fd4164cc898", "value": "24576:LN9+kioQbfMsMkh/Uds0IoIb2DEV0X1z+At4Yw6ZbWQ:LN9+kimszhsds0U6g+X1z+K4bU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357163, "uuid": "02bb9cbf-6fa6-4b99-a217-793586fb6d40", "value": 1087681, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357163, "uuid": "e10f38a0-b91e-4932-b5b2-ab9764c99ca9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357163, "uuid": "74ae58c4-d3f9-4458-969e-532e78ee6fab", "value": "E-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbcd9f3-61b3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Loki)", "timestamp": 1696313399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313399, "uuid": "beef64ad-ffba-40ea-bcc1-af8785c748c3", "comment": "Malware payload (Loki)", "value": "19202ef8b0f4d1536e4bf40e0246a2ec", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313399, "uuid": "d85d35ae-cc86-4a31-ae14-6da4138e99ac", "comment": "Malware payload (Loki)", "value": "e743cf899576503ecd96fdd01f5f8b6775a681e6eaff832b602ea04872fe1e4a", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313399, "uuid": "778abca7-7727-440e-a369-81b7082ceb59", "comment": "Malware payload (Loki)", "value": "1e570dea25b0f41bddf2d3e4b5fa887cc6f08a0e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313399, "uuid": "72e283bc-bdbf-406e-b047-64a93dc3684a", "comment": "Malware payload (Loki)", "value": "3888386ace486f75d6600c583a5b9d8e7d0508c0955342767f4057433c34457d9da2bc90452022a943f3c0fde502304c", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313399, "uuid": "6a54c98d-84e4-4429-9235-70e725e24c6f", "value": "T1BC65E00B94049F97C01947F8BE233DD80E0E7F29ABD569DB14527B8B3E3166219CA2DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313399, "uuid": "7a85c81d-da8d-46ba-824b-ff72382a39af", "value": "24576:xWQmmav30xSZyMw6VzAXZSp4Zybw6Vn+6bvdXXXXXXXXXXXXUXXXXXXXXXXXXXX2:AQmmQ30686VwEIf6V+6YxxDfIK27/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313399, "uuid": "50c248c9-71ec-40eb-bb39-a7e707d22bba", "value": 1443328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313399, "uuid": "b712b351-6023-4bde-b723-e1488b86169b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313399, "uuid": "43b1898b-8ecd-4eb1-960b-a26e637ffa3e", "value": "SHIPPING UPDATE.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbac9681-6198-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696302018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302018, "uuid": "7173de8d-4e4e-43a1-bcbd-19c99b805cbd", "comment": "Malware payload (Gozi)", "value": "aa05bdf7862a64f54d6e281944fb0f51", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302018, "uuid": "58d62943-fc51-4a02-b492-8cc371d4b58d", "comment": "Malware payload (Gozi)", "value": "e798fb0280fbc91cbb32234af0c55c4c6e16f528f8282057e334c2055ac07d13", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302018, "uuid": "1b843029-7245-4a58-80f4-e9577de5cc92", "comment": "Malware payload (Gozi)", "value": "60fe537372be17e284f0121f5da307325da6ca92", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696302018, "uuid": "1882e8d9-326a-4038-90b9-7db104ddb747", "comment": "Malware payload (Gozi)", "value": "29abf1c61391e22fbe5831e884a840a6d9042f672227a617e09168824f6cfacc70b2ec3e8742f04c3a7aebb158a0ce9c", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302018, "uuid": "bf2c13c3-8e91-4c4b-a816-ff68fe6456db", "value": "T1E8C022284E4DC162C002580B9058FC88AC0EB0442DE6E8981280DA8A9C820D4DE48EBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302018, "uuid": "a3f02d95-0971-4ade-b45a-38d3aaaad268", "value": "3:HRAbABGQEb/5sQaOUlQwAc1M7ovQvycAI9RyJ25YdimVVG/VClAWHn:HRYFJb/5sZOUwovQvyc1yc54vVG/4xHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696302018, "uuid": "3b940638-f048-44be-bdd6-84e6f31331d7", "value": 192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696302018, "uuid": "36d7ad25-2bd9-46b4-95b5-d536877dee50", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696302018, "uuid": "d19e0cc6-4b2d-4d5f-baab-79b4b07e27d8", "value": "Direzione.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db1c46d-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload (GuLoader)", "timestamp": 1696357131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357131, "uuid": "bd31da5a-0aa4-4a8e-9273-0cee6e30d8e2", "comment": "Malware payload (GuLoader)", "value": "814a53457a9b65ebe9e9692ca923f4ed", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357131, "uuid": "aebf2864-a886-43de-b3ce-f1480b712f7b", "comment": "Malware payload (GuLoader)", "value": "e83eb5a866c6a52a308b605f4493a3877c14d647d60b6fec6eaaa68f51e7732b", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357131, "uuid": "9b06d8e9-9703-4931-8fc4-11767734e615", "comment": "Malware payload (GuLoader)", "value": "f9459f01b1c70e9dbf86631920b1bb6a3285b1f9", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357131, "uuid": "9159ba07-c637-4741-82fa-5de6a8ee0938", "comment": "Malware payload (GuLoader)", "value": "630adf89e6de2717e97dbe23464e846da52745d69075790b7673611ff54c685406fe2fc9a84fbf935ba4e4a4716d6877", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357131, "uuid": "1b6f705f-130c-4ebe-b1dd-ef87248a7b90", "value": "T1CC93B3587845E105FC0AAEBE880A0B77E1D7416EC53734262FD9BA3D0506ED83AEB537", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357131, "uuid": "ee23127c-d635-46a1-8a92-5b1ca8371b8e", "value": "1536:YElvhYTEAU6WLm5vo8kezMSYR59pRM0Xm2gGQ8criv:YElv2TE7LmJVLYJA3Grh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357131, "uuid": "7a91bc17-f865-41b0-8361-17e04c8b9c8f", "value": 95664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357131, "uuid": "ff52cbbb-db8f-483d-be54-35953a188d4c", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357131, "uuid": "de4e8a99-4089-4b0f-835a-2cf2b1654153", "value": "PO_288209_Pdf.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39b1030-61a9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696309305, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696309305, "uuid": "537b3bae-54aa-4a36-9f10-8467d2f48111", "comment": "Malware payload (Gozi)", "value": "8abcabd16540cc77e6f820c561719eec", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696309305, "uuid": "f7536d7a-d309-40a7-a03d-ff99f53108f8", "comment": "Malware payload (Gozi)", "value": "e8649ad469c23e3ce48ccd5ba939548722841e3012444a257252bd7c6960a244", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696309305, "uuid": "578cd96a-fcd1-4d1f-b026-5f69b7715a07", "comment": "Malware payload (Gozi)", "value": "cdbd2c3363d355cfe6c03887c98388d26278d462", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696309305, "uuid": "2d8e55f0-8018-47b6-b4e0-da7cc6d80273", "comment": "Malware payload (Gozi)", "value": "0aa9ee1bbca5480d38130d28e7d69e54b62f77b0e702977345ff97a676fd419e641a6cfb3fef3f250980bc016aa781ef", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "pw-Agenzia2023", "colour": "#3DF0EC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696309305, "uuid": "8eb62bf1-2c23-4322-9935-d35808189f8b", "value": "T1B7E07D97C6C3DB56C85789BD22C213A90B005F601041715F56B45C111CB37B44F0B630", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696309305, "uuid": "362037fe-3eb5-4805-be25-4dc4ba9da680", "value": "6:5jLls/X3gWZIpK0GCiE7/dDySbZMcBI/GNkSYlsTgPpu+lZ:5jLlMgaN0GCiE7FDRbZQeNglggAaZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696309305, "uuid": "9907d1b9-537b-4037-b8e5-1f6be3495219", "value": 333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696309305, "uuid": "f96fc94b-956d-4f20-8827-8a6a22942c60", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696309305, "uuid": "7d3f33ca-375a-41cb-9545-88379d94aa98", "value": "Servizi387.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbccfdb7-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696343625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343625, "uuid": "fd428438-0a83-4be6-85df-5a839b5643cc", "comment": "Malware payload (Smoke Loader)", "value": "a0954dcc5c5a6b3a2e945b5da27d605f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343625, "uuid": "01280f2c-5385-4393-b54e-efb77edb0e4d", "comment": "Malware payload (Smoke Loader)", "value": "e920970ed1de88fb55f521007c10e12a677a5f43523cb4a73e10e2c70735d8e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343625, "uuid": "9918b34d-50c2-4be0-9c21-9c820d5bec81", "comment": "Malware payload (Smoke Loader)", "value": "7cbac1343a1cb299dd003915585848529ed7eeaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343625, "uuid": "c55313f1-34b9-4eba-b086-3e73303a6858", "comment": "Malware payload (Smoke Loader)", "value": "47e0d4659361964a29a1087c23e0d2f3dbf22bb75411b03216b5e627cbc588c7716f4e314456f932e461c1579ea855d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343625, "uuid": "917d7344-4750-4b83-83c6-9c190eff1d5a", "value": "T17A652362D7E88463CCB957B188F6029B0B36BD63956082EF7749AC544C73BC5A5303BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343625, "uuid": "ae82f84c-a8e4-466c-b565-549111c7dfc9", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343625, "uuid": "8ff49fbf-4b71-4347-9618-063defa61144", "value": "24576:UyokEU35PYRARCWqRHUtWJ+bMsLh3MQhm57A9W6K/XBjGQn79KsnkN/NRc73:jokEUJPTCKWn2hcQhu76K/XBjGQn5KNl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343625, "uuid": "decc5c15-09de-4a3a-b01b-89c9d33af3b0", "value": 1494016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343625, "uuid": "8071f0e5-bc98-4573-a59e-48f146139556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343625, "uuid": "da30af22-3726-4998-b454-ff4a71e3fa18", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1083f2d0-61c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696322239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322239, "uuid": "46f613e0-459d-401c-a598-395de5ba85c9", "comment": "Malware payload (Formbook)", "value": "a6c1e2db747dff5dd0612807837b2d12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322239, "uuid": "6774540c-804d-4c44-8bae-1b1cdc38fa5b", "comment": "Malware payload (Formbook)", "value": "e9c215e83bb6e46b8a29044e378bae7783ed14e3d5cf410a1ce433007d114f1d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322239, "uuid": "38726782-03ed-4e99-aae9-1cc5c699d8a8", "comment": "Malware payload (Formbook)", "value": "4fd2708716a4f40c5306ce647c579c97953b5884", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322239, "uuid": "87b2f5ad-9be6-406b-8304-9224f7a902d9", "comment": "Malware payload (Formbook)", "value": "c8b9342f6d0e2c12b0f775a0922fd99cf8a0ec8a62eb9038e84738411850b6137fc548b68f2e42a5961b4743e2e762eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322239, "uuid": "e0a5475e-874b-4cf8-89a6-f940581b989c", "value": "T158347C0175D28472D572193609F8A77A5A3EBC200B209EEFA7D80F7E8F746C19631B76", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322239, "uuid": "20f1fe28-1578-4ab3-9602-6c35cce01683", "value": "8c0ccb7fc45e2426233e4d667e820274", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322239, "uuid": "d0744836-070f-4a68-8d32-61596c0dbaa5", "value": "6144:NptkCB5vkniiD067i+jMQXjRbtHppAOls7jbm:Npttvkii3iKX1btHX3s7m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322239, "uuid": "773a6f3b-80d7-4615-a4e9-264c0e635f56", "value": 233984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322239, "uuid": "a41566ad-a9f0-45b1-b675-0e5e9cf0c946", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322239, "uuid": "51a16ac1-0019-487e-86c9-ba3630693bfa", "value": "SecuriteInfo.com.Trojan.Loader.1550.28975.10203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0143018-6181-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291985, "uuid": "ac228546-5820-4469-892e-c35bd7f7ec19", "comment": "Malware payload (Mirai)", "value": "b805adb4d77936b6b2c2906927a0a941", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291985, "uuid": "bb49dfdf-962d-470a-b860-488dc037a81f", "comment": "Malware payload (Mirai)", "value": "eb0febc1ccfa378cafc527189ccb5e15497b2d40bd943cbdcc22b12325f64df9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291985, "uuid": "15e3ee90-70dc-4114-be43-d5e797ead72e", "comment": "Malware payload (Mirai)", "value": "d55144550a1bc14b57d30981bed812eaf0fda7ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291985, "uuid": "d3b54926-40f0-4756-a79c-e7984a0758d0", "comment": "Malware payload (Mirai)", "value": "5dade3e539f64a098371b9806f92a3dfcc7311e1f2f7e9bd593155094ee48b2af1a0cf38ceca020e04d27cee9c990ec1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291985, "uuid": "60597c6c-fcf9-4abf-be55-ee32aaf840cb", "value": "T13E733BC6B801CE7DF82BD6B744234A1ABD3063D146830B366767FDA7AC731D85926E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291985, "uuid": "855bdeee-f478-4c85-81d9-f0c26e7225dc", "value": "1536:M1xZbHUaNgvT+LaynGdB8QUHaaV/RgJ+sMr3bed8sJkYt:M1LHUaN0TmawGdapngEsyMJkYt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291985, "uuid": "b4facb9e-ab18-4dc2-aa7c-6370c76515e1", "value": 73864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291985, "uuid": "22b644f9-e391-4735-8da6-d252415f9cb1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291985, "uuid": "a3188bdb-436c-49f4-87c7-d91a577152d5", "value": "b805adb4d77936b6b2c2906927a0a941", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58a284d9-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1696357149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357149, "uuid": "d4459689-7997-4437-bd8c-fcf21b66da91", "comment": "Malware payload (SnakeKeylogger)", "value": "fdc10b0a79f5e2d47f81c4f81ad4ac07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357149, "uuid": "c1147cc8-dbd5-4142-9889-d9c1cb22ec5a", "comment": "Malware payload (SnakeKeylogger)", "value": "eb129d9324fffc4f901285201177387057e3d6c8f34e93aab8b08eee5b44dcb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357149, "uuid": "34e32b73-b93c-4489-978b-64109c2e4e9a", "comment": "Malware payload (SnakeKeylogger)", "value": "1a9b020fe2e21e9ab341643c8f9e96bd8a5da095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357149, "uuid": "7126235f-fd08-4862-b037-e589cb0a6218", "comment": "Malware payload (SnakeKeylogger)", "value": "4f814d2a2acd8d1d6a041b94e5f37d3e81f8c12e0a7daf11b40f2d2385d3f9ee5175260065a3af3acfa943f8b0418340", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357149, "uuid": "a09b3d4c-ed39-4dba-8b4d-7bc3f1be3ec0", "value": "T18F946A047F4B6643C1AE177F9081144897B1D8116BEEFB0F9C4677F85A67302EB0AA9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357149, "uuid": "49266042-bbe3-4ef7-bdb8-4f5cbee5f93f", "value": "12288:vQ/VsmwXLT+jUl+cQMFY523fXbfqfc/3ubyMN:4/VsdXLKjUl+cQMFYU3fXbf2c/3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357149, "uuid": "32e45f3f-6d00-4827-a9ed-00c967372e05", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357149, "uuid": "968b345a-8a0f-4694-8f66-1da2e5727b67", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357149, "uuid": "6c2e18e6-6322-459a-b6d3-6f916a74a02e", "value": "dekontMPS20231003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcbfe666-61e0-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696332836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332836, "uuid": "17b0f34c-88a3-4a06-92b8-d597543ac7e3", "comment": "Malware payload (RedLineStealer)", "value": "2634623076a7af62a8479a5cef34b6d0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332836, "uuid": "9e4dc728-b5f4-4539-b29b-e052568d2b5a", "comment": "Malware payload (RedLineStealer)", "value": "eb1a060a2f31ff324b171aa329f0302493bf6d8a573c1142f03b7267fb2a362d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332836, "uuid": "84b8d36e-fccf-40aa-b57b-6dd7bb7d00ff", "comment": "Malware payload (RedLineStealer)", "value": "7f4d567bfbc4c5b8f8f7ea5c614dd909b0ab6ac3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696332836, "uuid": "68448bff-1d7b-417e-9c9b-244c68d4d5e8", "comment": "Malware payload (RedLineStealer)", "value": "891734107399e3b78a436958459829afef84da3f7b4616629af131fed40685b821b8f994e683c8a1c6501f2d1dba3c6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332836, "uuid": "ec9ea3c7-ca2f-4e66-bfee-ccea9c51aeff", "value": "T194843A04265CA6EEE1EF9B71103295E1C913976C61A4193DF2E36077BDF0FAB120E21B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332836, "uuid": "b6474e63-1f87-4fb6-a5ac-5f4fef1ee223", "value": "f707ada0aac189999ec6eb4a5a71dfbc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332836, "uuid": "db3c116d-e68b-4714-9ac8-9c92f839ce5c", "value": "6144:7kFSoUQrQakAGfCz35Jw66RPalaYNx2aDPUJKpn7jmb5kNkzJ43r7PSAxxOJYJfv:7kFkQUD66RPQnx2aLUJyfmb5kSPZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696332836, "uuid": "2594c1df-3534-40ef-9c0d-d25965e3056e", "value": 401409, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696332836, "uuid": "7b1c7382-cc32-4f6b-bf3e-523ad3907897", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696332836, "uuid": "cc0b0195-6017-40ad-bfe6-5b56455585dd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f2846b5-61c8-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696322237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322237, "uuid": "a45d422f-1067-4789-badf-e6904647b199", "comment": "Malware payload (AsyncRAT)", "value": "6c99b4c4064fe2ba0f3506b6283a16fa", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322237, "uuid": "9e45059f-7fb8-45d7-9dc1-8ea35690db43", "comment": "Malware payload (AsyncRAT)", "value": "eb37d95815824d94246220ac0bb63bce4ad8f9b3e821362d2d35867e9b83068c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322237, "uuid": "6f2d99a3-1ba2-42dd-b921-2d9c98b6d8a5", "comment": "Malware payload (AsyncRAT)", "value": "08a9c6a87194d88999dddc3689b73bc4923e4e43", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696322237, "uuid": "c0a3b7a7-8522-4532-b54a-163f9abe26a7", "comment": "Malware payload (AsyncRAT)", "value": "0d83620248ec9ad0dc3a6960d81638dc248f27045ffb1dad9d903831aa2b369296dfa6cf41f1ecb364b7e84c0d3bb1aa", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322237, "uuid": "54fe1447-3db1-400b-9c8e-e74fe7d8174a", "value": "T13A233B0037DD813BF2BE4F74ACF2214586B6F2633603D64A2CC841975623FC68A526FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322237, "uuid": "95bc04ab-e729-4744-91af-ef467609cb8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322237, "uuid": "067700fe-82bc-4628-81c1-27ae2d4566c5", "value": "768:6u/6ZTgoiziWUUM9rmo2qrdkxZLbkxQ86PI+ag0b3M8S5v5FwVhFNXw3tE7bhv8+:6u/6ZTgle2e1xQ8D+Gbc8S50FNAd4dS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696322237, "uuid": "7b115c4f-a1db-4550-820f-fcaf3a5d76e0", "value": 48640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696322237, "uuid": "ae86de30-1ec1-45fe-a270-f7ba0759fd6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696322237, "uuid": "bb3fa74c-3075-40aa-86ba-99012069c5d7", "value": "Stub.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25138881-61ff-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696345896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345896, "uuid": "c47beb04-b2ea-415b-8704-b8572d625445", "comment": "Malware payload (Mirai)", "value": "99296da0650974491d361d8b3d7af987", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345896, "uuid": "3f11690e-ee46-44a9-bd9e-5c9406eaee86", "comment": "Malware payload (Mirai)", "value": "eb3e03ad377fea222f6091941a96e1d1fc4edca1b9dfc2a11ebf40abb03d7cc1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345896, "uuid": "e23d46f5-2586-485d-b865-9794a7e81603", "comment": "Malware payload (Mirai)", "value": "82bdb3fd134ade8bbeed40d52b49a89796bdaa27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696345896, "uuid": "eb92ea2d-d2a8-492c-9f29-8ac0f6b313bc", "comment": "Malware payload (Mirai)", "value": "450f894038f71e667460fe84e4d72832709b89e196edba6570c0a31de6f88788a156100ad94b76518d698466ead88c97", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345896, "uuid": "f6c9a419-5b57-4043-946a-6ace48d096ed", "value": "T140D2D08976D353FA8CCDCABEB61F003A349A74D6A6B29363B342C5434775180FA51D89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345896, "uuid": "d8bedada-3716-48b1-acf7-c99bc3fea3b0", "value": "384:Mxd/PxEDLd2TwURz06lowYcEaqsD9aC450LQixBfE4jdlz0lewZ90BKrFjMMJMNN:WlxKd21RhxEnsD16IHE4RlY990ywoq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696345896, "uuid": "8ad2fb8b-4c7b-4cc7-8888-ecf01f67f552", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696345896, "uuid": "c920ffda-9245-40f7-9376-29743fedf682", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696345896, "uuid": "90ed883c-f1dc-4120-961e-d88451846659", "value": "99296da0650974491d361d8b3d7af987", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9eab2530-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696336651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336651, "uuid": "77fbcb11-c681-49bc-8dc6-7c1b55192f1d", "comment": "Malware payload", "value": "486f4cac56cfdd9cf8cf9bea3da1d2aa", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336651, "uuid": "950ab1ec-051d-425c-82e9-6d65aa132909", "comment": "Malware payload", "value": "eb5ed7f6c7dfdd74ee803f0d41f35f4b43f8c6a2e3cb64f1b9bdd0632950bdc7", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336651, "uuid": "58ad667f-bd2b-4aa0-9dbf-d4509e05dffa", "comment": "Malware payload", "value": "48c094c3b43309e5fcb4f0e03fa4e38b33f1f833", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336651, "uuid": "4ee185f1-980e-497c-bc5b-bb8b451c5a52", "comment": "Malware payload", "value": "646f3a760af5389a2df61dd89f575e8e0399c9dda2c016f9c2c09c242e0700e66d322fd17c14f357e5cfd3292f932c72", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336651, "uuid": "4ea71570-dc91-4aae-b6ac-c634baaae14f", "value": "T149B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE705B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336651, "uuid": "3ac44360-adcb-45ce-bc43-7f523478a12a", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336651, "uuid": "16a15693-ad84-499b-bf18-c9c075468228", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336651, "uuid": "7f456847-f33f-47be-97a6-7aa02a1ea780", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336651, "uuid": "94e27f4f-20a6-4e49-a479-447968660131", "value": "AppleApp(29).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96dc88f0-6203-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347805, "uuid": "e3f51060-7660-4eb0-ac09-3d3a0dc50244", "comment": "Malware payload", "value": "8bc1883682b0c45891aa940174baa57e", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347805, "uuid": "e245d524-e835-42da-b31d-8fc7556934b5", "comment": "Malware payload", "value": "eb97823e591636b1bac035b12dc5d158471f81f3eba6211ff1bd7b9e9e2bc785", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347805, "uuid": "8f722b55-eb22-421a-821c-7a9c79dcb837", "comment": "Malware payload", "value": "07237b7477cb47353d373ebfcb510edec96636ad", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347805, "uuid": "2d5eb4d6-22e0-462c-8fd0-2c14f783dde5", "comment": "Malware payload", "value": "50994d9308debe189abd00e1aaf6137ba7f38912f149160e3225c1eb9cd6543ff8b71efc11231e19660cb2a4a8505594", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347805, "uuid": "72598f45-12be-4eba-9ab2-1c61ed939399", "value": "T193B42338112D3CDBCE5356F7AEA42B629CDB85E729B4129001B242658C6FB4AF9F444F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347805, "uuid": "eb54bdaf-f6ca-44f8-abb7-c2d91b17bb2f", "value": "12288:JMGiNz/PUAg4Nq474U1ue65dRDwdFBg+3oEpVQaoKk:mNzkyqi4UQ7m3BRo5ao", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347805, "uuid": "cc21be42-4d03-4011-aa48-b4d243d998d9", "value": 500047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347805, "uuid": "d81adf29-2ac5-4c72-808e-8e72ec390026", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347805, "uuid": "03be6a7a-d93b-49e2-8285-1cdf63ba3bb6", "value": "Installer_v2.1(1).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9608a29b-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696336636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336636, "uuid": "43a73114-8aac-40a5-a4e2-7f75e7eae34b", "comment": "Malware payload", "value": "278ef876d328520d38d968910f745171", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336636, "uuid": "d678ab53-a741-4656-9b20-733aebb64320", "comment": "Malware payload", "value": "ebc73b0d0754de76ba41570f8c212994931c6144d7c65ebfc80d9cde95ea3062", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336636, "uuid": "f2368f61-9ac3-4381-a240-914d783392be", "comment": "Malware payload", "value": "c88b87f256915dc9c679155bba868b20a59773cf", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336636, "uuid": "e87d6a70-1a6f-4c35-a613-5bb0b22cfc77", "comment": "Malware payload", "value": "89e971a944189b077918b783dcacd85a1a041e81dcc90b151ae7582ff05c0d5506195ed9355d6104e596df7422c9db08", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336636, "uuid": "4b2eaae2-c031-4b41-bee5-aca54fe86d95", "value": "T1DAB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336636, "uuid": "fa18046f-c4c6-4a33-a5af-287f87495626", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336636, "uuid": "24ad7ccc-a47d-4f00-ba9c-8892baf451ec", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336636, "uuid": "8b05d961-2d70-469a-9315-2c54a0e8cb91", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336636, "uuid": "cea2805a-7439-4833-8115-c758016a2144", "value": "AppleApp(89).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4259c8c9-61dd-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gafgyt)", "timestamp": 1696331342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331342, "uuid": "8e7eb446-fc1b-469a-b1ea-af2de91906c9", "comment": "Malware payload (Gafgyt)", "value": "27018b0686acc3f375a3ce537231cee3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331342, "uuid": "b05e04ce-2314-4339-a15d-d7ede0f733d3", "comment": "Malware payload (Gafgyt)", "value": "ebfa8c54cec6f1909fcedf6629f53ac177db33fc2eacb01d018921d5dc14f39a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331342, "uuid": "8411f9d4-7553-4446-a1d9-b8cc702c8db3", "comment": "Malware payload (Gafgyt)", "value": "49309040c6a2bc085574e29a1069b799937136d9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696331342, "uuid": "e3a94dad-8273-4611-974e-04bba1f87818", "comment": "Malware payload (Gafgyt)", "value": "decc9c528ea98bfa519b77b5996641226160d9fed14c717d176456a605f32137ede13237e37e298c2c4ae3b31750d937", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331342, "uuid": "696527b9-ad39-4348-adfa-41f1049069a8", "value": "T1EAC31927F2E18ABAC0C7527426DFDDA19C23F1FC1763711B33A02D602B599DA1D69E42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331342, "uuid": "36741965-d921-40fa-839c-adbc591ba606", "value": "3072:4Hw/WdJny+oKNdadPjYplqwgphaWDQ0qWJ1mXpuOXyX+Or4e:+7y+udPjKYphaiQ07J1mXpuOXyX+Or4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696331342, "uuid": "17f77008-46fb-42e9-acbb-ad489711c2c5", "value": 120871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696331342, "uuid": "bf37eb1b-d9b9-4ff0-884d-417e165b5c9a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696331342, "uuid": "83ff1504-a0bb-47ca-bca6-14a0aabea472", "value": "kaiten-x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679e5b5c-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347296, "uuid": "5de1afeb-02d0-4010-8f56-6467320fd6b2", "comment": "Malware payload", "value": "f84759fa42b6d89bc28dc8d707bf5025", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347296, "uuid": "53fa8a34-9427-40c8-9a26-85beb0bf2c8c", "comment": "Malware payload", "value": "eca5fe0ec20d49eb62654ef793aa15d27d7bcccb55a1a27c8130ccd373ccb8fc", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347296, "uuid": "0db2021d-ff61-4eda-90ab-fa55bc5137a5", "comment": "Malware payload", "value": "b332cbad93f308a93fb3ff6d6df64d34053e224c", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347296, "uuid": "4a23becd-f427-4cb8-ba37-c0776b36b69c", "comment": "Malware payload", "value": "251d90d03a4dd603e16a1a90d65847e667c4f21fbde983a6426f990cdb114e604448970ee157108b28238f56cca28a29", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347296, "uuid": "7696dad0-8026-4763-b2f8-ab72f61ae611", "value": "T1A3B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347296, "uuid": "10133ffb-5d2c-4c78-8df3-941f60e921f4", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347296, "uuid": "65c9cfb0-44f7-44b6-8d33-1d9ebe947d0e", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347296, "uuid": "34325f4e-6e09-48fc-90d5-44f48ac9a10d", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347296, "uuid": "9c7fc927-4f7e-4a2d-bca9-f90869bb7d95", "value": "AppleApp(226).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7028a5b6-61f8-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343015, "uuid": "e9272381-1cbe-4fd1-b85c-e72f8854f7e1", "comment": "Malware payload", "value": "e43b292090dfa82e6fae29d3afa03b30", "object_relation": "md5", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343015, "uuid": "5812398d-f9b7-43f6-aa7a-7f0051508c32", "comment": "Malware payload", "value": "ed0ffa0ff4bcc5a9407cf7525b3b7a7c71d8bb5d639ba0e444218a62925ac0c9", "object_relation": "sha256", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343015, "uuid": "e54a5525-d827-456a-ae5c-c34a58569d46", "comment": "Malware payload", "value": "5d3e86520af213e47ff49752fd84038256efb615", "object_relation": "sha1", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343015, "uuid": "8b700dca-3420-41df-8c25-fa1b20acce29", "comment": "Malware payload", "value": "e30af36d482e9203cd6d5be53d60a9d5323cbe9d1efa52e39ede65e6d0cc9d9e10039b9eea78e75609ae2325e2dbb9b5", "object_relation": "sha3-384", "Tag": [ { "name": "binder", "colour": "#3053DF", "exportable": true, "hide_tag": false }, { "name": "crypted", "colour": "#7BD566", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GoRAT", "colour": "#D3C496", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343015, "uuid": "246aaffd-e953-40c5-b960-519bfe2dc1c6", "value": "T13CD79D502CFF00CD7137AB254BDCF8FB495AE455192EB1F92282DB454B36E84D8A39B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343015, "uuid": "716436af-5e02-48ca-bc6c-e99a056aa068", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343015, "uuid": "b5f8e96a-ba4c-4dd1-8a17-d9d2aa61cd0e", "value": "49152:6iBVabmBmwwp+pS1u4yeyUsXM/l8cKS1VRVVWVdigw54AZK2P8AsLdDvS2/76hbP:", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343015, "uuid": "895e07f1-f6a0-4b26-80cf-6206286983aa", "value": 62073344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343015, "uuid": "11781734-27a8-4092-89ab-8f437ffa3f09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343015, "uuid": "5b7c2bd5-b7ba-4198-96de-d09385686e05", "value": "EAappInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5e8ab3-61fc-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696344621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344621, "uuid": "e6313497-acca-449f-8e69-4de3cdd26c35", "comment": "Malware payload (Mirai)", "value": "2adddb1e42a98aa97679bad1c9842f20", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344621, "uuid": "a7316417-b9cf-4401-9726-1caf3df5806f", "comment": "Malware payload (Mirai)", "value": "ee16dd97ce81410cb0150f502a25320cd63bf56f7bf613174a8a6f7f3741cca1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344621, "uuid": "2cf89e15-8ad3-459b-aef2-d91e60709dc9", "comment": "Malware payload (Mirai)", "value": "f783fe7bfa4a5900b4e22c3f636cdc61ab19c9f6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696344621, "uuid": "da3324a0-f786-4fd5-9bb9-92d72e9e2bfd", "comment": "Malware payload (Mirai)", "value": "f9685ab2cc6b2c4d662373e7ec97b76d312835ea499a626545f561026682184055e06b216ad158e71ed0711dd3e6a57f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344621, "uuid": "8f352d8e-1cd2-4c5a-af3f-2d5dbd82ffb6", "value": "T1EEC2D0BD7EFB6E47CE2B00356898EE3782B065A5D35BB6D7B2044102BC130E5BA57C94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344621, "uuid": "a652d9b4-7ac0-443f-8478-c897c30e4973", "value": "384:M21DMwk8JPyGNoDZsEXVZVBy6xIJSlSmknnLZddZ6TJfUVlMWEbo28tEe5mjX7IP:vMw4DZdFbBy6x3K/KdWnH5Qkf0NM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696344621, "uuid": "972b71be-006d-4bd1-87d4-8e5b87842ce3", "value": 28048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696344621, "uuid": "c5901a04-75df-4c49-951f-34aef7012353", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696344621, "uuid": "b9cbb0fd-0239-4ca5-bb3a-4009acee250f", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "342b67c2-61bb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696316715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316715, "uuid": "4e09fcbd-d0d7-4b63-ab4b-56d877d0e244", "comment": "Malware payload (Formbook)", "value": "00a8e19caa00d45915b2068bc75711c0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316715, "uuid": "6bd63fd3-6dac-4e8b-9267-3f82a86a5b69", "comment": "Malware payload (Formbook)", "value": "ee8472c23be3d80594d5f4a12f2dd6140b5996cc8220fd3befe62391def68038", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316715, "uuid": "f2f5e0da-cac3-4430-b2a7-ac81ea20ea88", "comment": "Malware payload (Formbook)", "value": "0e5f00c645d8b83cf8367e54d8597bc7de46867f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316715, "uuid": "32b97770-1f3c-4bb1-9347-ffa4e0daaf3f", "comment": "Malware payload (Formbook)", "value": "cdfde0d19e08cba345ef80969a22ee1e867cc67288087b770d7d3fe79c91863b7c4fa5abfcf24b1cc098207a49824cd9", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316715, "uuid": "ff204a31-a861-40b9-a549-621a6cabcad4", "value": "T1EB6422EC678F97CB250D58A7B75B3E1B8EC757E80C28D92B6904851E81C881B3921F3D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316715, "uuid": "fb0bdbc0-3c48-4e59-80d3-ff960052a5bb", "value": "6144:UH0dTF9hw1R8jxWzNoQKGGz5rELCmwptGmwx6uxBCrmdcIPiMyRApgvpJg/:UH0xhwb5zNoQKGGNrELLwWj6NcKMyRDq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316715, "uuid": "8b1f4352-610c-42c3-9115-045a48a23e6f", "value": 331874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316715, "uuid": "02907aee-582c-41ce-82e6-f130270f7ea7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316715, "uuid": "700ad2bf-9dfe-4cae-a1dc-e5e305d492bb", "value": "ET2321000550.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34d1f89-6187-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696294622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294622, "uuid": "02e6d230-9e99-44b4-be39-4b6aff042ade", "comment": "Malware payload (Mirai)", "value": "28cf6ca6ae6d7604308cba762e16241b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294622, "uuid": "560b1efc-b878-4377-be4e-ff034e152311", "comment": "Malware payload (Mirai)", "value": "eefd2fbea7a222a4dc45a6f0b714f2e466fc5df869421eb784b36960e4f229bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294622, "uuid": "aa09ff42-10b3-4660-9c2b-a690e2f6def9", "comment": "Malware payload (Mirai)", "value": "644ab7d4a5aed7204115d3256e957736d5c2fdf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294622, "uuid": "1ce417fb-39aa-4a65-b8bc-25dd154d0ddc", "comment": "Malware payload (Mirai)", "value": "7abf51325cadaf2c6657f4cea9987ecdb1388eb75a4ed28fbf809093918e1d0e1c0fbd8a177c90e0dc4c23c873ddfe15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294622, "uuid": "5a0b9dde-45f7-42e6-95ac-b54062c5ddf0", "value": "T11AE2E035636972E0C7940436DD759A837FCB2768B0AA76657328133443D1B5EA1F23CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294622, "uuid": "31b59088-0234-405e-b5ef-50e05b949afb", "value": "768:6LxreMa5dpB2m1N7W7jkR7DaEI68Uco2ZCmB1gdYJ68QcQlDs3UozXO:6gNpB5Yu0683ocCmAY6nzluzXO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696294622, "uuid": "968a113d-8ed9-492f-b7c8-34f6fcd02745", "value": 33608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696294622, "uuid": "d424750e-10f0-4e03-b25d-436dc22381fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294622, "uuid": "8033e36e-1e85-4a1c-8a24-84539c35fbc1", "value": "28cf6ca6ae6d7604308cba762e16241b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "016d126a-61eb-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Smoke Loader)", "timestamp": 1696337246, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337246, "uuid": "32af94b5-0dcf-4f13-bd1c-32e89a09802d", "comment": "Malware payload (Smoke Loader)", "value": "9d1f7eb44f84d925d59a1180a84a557f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337246, "uuid": "3c5a8b3f-0ad8-43a1-b3d7-72f539b9fedd", "comment": "Malware payload (Smoke Loader)", "value": "ef23ff8a80325edc27eb986c68f8737eef07742ed585fbb49ca0c3fb1690ee7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337246, "uuid": "c67e5fe1-5e37-483f-bd9c-a10a3002c171", "comment": "Malware payload (Smoke Loader)", "value": "74f9a1fe2e69f95c40484b8ddcb89e1dc7ff745d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696337246, "uuid": "b20ac3b0-f785-4910-8333-647caf820d57", "comment": "Malware payload (Smoke Loader)", "value": "d13e071ec0dd6d56b809e1664cc611bbcdbf1afb26ade51b4581e0b5b1163cc9517245fd471e4f17997ee5283a7bbd2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337246, "uuid": "4c614a1d-21bf-4c00-b03d-6fc28656679e", "value": "T17C549F1273E1AC61D4625A314D39C1E43B2EFCA19E6957DB33583F2F59702E19A72B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337246, "uuid": "259643d0-fb1f-479b-9cea-3407934147ed", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337246, "uuid": "a06f3a7d-2f06-4f3c-9d3d-c3d927905d5d", "value": "3072:i6cYxmvmR0ayowUJSFxVE4KLBtHAgI/uw6rcLl5NVAY:PcYYvI0ayoDSFnE4k7HA9/uw6WlHV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696337246, "uuid": "cb823fb2-4a39-407e-8626-9018b5110558", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696337246, "uuid": "e5f36481-be46-4a10-b05e-e4b2d7824e56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696337246, "uuid": "654042a2-a735-4b17-9bb6-aa3603f2fabd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "feddce64-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696343684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343684, "uuid": "f14d2575-da14-48f5-a992-1dae2866778a", "comment": "Malware payload", "value": "71ab5f2f2043683d908490bd18830920", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343684, "uuid": "9b5e30c7-f479-428e-8a05-cf82d01d1ba7", "comment": "Malware payload", "value": "ef7e77d0180825eae9e3cb15fd4aa49edd25089a8d61147b559bb6ff6fbfc02e", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343684, "uuid": "c7c6e53f-0c39-4d27-ae9b-022c3616d2f2", "comment": "Malware payload", "value": "b9a077d229aa136366cb1f308aeed6e6a93c115d", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343684, "uuid": "e9d3db3a-12f1-4801-a9f3-5fce30c71bdb", "comment": "Malware payload", "value": "e7c6df91610416c03297cabe2f1e8aa3b8656bd0a821f9f0ab3021bb1602e4397233f2888b25367e0d217f0a666b231d", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343684, "uuid": "c70fb0cb-e718-46da-a76d-508873315ad0", "value": "T158B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343684, "uuid": "2d67bfd9-b106-4f64-b9d3-b54cc21f04f8", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343684, "uuid": "19517dda-fd8e-4794-b3c5-4eed98a18d7d", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343684, "uuid": "8ebd5ba4-0649-4321-a49e-893d007ed36f", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343684, "uuid": "ec72d04a-e62b-4bd7-b489-974039ab6805", "value": "AppleApp(139).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "570991db-6219-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696357146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357146, "uuid": "0465cb1f-67c8-4ca6-8a94-a775e7b324d0", "comment": "Malware payload (Formbook)", "value": "61e7842d593f985b71dcb89b1d12a097", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357146, "uuid": "34921aea-33d0-4fe8-9440-382e87e0a3c8", "comment": "Malware payload (Formbook)", "value": "efb834b38792a7c5f000b0683aa6fb5999fd2c0d6dfda9ba417f990fbe1041b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357146, "uuid": "73e880f8-a2da-4587-a6bd-fc5dc8840870", "comment": "Malware payload (Formbook)", "value": "d73c1b338469a5d5125de231f2b09c7c44c73a66", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696357146, "uuid": "1ffbdc5a-9057-48a2-9d94-636a521b4546", "comment": "Malware payload (Formbook)", "value": "39f680299e83b4835ce052e35bea2267394c7a79e1cd0522ac5ae2a9ae4e576836ebebd895775d731088c45765fabf5e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357146, "uuid": "09de59db-8bf1-485a-b159-14be1b9d5ef7", "value": "T120D4F18463F19A44E3FA8FB64DF1EA444BF9B4032591D74E0C8A269D4535FAB4F00EB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357146, "uuid": "3fb2efee-54d3-4ae8-b69f-105736c8d496", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357146, "uuid": "943b7368-b2aa-4e2b-962f-18253e340453", "value": "12288:zMYnQ3j67SESV1eXl8OhA905Na+U/IVEbGU3kD5qekn2w49xq2D/ERzAnwjiB2I:zB5Na+3V6DkseC2w49lD/E9n3I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696357146, "uuid": "0ab5ce72-fdd6-44c4-857e-60de0980e253", "value": 610816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696357146, "uuid": "41377fa5-363c-4033-b0c9-9b0227a0f2d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696357146, "uuid": "4bcf3b6e-a618-4bdf-ace1-c34420b38cde", "value": "Sipari\u015f 5035.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7f8cb8-6218-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696356946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356946, "uuid": "0586f883-66c5-4cc8-9fdb-c3066038e8ae", "comment": "Malware payload (AgentTesla)", "value": "d981738093e4b59c4eb8e057be4aa409", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356946, "uuid": "4a1ad71a-5775-40ef-83a1-c541e24d6727", "comment": "Malware payload (AgentTesla)", "value": "eff8d85fc22accf7720d5180adefde9214a5d84ee6cd6e8118e42124f46afb33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356946, "uuid": "e111f73c-076d-408b-9bbe-e3b8c74f4e36", "comment": "Malware payload (AgentTesla)", "value": "707eb438f82c77d0830580dc0dbf50b874d56d01", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696356946, "uuid": "2a47b77b-71f9-4c31-82dd-d8740c61d16b", "comment": "Malware payload (AgentTesla)", "value": "28f48ae9705aa986c1a88632467fa5b88d460ba6930d4b02188a3b8e569f4e9e1723a7aa99ef6e4eeb154a8e40322de3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356946, "uuid": "6118053d-55de-4df9-a94b-74dace384d93", "value": "T1B055E00FA424AF87D00943F87E2339950E0E7F29A7D569DB14537B4B3E306A219DA6DC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356946, "uuid": "83ba7240-a0f6-47ad-9a74-77768d2a8d8c", "value": "24576:bWQmmav30xYIxZyNw6VTAXZSujHWZyLw6VoAXZS3yYK5br8oTQJJxSf3wzx:6QmmQ30P56VQEhX6V3Ei3rjTqxS/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696356946, "uuid": "378125de-0da7-4a7c-8ac8-f6a2f13d2d59", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696356946, "uuid": "7eab2f26-3f51-44d3-a733-de6d946ebc4c", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696356946, "uuid": "fffb9117-ab30-4454-9a5e-a69d14bc9a2b", "value": "New order 32724.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4999c2-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696347280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347280, "uuid": "bd58733d-0f47-40aa-8ca5-818f583f9588", "comment": "Malware payload", "value": "93e2e9b637f4e0621cacaa81667f26d9", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347280, "uuid": "f222e60a-0df6-4cbc-bccb-db53503cecab", "comment": "Malware payload", "value": "efffaaa3b185419e61cd16f661b84647fd4b86fc3c1812b2fd83a5a28073d319", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347280, "uuid": "f98c8309-479b-4f46-91fc-b148b88a50b5", "comment": "Malware payload", "value": "64440aaaf50bf130e7571e8e616bd8f7e8ecb71e", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347280, "uuid": "e3334c58-09e1-46d3-80a8-7a8692bc7b58", "comment": "Malware payload", "value": "87adb8594b976e6d355f6d864a0aab2bbb5434909eeebc9fcb35658bed1d0e4fe06e3a576907c8343de707ad36aeff7d", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347280, "uuid": "bcaf2efc-bd4a-4ffe-82bf-2e7c78e0cb99", "value": "T111B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347280, "uuid": "118c3722-014c-4f05-9c3f-f72eb41f646a", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347280, "uuid": "2c7996f2-a20b-4ba3-b967-57bd24411a8d", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347280, "uuid": "a1c82fc9-70de-4059-bad7-31b97c8f4d23", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347280, "uuid": "c396fbb9-922b-4ea7-8058-663c6937cc9d", "value": "AppleApp(229).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05895b0f-6187-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696294303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294303, "uuid": "81e84023-eb70-4553-82e6-6be0195453ab", "comment": "Malware payload", "value": "e13d2f6127552a011aa30624e6ff5e9b", "object_relation": "md5", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294303, "uuid": "bb95cd1c-8fb1-45d8-88cc-5993dd9724bb", "comment": "Malware payload", "value": "f0b9f4eb3af0017d742397a1ff568d87c1230482ea7688f71956e63489830301", "object_relation": "sha256", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294303, "uuid": "cb786b8b-b3e8-4f52-9b78-ddbf33db06ab", "comment": "Malware payload", "value": "fd7518f90590e27f81f9ed9026615128139adbc2", "object_relation": "sha1", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294303, "uuid": "18b6b384-ff7d-4504-8f71-b9e0736ea270", "comment": "Malware payload", "value": "95956cb7b4b01d81fd6107f2fd72cc873785a534e10e8b274f60d8e942bafc3d0e1511fac8c2337ce46d5ac64fc00b19", "object_relation": "sha3-384", "Tag": [ { "name": "Shellcode", "colour": "#E5D9A7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294303, "uuid": "cbbe3f0d-46d3-4e44-9063-c8aaa895b17a", "value": "T1BBB312EDD909C667CB42C477E1EEB7838B5D21036776B48102AB49880AA6BCD2771D73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294303, "uuid": "bfb15eed-3c7e-4f66-85d8-a2d983700fc5", "value": "3072:8/B7fMycHoCPTRxYBERASO6piVm27KlbVMwg/YCuPBH:8/pfM5bRVk6piVmECNgmPBH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696294303, "uuid": "6976c471-1aaa-4f29-a249-f050f812c206", "value": 114688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696294303, "uuid": "f20ab986-e65b-49e0-9658-ee33e1992a9e", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294303, "uuid": "aa10aa78-7336-4499-a608-405c634f1a6a", "value": "sc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57a97b74-61f6-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696342115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342115, "uuid": "96421642-b7bd-4fae-93f6-653664fb377f", "comment": "Malware payload", "value": "c0e2092544b9012e2ee7ead2a6804aaa", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342115, "uuid": "697635ae-dcdb-44bf-b6b9-8d85772bfd77", "comment": "Malware payload", "value": "f0e36b7cadd42de91bd16b42837ebcd7a9be1e8ed8d243fb31aa69917d65e046", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342115, "uuid": "e13a4a61-8ded-4790-96db-16a1cb41e4d3", "comment": "Malware payload", "value": "6156a258803a59b3ca8f3136c067696e2fcdd77c", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696342115, "uuid": "f2223a7f-4356-4c6e-9900-42e6b885884d", "comment": "Malware payload", "value": "5e00380ad29f7db2aa548d59c1a067609580fe2a21aeb0ab1c39e33f839da00c61906d9c05fedc4eda13a1c49ec506d5", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342115, "uuid": "cd93a7ae-1249-44cf-aaf7-201b9daff46b", "value": "T16BB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342115, "uuid": "8a4c9174-dbe5-4e6c-a7bb-43d68ef6b32d", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696342115, "uuid": "5c7edbda-3c18-491b-8017-59677220c7d6", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696342115, "uuid": "776c8a1e-1dc8-453f-99b2-50d475d4c928", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696342115, "uuid": "75bd524c-0293-41a3-b6c2-1726294b0ae5", "value": "AppleApp(10).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d427ace6-6244-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RiseProStealer)", "timestamp": 1696375825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696375825, "uuid": "290c45c6-eced-4a9a-a501-07333187f3c1", "comment": "Malware payload (RiseProStealer)", "value": "3a569b205061a469b64441f3db312aba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696375825, "uuid": "dcc04868-1c38-4728-8627-c1857a4fa45d", "comment": "Malware payload (RiseProStealer)", "value": "f0f4648624a7d35c58bc4d6b67792744727fdf8c1fdc149df0dcfe3b1eed2a27", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696375825, "uuid": "a26d864b-5dbb-4415-a49b-fe1c29e56459", "comment": "Malware payload (RiseProStealer)", "value": "5c21b8f85017b59717b47075f7f2d4bd84e77e73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696375825, "uuid": "3bd44303-f814-4414-8410-b1bc340c9c78", "comment": "Malware payload (RiseProStealer)", "value": "3dd11d76caf6bbce3792885a7189ed5cdcd4fd0782c4345f3ab95284e483a5932d465a21910d02ff7e37dc73fe994350", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696375825, "uuid": "29218e44-853a-4aca-ad69-9d6709a72d69", "value": "T1C115120276C0A861D5B227714C3DC0E4276EBCA29D7963A7365C6F2F5A711F0A7B2B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696375825, "uuid": "647cf81a-39a9-4d56-8a9b-f7fcfc88ec88", "value": "775c7d434cffd499e537a34db4132a29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696375825, "uuid": "1661b784-124d-4194-9bfe-91cb82b799d8", "value": "24576:TbBc0B38pi1eBTt37vIJcSk3fNZATxVxOI:nO0B3R1mt3zrr3fNZArxO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696375825, "uuid": "38ab22a2-1d4e-4d1f-9966-4fbabbade4de", "value": 915456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696375825, "uuid": "93ed350e-8897-4f88-8d56-447e34644375", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696375825, "uuid": "39f48520-48ab-4127-ab68-772ccd560c7c", "value": "3a569b205061a469b64441f3db312aba.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "986fb723-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696336640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336640, "uuid": "da2aaca3-2357-4b61-b909-91ce24409596", "comment": "Malware payload (AgentTesla)", "value": "c4f7b479aafe5bdf57b7f30ebb0c7358", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336640, "uuid": "e5bebcfa-c5e2-452a-a7c2-269b3c05a779", "comment": "Malware payload (AgentTesla)", "value": "f171f8699ea2ebefdf7cdf2665d344cb46d0095c3fd89da5ed3c2bc0bdb3aaf3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336640, "uuid": "f5808b29-f5b0-4845-8664-e57bda6422b4", "comment": "Malware payload (AgentTesla)", "value": "fc270a19eb8bc0ccce2da96760ec9b2979bdfbbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336640, "uuid": "1366b988-d3f1-4012-ac3e-878ecd603083", "comment": "Malware payload (AgentTesla)", "value": "1da8dcb6f58a04f2a7f5b3fb530a91908a99874e44cb748c887fc381be722cd0ad649b0d6c1315a2335bc4c4e8556398", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336640, "uuid": "d4cc25e3-a11c-4075-9524-e4e332a6c2d8", "value": "T17DD42316B57E6B74D9BAAFFA42F1149217B2220B1D30E36D1C8835DE0A7374A2F15B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336640, "uuid": "f665feae-02e0-4dfb-9376-98865463cfa5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336640, "uuid": "ddb4771a-f1f1-4a6a-b505-229421c774e0", "value": "12288:f9iSAx5PWPQgqGhBbTz5BmEs9BQ/m7a/sY9E4MB+jNS1nM3Zb7xa:f97Ax5uPjqG+EqQ/FA40UQE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336640, "uuid": "a8b0d7d8-7335-4a96-86f7-d096ba63dd7f", "value": 620032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336640, "uuid": "38a95672-4f98-4fab-8f3b-072bab514002", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336640, "uuid": "23f805fa-dd24-4636-a6a7-6fe1e3cdccc3", "value": "SecuriteInfo.com.Win32.PWSX-gen.5808.16969", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6086b88-61b9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Amadey)", "timestamp": 1696316155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316155, "uuid": "2054f656-7795-40f9-801b-e15bbe7a85d5", "comment": "Malware payload (Amadey)", "value": "d5e62f5a1aef18bc713ee00af2485de5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316155, "uuid": "2684ea2f-00ef-4090-9eba-6a9cccc63caa", "comment": "Malware payload (Amadey)", "value": "f1ffc35113b9e6652d9d9540f7c8c42ea1ccb078271264e73a0ba69d1ac3d0ef", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316155, "uuid": "d033711b-7866-4cbc-bdc3-0e70613bfb21", "comment": "Malware payload (Amadey)", "value": "37490ad1cfbbf3aa1f9aa709646728cc8e6df732", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696316155, "uuid": "cc4452ee-ce1e-41a9-a2ca-397c05980521", "comment": "Malware payload (Amadey)", "value": "69d5c57ae2507b6f58376dc2626e9850da1f34ef58400e7610bdbcb36fcc218af7bab539540a5b9778c360b9674b1e9c", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316155, "uuid": "326490f1-eaeb-4ca8-af38-9a8e170d6203", "value": "T1A8D41242ABC58037DDF13F7099F206D31E327CB195284B7B1386A9991873BD4A93176B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316155, "uuid": "f361e038-7320-4cbc-881b-843846aa391d", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316155, "uuid": "98fff402-c386-4567-9f1e-c593c1369ff2", "value": "12288:rMrcy909ERNeXM1DMRhQMGjCatxH5XjBgMiLWXFjYTDhM9dxCI+oQF9JX5qBkBRv:HylN0Jh8jtxHNBdiLWtkNM92TZXYWROe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696316155, "uuid": "ef96143e-f38c-4efc-8992-c1bfb9c53a0e", "value": 650752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696316155, "uuid": "c8875bfe-bf6f-4fa2-a97c-812f679c8556", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696316155, "uuid": "f43963da-0dc1-4669-84af-bff6dc7e5a29", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b40d72-6202-11ee-a6f9-42010a9c0055", "comment": "Malware payload (MarsStealer)", "timestamp": 1696347477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347477, "uuid": "54b81fca-cd83-4b8b-8131-523f26472fd7", "comment": "Malware payload (MarsStealer)", "value": "fe24f96e34778f7c9a6c6ec984726c1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347477, "uuid": "98211bf2-4980-411a-9613-b871af51a90e", "comment": "Malware payload (MarsStealer)", "value": "f36c198674bf407f576632eec261c78ceacde3532efaba78567e4c8a2850c499", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347477, "uuid": "6b3cb20f-7f58-46f3-8ce0-ecfb4c31e57d", "comment": "Malware payload (MarsStealer)", "value": "02d2a55142f9ee4ee7fb9e8c70fbe55b258b40c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696347477, "uuid": "17bd3786-3055-4d16-8e38-40f4c91ea020", "comment": "Malware payload (MarsStealer)", "value": "33318007daa1f01de308c6aa0a9f0bef1a120868bc8ac552f48f96733881d49b8988ce482da5f208a1c043d343d82960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MarsStealer", "colour": "#DDEC50", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347477, "uuid": "746f3413-478c-47d3-beed-4f797191b50d", "value": "T10854AF1273D0AC21D5625B319D39C5E53B2EFCA19E6963DB33683F2B58701E1DA62B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347477, "uuid": "95b99aad-62e9-4dec-abf0-8d362bba6116", "value": "775c7d434cffd499e537a34db4132a29", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347477, "uuid": "e2f55900-0d94-4942-b374-46d0c3f8a8d4", "value": "3072:VqdkPSvT6Tax9l51+vtbe9RrM38FdtYBiDnMS2NY:Edkav2Tax9fhMMFHCiIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696347477, "uuid": "dc47c56f-ff8a-4811-be39-85fc07287f48", "value": 303104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696347477, "uuid": "d2585aa9-b5ad-47e9-be6a-4e1176a8e44e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696347477, "uuid": "f5e4c41a-5e11-4702-ab68-8cbeda29b24f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff09a74c-6231-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AsyncRAT)", "timestamp": 1696367736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367736, "uuid": "d4fd5eb7-7404-4e3a-a8cf-7c9d8fe73d51", "comment": "Malware payload (AsyncRAT)", "value": "0073b8280dd14ba37fc71bbe9f3e3dbb", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367736, "uuid": "70cc1939-fe36-4314-8946-ec8a47f23733", "comment": "Malware payload (AsyncRAT)", "value": "f3bb7c06974dec76f51522f0df50cb74a44f797949857e073b761541a2d3fe28", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367736, "uuid": "a4554843-2458-4f2d-8bd5-ac383b73bb05", "comment": "Malware payload (AsyncRAT)", "value": "0e06f4f88c4b1ee308356487cef148f4088e6144", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696367736, "uuid": "166cbcbd-e575-4ce1-b72e-3ea018a462e5", "comment": "Malware payload (AsyncRAT)", "value": "0152448bc6ce3ccd0eb6a56320aa61d5b749eb0e587028c6d24f6965efba75a98efd1f22ad417215ee7c3391128f86c9", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367736, "uuid": "d86ba76c-1ce5-45ba-aa57-950202e95f29", "value": "T11CF344CFC03F8F6916C6955B2DDFF1C046A863E788D8A3A9C997F896108DC29191F1D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367736, "uuid": "e9d6764b-190a-45d2-8db3-658b73a6e037", "value": "1536:TqdqdqdqdqdqdqdqdqdqdqdqGFFFFFFFFFFFOqdqdqdqdqdqdqdqdqdqdqdqGFFi:W6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696367736, "uuid": "bed3fb8e-235e-4132-96ad-e71b5d2aba27", "value": 162511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696367736, "uuid": "d34c8f85-1de9-4828-82f5-73b674955f02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696367736, "uuid": "7b7d94b2-e2d9-44ee-97f0-3d2670eb8c9d", "value": "Details_sep29.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4e209b-6220-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696360051, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360051, "uuid": "173814b8-20bc-4d70-86f6-170f7787d56a", "comment": "Malware payload (Formbook)", "value": "5b4cde02e2552a6c3d5f4c96e61a9e4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360051, "uuid": "f9aafdba-1743-44f1-9f6c-6faf8919e766", "comment": "Malware payload (Formbook)", "value": "f3c99b21d43e967be5b3e53e70050b9d6dce181fe5415f9825b512850ecb0b52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360051, "uuid": "59769bc2-8248-40d0-9fe7-06753fcdb03e", "comment": "Malware payload (Formbook)", "value": "8f74a53719a6b2bc596807f1edf53d98109c4a86", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696360051, "uuid": "3cb543dc-3f99-43ec-bb64-3a395b684a2b", "comment": "Malware payload (Formbook)", "value": "96e72126549c4a5dfb7fd2e4f64077bfb436c22c01828200c804dbf788e6462367ceebcdd28716769fd5258e4e9adfa0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360051, "uuid": "93fb2cf9-d76b-4a62-aa46-c95d3ce5f370", "value": "T1ED64126472B4D8B3ED636E715A3F0D7216A8BC39A4B0571B13C3BB157227672CA1E2D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360051, "uuid": "59387b3b-b77c-4ead-a46c-4e524b50fa5c", "value": "9dda1a1d1f8a1d13ae0297b47046b26e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360051, "uuid": "4a513d4c-1a47-4bb7-b27b-f511fa115b95", "value": "6144:LnPdudwDzsIduV5l234RUyxsM/TxFmrmBHzL7jbsTFv2ys15HguJPm8idQQrS:LnPdvsIwV5BUySCxhzL7jbsTwnLHgVdM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696360051, "uuid": "ddcd6408-510c-47ad-bfef-03bb6126676f", "value": 317088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696360051, "uuid": "5b24524a-8cf1-424f-bc19-2b8e935cb574", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696360051, "uuid": "e942bea5-b0a3-4ab0-a09b-05eecac7834f", "value": "5b4cde02e2552a6c3d5f4c96e61a9e4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "059184ea-61d9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RemcosRAT)", "timestamp": 1696329522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329522, "uuid": "d2c372c5-f3b1-4529-9641-6fbf1576943e", "comment": "Malware payload (RemcosRAT)", "value": "c7607cc0873da44ef1aa8b9982de0e28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329522, "uuid": "e9575928-bd90-4bb1-b631-595593958cfd", "comment": "Malware payload (RemcosRAT)", "value": "f4c3fd0e00326b94391240d6f460ef2501f5985e6e09d3e2e4728441c91417e2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329522, "uuid": "0bd3c193-d3ba-47a1-bf5d-2e108bc6a0bc", "comment": "Malware payload (RemcosRAT)", "value": "262fcead2cc63dc85138611352ced74ac0524de5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696329522, "uuid": "7919e03d-a151-4652-a98f-f7fd2c9baa81", "comment": "Malware payload (RemcosRAT)", "value": "2d3e8a42891bbbd344fcd5c5a6619fc6f75db0549adbd35f5e59b12d0312ad55234ec6986cf84b69767aa157e52e2d97", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329522, "uuid": "cb52d1eb-12b4-4731-855f-008fa984b219", "value": "T118250160E6BACDAED4350ABC503056110DB7AFCA0B12EBCC581D7DBDA830703A799937", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329522, "uuid": "1388516b-499e-43c3-882d-e0c827db77f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329522, "uuid": "b6d9bce2-dbed-4e4e-8023-a173ebd4914b", "value": "24576:Md7Ax5uP1ob3JxM2BDJBNjvI21CAzkQCq9uLtVEYI7Pel+A725enXFM:2MxA1YxM2xtI2AKLCq+VEYI6ljRXm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696329522, "uuid": "6dec2b49-23f9-4ff6-b30f-2345bb7aa9d4", "value": 988160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696329522, "uuid": "c8474af7-1108-47f2-9783-76dbcee656d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696329522, "uuid": "6247e557-d02f-4d24-a77b-b012770b8758", "value": "SecuriteInfo.com.Win32.PWSX-gen.25481.5305", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ebc4a04-61d7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696328705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328705, "uuid": "dda5e644-e9ba-4355-a99c-fd48905d3f03", "comment": "Malware payload (Mirai)", "value": "5819a9b0a64984fd3a78dfe24dd06985", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328705, "uuid": "feefaba2-3db0-497c-b263-1a7db8e6e514", "comment": "Malware payload (Mirai)", "value": "f4dd8c624f4f084652442239e600327c93ce4dcfe5661db71487b5b891cc1031", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328705, "uuid": "9a589533-9d84-46ef-8ec7-a21182e46b67", "comment": "Malware payload (Mirai)", "value": "6c4304bfc3729b6292c9a1cf3aade666bc42117d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696328705, "uuid": "32cf2cfe-b86a-4d92-a291-190a15e29bf9", "comment": "Malware payload (Mirai)", "value": "9ee610006b07a85a132c4c01d0831d311c062b1c918e7873094fd33b972cada60ec257753c0c3fa7897971628feeb0a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328705, "uuid": "0b4e01a3-914e-454c-8151-177081076811", "value": "T115B2C0D4CA91534BC1B078B1E13C8B516A3B55B0D9F738262324D6BDDA9289633FC9CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328705, "uuid": "3bbd72ec-6014-415a-b56a-e0ddc6615d45", "value": "768:WHKQFH0rs3zWoDDRsjt7LB9U+BTPyTQ3UQen7z:uK7rs3Kktsjt7IWyee7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696328705, "uuid": "865cdefc-0101-49ec-9d3b-2dfd9d614acf", "value": 24672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696328705, "uuid": "2629d3ac-1bf3-4f4b-ac0e-ff5d30ce71f4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696328705, "uuid": "714a6462-7c9f-40e7-b6c5-152ad7924648", "value": "5819a9b0a64984fd3a78dfe24dd06985", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92e12515-61e9-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696336631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336631, "uuid": "4cf3f766-eb09-4fa5-a9c4-0b8527e1b881", "comment": "Malware payload", "value": "26bf4b81aaeaba6fd0237865e8b197d6", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336631, "uuid": "a8f5aef5-4613-4234-af39-61daaeb84480", "comment": "Malware payload", "value": "f579355b0b0830443bb74cac19001c988effcdce8b08c974bb3b0ed1c9843b3d", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336631, "uuid": "f64d61ec-13b3-4c93-bdcd-bab47959e1e0", "comment": "Malware payload", "value": "64f5c71a6e0b50266aa6e878d8077787154c8013", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336631, "uuid": "6827ea97-1bb9-468b-9359-14fae8484d97", "comment": "Malware payload", "value": "b3e8f069810fe153ea44a088a14575561825b977010bf676fd4a7367cd7899dede1d3a5edbbb8bade2034b716220f19f", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336631, "uuid": "18969250-fe75-4254-8343-a34802f85b24", "value": "T15BB4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336631, "uuid": "3e87d165-9f85-48c1-97db-e79f64049056", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336631, "uuid": "86aca2d3-d952-4395-8309-1b1eba05bfd2", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336631, "uuid": "f2a3059d-63a1-4009-bade-bb135a42eef8", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336631, "uuid": "a9b940c4-69e1-4cc1-8f9c-d74768de572a", "value": "AppleApp(85).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f168d8a1-61e7-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696335931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335931, "uuid": "3a79cb10-98a0-427a-9209-e69d2fff8ff5", "comment": "Malware payload (Stealc)", "value": "1ea10b9fa4fba01caf0cc5c7fd27cf62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335931, "uuid": "0ff5a83b-4dd2-4be5-99d0-0cd94db3072a", "comment": "Malware payload (Stealc)", "value": "f6559e9de5695802ff471ea1769587e6f93aa9a3c1e29451b4b304886ca8489a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335931, "uuid": "08c0b3d4-0c7e-4b43-be6b-d03b27c1a09e", "comment": "Malware payload (Stealc)", "value": "07d2db54a92bc6f15316c60989af5ead8d3b9db9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696335931, "uuid": "3d8b787d-79d2-4e4e-9341-843c639c73e0", "comment": "Malware payload (Stealc)", "value": "ef88384ef3c0a40d9f92aa6cd171b14c6c635d8803a0d9837b4c397007bb0912aae5688d28f879878e838e565c8c1e1c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335931, "uuid": "44593bed-8e47-44b5-85d5-debbd5729dea", "value": "T171549E137790BC61E4A25A324D3DC6E53B2EFCA19E6953EB33583F2B59701E18672702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335931, "uuid": "b8f01e1c-b8c5-4052-a24d-e46bda37627e", "value": "e9df9444a99e49eb51fccc88bae85d1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335931, "uuid": "24219ca1-e56d-47d1-bd13-9c2b4f89ebdb", "value": "3072:G2hQqSvx/Ja8lVskJSJvQ1YpVpt8W5gLPgG2IA6wVkNVS:jhQ/vtJa8lqcMp6igLIG2VPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696335931, "uuid": "baa5eec5-0947-4ca6-b0f3-3fc0915a311b", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696335931, "uuid": "07111585-f49b-4320-82f3-a10724f3f383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696335931, "uuid": "ed8e4bb5-8a46-474e-8eb8-789c3681f54a", "value": "1ea10b9fa4fba01caf0cc5c7fd27cf62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30e3dfc-61d3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696327209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327209, "uuid": "e0d7ea3b-d3f3-4999-9e83-c22a17049117", "comment": "Malware payload (Mirai)", "value": "e0fb31c6fcb620d94da65c677da8cfd7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327209, "uuid": "605b66b4-8fd8-47ac-814b-a0cac48758e4", "comment": "Malware payload (Mirai)", "value": "f666a1e39dd7880853af16c4a0288067af4896deaa4854dc1361f28250c25128", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327209, "uuid": "69a8308f-ab13-4b7b-9538-55ebe89be4d2", "comment": "Malware payload (Mirai)", "value": "2a917f008d9a8d5a26879fd8f383e56b7f25a115", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696327209, "uuid": "a937766c-4540-49ab-87d5-54c2701d74b1", "comment": "Malware payload (Mirai)", "value": "8b736473304be6d209fe8371d41f9463f0c01088208016d90a4965d5a145dcc4d2d300f34a50cb5f280781c0606d98f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327209, "uuid": "79fcb1fa-ab52-465a-81cb-8b950a3721d2", "value": "T1EAD2E170D6E91CB6C2540AB2E67866C4BE464F3DEAFA384011008BFB3942D5539EE9C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327209, "uuid": "b1119017-378b-4729-a615-b9b9b39d9ba3", "value": "384:gSt/koxisa34beDtZwuaCBsk+G9lLSsLYSTFs9u8OtqlrNENwJJvFJ4FmdGU5eTU:gSsoTAZ3alkXLvFh8nNEL3UQeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696327209, "uuid": "a5bb65b5-f08b-4725-9775-a695182a1956", "value": 28312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696327209, "uuid": "f10bd0d7-0233-4a3d-a6e7-0624df6c96f5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696327209, "uuid": "fce43c46-29ce-4811-ac08-851cdfbf4ce0", "value": "syms.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94d3944f-6181-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696291967, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291967, "uuid": "f064a823-4250-4356-b203-f6084627dd5f", "comment": "Malware payload (Mirai)", "value": "a39df86343d4fc3ef1c3942c4b7c0d59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291967, "uuid": "52194c23-0ba2-49b2-b11b-df2807af6d96", "comment": "Malware payload (Mirai)", "value": "f740e8971e738d844acf386f24d1c36dc63e0d534df6f2110b80d753e0cca9de", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291967, "uuid": "ce4d5c0d-c311-4fdb-88fe-dba1a5e0051e", "comment": "Malware payload (Mirai)", "value": "ee8e8947f8d0f550f9ebac6c0346c30317a0032e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696291967, "uuid": "499216c0-032f-41c9-a26c-fd5471bf208b", "comment": "Malware payload (Mirai)", "value": "b5f66cef1318a3464d787f16cd38b7dfa4620440382474d93c53d2460ed6e0da3b448cbafa556e8061c54cee49b36cb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291967, "uuid": "0b700762-54f4-4229-a631-aba011bdf0c7", "value": "T1D9D2E1487AD363FA8CC9D97EB61E4039309A74A9A6B29373B305D5530736180F651E8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291967, "uuid": "bc45781d-86d5-45fc-b6d1-2a2afcde64db", "value": "384:MSd/PxEDLd2TwMWzB6lowYcEaqs+9OC450LQixBfE4jdlz0lewZ90BKuFXLuEQN7:llxKd29WcxEns+V6IHE4RlY990vjlQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696291967, "uuid": "5eef5df6-a951-428a-a48a-0e3178b9bcc1", "value": 29456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696291967, "uuid": "ae67d259-d7c8-4691-9c15-1223ac20b3a9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696291967, "uuid": "c846ecd8-3a51-40fc-8d22-928f1a77f38c", "value": "a39df86343d4fc3ef1c3942c4b7c0d59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbfbee4c-6187-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696294636, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294636, "uuid": "3ea991b2-3f3a-497e-8a6c-ba8fb0ea59fc", "comment": "Malware payload (Mirai)", "value": "fe292161e220af4136d8c935613ca3b6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294636, "uuid": "57229507-24b6-4c27-8fd3-97fdecee73cf", "comment": "Malware payload (Mirai)", "value": "f915e2db9fa7cc1327c53cac285afb93d088946f763149fe587cba1e9ad69d6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294636, "uuid": "77aca07d-9088-4abe-81ad-d0742aad4190", "comment": "Malware payload (Mirai)", "value": "3b93bebee3ebce6e00f95e6023e28c808f430aee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294636, "uuid": "5cda70ea-a2d2-4f6d-a24c-db525e726f27", "comment": "Malware payload (Mirai)", "value": "776115a55fe09ce814faa1495e1bcac7720860d4e54b69f93c7ff1a8aa02615286cad3a17d4a17346c85b1c2bfa167ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294636, "uuid": "23a6ad5b-8118-465d-a992-5b3f279a30d3", "value": "T1D363AEB2D4196E5DC4A64170A128CBBA1BB3D0C452972FFA0B9BC6799407FECB505FE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294636, "uuid": "91dc3340-c860-43ba-b0f5-7a05d4a4d019", "value": "1536:TuELCwtDckQpCdvVw1D7w0S0KhQfwurZtC8oH/kmgR:TuEmJxpCc1D7w17hwrZtY/kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696294636, "uuid": "daaa469f-6a59-45b0-847b-bd08335b5897", "value": 71008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696294636, "uuid": "af04bb6d-7d88-4f15-a876-acc75671a9c4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294636, "uuid": "849e6bea-f219-4fef-a998-301b3f80e7c5", "value": "fe292161e220af4136d8c935613ca3b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f38ecaf-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696374340, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374340, "uuid": "d94e7124-faa8-4a8a-b014-50b2ee8acf40", "comment": "Malware payload", "value": "1d54c5ec3d4d7179431cea6e35aacbce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374340, "uuid": "0f8ed585-d66b-4a0a-9ced-c32033a00dc2", "comment": "Malware payload", "value": "fa1ebd95edd401d7929fff642b5c060cc2967c31feb3b36ceb6501e74e494867", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374340, "uuid": "a13dd5ae-5822-4fd8-8bf6-f4d1f7192547", "comment": "Malware payload", "value": "e358a56a854642dc049f673ebab11bd62a3458e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374340, "uuid": "dccf1e8f-cf61-42d8-8fae-42563a65c558", "comment": "Malware payload", "value": "3d5aa85b83a33bb4ba712ef410b9280e5a5a3b4811e524a3ec2d869a1344e41d56bd0ad82346bbe29fd5f3a8cebb5d28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374340, "uuid": "6033901b-b107-4513-9002-058f19d82096", "value": "T13273C709BF651FFBE8AFCC3749A91B0528CC551B22A83B757A34D818F64B64F05E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374340, "uuid": "c34a2521-6520-4739-897e-e279926f99bf", "value": "1536:d9s6IWScAMbTHHSaroKrQXR6Xr7ZuL1cxMTadqPRBN:dqAScAMbTHi3XVT6q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374340, "uuid": "9e9b65bd-e020-4418-bdd3-d031341f66eb", "value": 76044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374340, "uuid": "47129b82-967b-4092-b463-bb2596705116", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374340, "uuid": "fc0e3a02-e87a-4bd7-b092-fb643e1595b7", "value": "1d54c5ec3d4d7179431cea6e35aacbce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0e81de-6187-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696294633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294633, "uuid": "bbae32a9-967f-428e-836e-44a6bd1c3716", "comment": "Malware payload (Mirai)", "value": "28ae328bb8686f3a9382fbc6833a85a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294633, "uuid": "9bbc0c15-6513-47c7-b731-88343787ed18", "comment": "Malware payload (Mirai)", "value": "fa578cad74b2765ca9b5719cdc93e2e9299655d4d1b548348aadd605819e7296", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294633, "uuid": "8d9a7ca8-24a4-48ed-839f-da28c37bf465", "comment": "Malware payload (Mirai)", "value": "2b9cc75062450f0fdc3ff795d59d5d75ecb0e1b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696294633, "uuid": "8b15fc2d-500e-41ce-9065-c1dc5fea4535", "comment": "Malware payload (Mirai)", "value": "e18d60481bd5cf4acbec623577aa2b92891930c3d49a396c667c5d03597e0bbd09e11f126cc66340e606b73652b40d62", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294633, "uuid": "e308a0dd-4d26-4e84-a92b-ce90561c2e37", "value": "T1AC72E0C1E6E56099E348CEBB1A930EACDA424D07A2C3332BCF5D5C86740D5AAF18B5D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294633, "uuid": "c13b160f-f13d-4afc-8162-c10041482467", "value": "384:u6vjdwib368jtc50hwhJSCS9IHxj2hYagnBOcLvBb2EjsS:u6vZwib36gtc53iCAIHaYagnUW5bNsS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696294633, "uuid": "f77274d2-3e35-4401-98f3-e6081082dd3f", "value": 16980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696294633, "uuid": "5bf5785c-7f92-4b0b-912f-3350382da007", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696294633, "uuid": "7dadb902-b42d-4eea-90d5-7b73aae9e5bf", "value": "28ae328bb8686f3a9382fbc6833a85a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2e4bcc-61f9-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Formbook)", "timestamp": 1696343571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343571, "uuid": "707e60ab-0a70-4943-986e-409483b46bc6", "comment": "Malware payload (Formbook)", "value": "80af84261f1dc5ca1276251b85a70c96", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343571, "uuid": "8250f7f8-1c50-499d-bb24-6be16ba4749f", "comment": "Malware payload (Formbook)", "value": "fb1850a9de283511c3d8cf8c54f2ac8f482281a393c3d25ef37c22e47aa295c5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343571, "uuid": "3ddb0581-0c9d-439e-a86e-d46bc1ea9c3d", "comment": "Malware payload (Formbook)", "value": "546c130abe4994a90aaeb084618cfc3f9d6724de", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696343571, "uuid": "6cc0ff37-cb78-4f54-9e6e-129596e411a2", "comment": "Malware payload (Formbook)", "value": "256e9bcecf478235b1e578382d5dad4474291b73c741d4cb16ee3c700a6252c77035ec766ad224b64eb8c6cd6c938332", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343571, "uuid": "ffac17a8-50ee-40d0-8823-cc065998ee29", "value": "T13ED4239BFF89F43D89A76B8418E74B5220C4C207379E17E0CEE9A4C25F50E95B29584F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343571, "uuid": "ff7f71f6-6dc5-4430-80d8-95c9ddd012a1", "value": "12288:lZm6QDMWg9eegWPUIHmNrpSfgGtB0DjU++UWaF5N/Fi5xsv2Mf5/SXt6rU:yPwWg9eegbIHmNV8gGIjV+UxN/Fm27o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696343571, "uuid": "fe9d0d26-4390-4d7a-b786-f1297c7df498", "value": 602350, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696343571, "uuid": "fb18e1d5-4d14-43b9-a15c-f839ee1684b6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696343571, "uuid": "53605cf7-d881-49e3-b28c-7812c0408058", "value": "Invoice 2796.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbeb28a6-61ad-11ee-a6f9-42010a9c0055", "comment": "Malware payload (DarkGate)", "timestamp": 1696310957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310957, "uuid": "9ec212e4-70b7-40f4-ac99-a8b69434e2c5", "comment": "Malware payload (DarkGate)", "value": "85af9054d4e9448ca48a8be7a3d14a89", "object_relation": "md5", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310957, "uuid": "b81a372b-0497-43c6-8123-bc58c3896d56", "comment": "Malware payload (DarkGate)", "value": "fb905585e47222ccebca0a0669ffcd63a29092269c6d90886a79bd018cf7da34", "object_relation": "sha256", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310957, "uuid": "922cc203-17ef-471f-8f9f-264045b7d15d", "comment": "Malware payload (DarkGate)", "value": "d35ae5a45a606cc70fcff36b88af01e9f4e699bf", "object_relation": "sha1", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696310957, "uuid": "d90c827a-1f40-4cfa-a91a-f704ce43706d", "comment": "Malware payload (DarkGate)", "value": "c945854416fcc6e5aaebcdc557016bbf796f040e440036bd836029718de15d503cf569abe91d7b038d148dfa4f2af2ab", "object_relation": "sha3-384", "Tag": [ { "name": "au3", "colour": "#BF8C9E", "exportable": true, "hide_tag": false }, { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310957, "uuid": "9535fc92-5116-433f-9428-ec7daa26da97", "value": "T1CF05C04ECB288006485D0DB11EB80D9E9B5411C644F3FC6AA738E866FB6577B81E73BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310957, "uuid": "dd1c0efe-aabe-43b2-ad99-8943ab020d4e", "value": "24576:T3jcFard0oQg2tTwBLyQx6BV0W1XGVPPPPP4D7c/urnsO4HbuU5r:TwFaZ0T79sLvEBV0cXGVPPPPP4D7c/u6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696310957, "uuid": "ef46acd9-744b-49a8-bb72-7fbdbca63378", "value": 795147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696310957, "uuid": "5f6ee780-f9ff-4705-a4ed-de42f69c1855", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696310957, "uuid": "7eb8817f-7e6d-481a-add4-6d4ce2a5e91a", "value": "vvuvrp.au3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "302e2a61-61b4-11ee-a6f9-42010a9c0055", "comment": "Malware payload (AgentTesla)", "timestamp": 1696313702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313702, "uuid": "63c4bcb8-27fd-4ad9-a4fa-24bc420036bd", "comment": "Malware payload (AgentTesla)", "value": "003ec7cf3274b6fb4df159bb82c9272d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313702, "uuid": "45f1e771-4174-483e-9f40-cf571af64f08", "comment": "Malware payload (AgentTesla)", "value": "fc3abaedd390a09669bbda0d333a7a2a1f2e9087bf293f44e25f879b2add32f7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313702, "uuid": "5c86c625-f640-4559-a941-ed5523a21a95", "comment": "Malware payload (AgentTesla)", "value": "48b84d3f788d4f2bea7e6372209631e87f0c79d5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696313702, "uuid": "1515b9dd-c6be-457a-aa4e-8a01e73b8be3", "comment": "Malware payload (AgentTesla)", "value": "16ce5da5095142f8c511ff280d98a1d95b6bcb96f9c22a05160f36cfa8c55b3638beb31f157ed5b04d2d87d78948bb7d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313702, "uuid": "07ee7a5d-8991-4ac3-88d2-8e94ccc9defe", "value": "T141D423A8F507497ED73824B6FF05B718066F7051A04B0E8B22E2BA5D18BB5E0B75B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313702, "uuid": "f0dfff6d-6031-4858-b7cf-ba8e583e548d", "value": "12288:3xnWRMevBxT00vkp71tPcBEkRSVz6jmI2DyDmGs/3LIFXehOjTtM:BbevBxAgkpzpkOz6jmIVZs/3wdTW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696313702, "uuid": "e3fe160f-9f90-475c-97b5-1d856366d099", "value": 657043, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696313702, "uuid": "4b2e9ba0-7fdd-441e-b74a-5d95c261a844", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696313702, "uuid": "6ce65356-4b53-429f-8df7-569af0013350", "value": "OC 7068 Change of Bank Details.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a3061d6-6241-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696374358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374358, "uuid": "8c86946a-a9f2-4397-b65d-bb43e08bfece", "comment": "Malware payload", "value": "c4ec7ee23b5d74de93ab437ea5325e44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374358, "uuid": "925286ee-ffbd-4134-9988-36d7cb131686", "comment": "Malware payload", "value": "fc5ec3a6e43c64e98872cd9e0103e902b0407f151c7c262cf0302f2b4253d57a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374358, "uuid": "56e4172d-2a18-47d5-b9f0-11fed2a7ddb7", "comment": "Malware payload", "value": "d8c1ef6aea043c0e54ec13189a199077db952029", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696374358, "uuid": "afc1acc2-c03a-473c-b915-87cfb295dec9", "comment": "Malware payload", "value": "e79ea54b64e0007009a44723e35082b80e306c98bd17180a1b5dd5801eba1daf68df9dedab617c10313f62296e2c5005", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374358, "uuid": "2320117c-bab3-400b-ab28-8d2920e26c75", "value": "T12A63B61E3E21CFADF7AD82358BB79E219748379636E0C184E59CE9011E7030D645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374358, "uuid": "80c7ccf5-d3c4-4f04-945c-07f2b87aa1f1", "value": "1536:u4sXjUwSK9wcPqOfDRaH3mu9UvhwLDxs6RjTE0If/:oXjvSKxDC3oKL+6RjTELf/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696374358, "uuid": "702bb6a2-c8d8-49a7-abd6-5ab08c7f9a42", "value": 73036, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696374358, "uuid": "ce3c1f6c-b34c-46e4-96e2-66d8cc5c533f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696374358, "uuid": "a52fc812-7f68-4b32-ae78-d65d2c72cd0f", "value": "c4ec7ee23b5d74de93ab437ea5325e44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09e1c3b1-61ea-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Tofsee)", "timestamp": 1696336831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336831, "uuid": "357f482b-8264-4f52-9301-462932419aba", "comment": "Malware payload (Tofsee)", "value": "fee05355f11b9b0eea6e57b881610c22", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336831, "uuid": "e19c0555-b276-4e64-9445-ab6e17162ee8", "comment": "Malware payload (Tofsee)", "value": "fd8e20c61722f3e5f4cda45cb1e29034ea9837d51183732bcae74e4f3eb38826", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336831, "uuid": "3221e4a6-0a61-44e6-a4d8-a74513e30702", "comment": "Malware payload (Tofsee)", "value": "e25f55fd78494c71a6105cd8ac75240b376793de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696336831, "uuid": "e54ff736-0ed2-4641-a7f8-30892512b5f0", "comment": "Malware payload (Tofsee)", "value": "d0c0c9a78798093fbdf032541048c9192040b86382cbd82fef91ac4a434cf2452b31e09eca8b73f97b387432928ce52a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336831, "uuid": "62ac3e79-3c29-44e7-87cb-0937b533eff4", "value": "T15754AF1277D0AC31D0625A319D39C6E53B6EFCA19E6963AB33587F3B48701E19662F03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336831, "uuid": "3b6ad2db-78d9-4803-bf20-17131fe18337", "value": "5db9811e467f5108fd02395919c766d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336831, "uuid": "6619d62e-1a2c-454a-849c-b83fe5959a14", "value": "3072:gK6G+2mvrkdatQbMc8a8dqN6ZlfWuYZLcVCnM/0ELNtY:gXG+XvAdatQb58dH/HYZouMsEx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696336831, "uuid": "410c9d4e-aae7-43df-ae2c-fafacaa3149c", "value": 302080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696336831, "uuid": "2f3da57d-1ee5-411b-af35-165d9da577f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696336831, "uuid": "29c5c900-3509-4a9a-aadb-cda5368a0ff1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "796e886c-61ed-11ee-a6f9-42010a9c0055", "comment": "Malware payload", "timestamp": 1696338306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338306, "uuid": "ba783dfd-d320-4a86-9307-24c04a9a59f0", "comment": "Malware payload", "value": "55a108f7ff4f5e5866516fa41ad36baf", "object_relation": "md5", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338306, "uuid": "4a9dba05-9acb-453d-b425-afa229d6c378", "comment": "Malware payload", "value": "fdc3bdc0e5f05706c3a2aa4787165ebccdfaf210d545ff6a341bd1fd95e7fa04", "object_relation": "sha256", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338306, "uuid": "270b6691-9b1b-4595-84d1-aec6cec88502", "comment": "Malware payload", "value": "42651584cd37679bce1d4b9158d3acd4df76d41a", "object_relation": "sha1", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696338306, "uuid": "d69dbdd5-44ca-4a23-84e6-43ac6e4c7bb9", "comment": "Malware payload", "value": "961763c4088d01c9a3689f79f8f657d3b26e97f7adb6d1e6850d71c4a5f3e7d79becc67e9c718c796c4a4c34b03a8557", "object_relation": "sha3-384", "Tag": [ { "name": "AMOS", "colour": "#1D14E8", "exportable": true, "hide_tag": false }, { "name": "AmosStealer", "colour": "#AF131A", "exportable": true, "hide_tag": false }, { "name": "dmg", "colour": "#DDED21", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338306, "uuid": "cae092fa-1ad8-49f6-a5bc-dbfce07fc5b3", "value": "T163B4237C993532C6DDB127B9AB5C91325CDA03F725A610F0E0B259BCCCDE709B490A9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338306, "uuid": "335f2e8d-59d4-4a37-bb3c-fcd104a363c0", "value": "12288:WXoJfAycbXpNU0bamorfNq4dYU1Uu65dRvwB1na+XyEfrWEN7wr:U9hbjtbrorFq0YUKLaXn3yhE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696338306, "uuid": "adee6227-a8c8-4b2d-a30a-713db2ea56f3", "value": 512672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696338306, "uuid": "a0909e5f-3723-4179-a84b-83875818dc8f", "value": "application/zlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696338306, "uuid": "81af66df-3ca6-409b-bdf9-9b75140866f4", "value": "AppleApp(57).dmg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e5036d-61c3-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Mirai)", "timestamp": 1696320097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320097, "uuid": "c7bbdf38-80c4-4555-8949-44f679157ced", "comment": "Malware payload (Mirai)", "value": "83b207f60f8a15325e395f9519a5e0bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320097, "uuid": "51cbefe9-f3c8-4371-9eac-93b4d6485633", "comment": "Malware payload (Mirai)", "value": "fe00f9d2080d82fa1d725749b223e6feedf07d264ede6bd04b175c9e72d09301", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320097, "uuid": "3df2bbd0-60ad-45d7-9988-5642bbcf5e18", "comment": "Malware payload (Mirai)", "value": "23b58b98c8643a55c8adc4d00185b0a313e8a73c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696320097, "uuid": "c70cebca-2ff9-4792-b4fb-6953a2d037d3", "comment": "Malware payload (Mirai)", "value": "c43a9766f89d9582e3b0b98e1aa83a84cd9a625a08d6f3bf72dcd7dd734791b73ee37edaad931b268e09c9f550b8d1b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320097, "uuid": "c196861f-609b-4992-b40f-6910993c5258", "value": "T14D53AEA5C699AE5CCA5044B4B604CC398723E009A5E73EF6D546CB9A900BFFCF054BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320097, "uuid": "c55ac5c3-b671-416e-befb-17e12818acbd", "value": "1536:CapBdlL3/G62kkeao2bo7ofs3MA5+/+kreGC6:C6BdF3e6FrjMf+MW+2kreG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696320097, "uuid": "b10d630b-f3b4-4cef-b605-ed8f5e266082", "value": 64168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696320097, "uuid": "fd9b9fda-132e-4d6f-a08a-985acafe46a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696320097, "uuid": "80f110a0-e2b4-4969-881c-57562231bbd5", "value": "83b207f60f8a15325e395f9519a5e0bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad68685-6193-11ee-a6f9-42010a9c0055", "comment": "Malware payload (RedLineStealer)", "timestamp": 1696299627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299627, "uuid": "dffd510e-ff99-4e7c-8ece-45076d5a4e43", "comment": "Malware payload (RedLineStealer)", "value": "a19dd4020a00254b82e2f03faef19ca7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299627, "uuid": "4a95d3ba-69d5-4e9d-9ea6-287c1ee0d7c8", "comment": "Malware payload (RedLineStealer)", "value": "fe30bca8421df9bad34caf365ea2404eae423d82f14d626436e426cc313dde15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299627, "uuid": "d30f80a9-ad03-4531-82b7-b5bb57a38699", "comment": "Malware payload (RedLineStealer)", "value": "58682ea9294381ca43200cd5b1479fd59f18287f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696299627, "uuid": "fd6d8614-6fb2-48c2-bc95-310ce0a267d9", "comment": "Malware payload (RedLineStealer)", "value": "e2256e55e36a8ebf69ad270fea5664f35c2195c42a53ecd47ca9085fc660791e42296ca5d6559e917c66e49d658ad878", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299627, "uuid": "9b426eb2-ebe9-4e12-bd72-bb5aad9c8b8a", "value": "T14104AE1279C3C4B3D567D53108B0E6B55A7EF8300F255EAB339817BE0F645C3AA22A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299627, "uuid": "0dd201c9-75f6-4f90-80db-b1be99f0bde5", "value": "f206bf4934412e0139dfd76edfc7dab0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299627, "uuid": "e309d5f5-f602-4c61-94ae-82c88e024353", "value": "3072:VqNvi3shUKee5ivyM2Em+Nay4V1ERc6g3DTgcXo9D9qhZ0I/ygW:GUHvyIm+NQVSRcz49D9qhZbyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696299627, "uuid": "9a39c35b-24e9-4875-9174-474806ef9e4a", "value": 179712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696299627, "uuid": "2000d33e-161b-4bb5-bb3a-0e4397d32437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696299627, "uuid": "fdf1057d-bbda-4f03-a088-49f5dc8c97a4", "value": "a19dd4020a00254b82e2f03faef19ca7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e4c717-61a2-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Gozi)", "timestamp": 1696306061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306061, "uuid": "3cf2bbf4-bad7-49a4-9fa4-83a3e8080490", "comment": "Malware payload (Gozi)", "value": "d65a89d1e17f4062addad5a8a2a49742", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306061, "uuid": "03ab053b-71fb-4c81-9275-940ce0b53b99", "comment": "Malware payload (Gozi)", "value": "fe321c7dffa233a79666f957dd6a03dfcdbaac418eb2b17a1e2edd4766bd55a0", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306061, "uuid": "e045ff53-e646-4e8a-bb67-688ff9f84a51", "comment": "Malware payload (Gozi)", "value": "23d21346fc25ef074d4195c5e895deacdbe8800f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696306061, "uuid": "3f920598-fe8a-49d3-aaf5-0428090274ea", "comment": "Malware payload (Gozi)", "value": "03b7f1d98f9503a12b82e2a8dcee28bd341960ef869b51652e6cf04efd5eefeb9c5690ad8527c967131cdd1c6b73ccfb", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false }, { "name": "Ursnif", "colour": "#09785F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306061, "uuid": "e390bc23-111a-4912-966f-55a1b4b49a8c", "value": "T18AC022184E4DC162D002580A8058FC88AC0EB0442CE7E8981280DA8B9C810D4DE09ABB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306061, "uuid": "9bca044c-d040-4c1e-bdf9-bcd5e7ed5860", "value": "3:HRAbABGQEb/5sQaOUlQ25l1M7ovQvycAI9RyJ25YdimVVG/VClAWHn:HRYFJb/5sZOGzwovQvyc1yc54vVG/4xH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696306061, "uuid": "e4e1a033-e075-4d54-81df-109d4abe7d43", "value": 192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696306061, "uuid": "0f18ea03-a977-40ed-be40-935b66f1c293", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696306061, "uuid": "828ea443-e946-4452-bc15-d9b72125c1dd", "value": "Cliente.url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c48fed74-6181-11ee-a6f9-42010a9c0055", "comment": "Malware payload (Stealc)", "timestamp": 1696292047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1696292047, "uuid": "26841df0-de68-4e87-8b21-5c17ce7e4a07", "comment": "Malware payload (Stealc)", "value": "a9e99032f074ac68c3e7c0dc49534382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1696292047, "uuid": "0ed37d82-eca2-44cb-83de-c29a6fa5c599", "comment": "Malware payload (Stealc)", "value": "ff0bbfd33c3d090959b03d01a89022338d9cde31fee401b531a59d95ebfe931b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1696292047, "uuid": "d5179d3f-be52-4f45-96d5-18e2bca30fb9", "comment": "Malware payload (Stealc)", "value": "2480aa49fa02da01bd46d49759a1d946635b3189", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1696292047, "uuid": "502cc2e1-9d43-4862-850a-d74a073aeb11", "comment": "Malware payload (Stealc)", "value": "234a007f403bd4789089d07654f072d6f929518f9b5c66e861bf1b7f14d9d08d4276f35dfce6ebc0416e75d4a934936c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1696292047, "uuid": "39dcd128-50d1-42a5-a2b1-096fb5878217", "value": "T1E834D0227DB5C032D5EB06752834DA956E7EB9233770859F27241AAEEF203D19B62307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1696292047, "uuid": "c5f092f4-f78b-49d6-bef7-c95524e4450a", "value": "a7960cb042304220b44306228fd698f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1696292047, "uuid": "c196804a-3570-47c7-a6d1-b54a3275773e", "value": "3072:2SzEByvpSW+n/iFtztStTPlzP1sBDmFc2pZ53DF2n/Q:N3sbn/ibp8PlrupmFrJ2n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1696292047, "uuid": "3041f8c2-a002-4600-8cbf-55fd0160f153", "value": 232448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1696292047, "uuid": "7b48c6a6-f239-4e74-a80f-558ac5cb9171", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1696292047, "uuid": "cda6cbc4-e05b-40df-9c98-be227f75e51e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }