{ "Event": { "published": true, "date": "2023-11-16", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2023-11-16", "timestamp": 1700179382, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1992069e-bba6-4b6e-b791-b535b6fbc639", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c4219c5-844b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700116943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116943, "uuid": "e2b4728d-2fc8-4fac-a4e5-d97f008a8235", "comment": "Malware payload", "value": "5e736939a00da2e3dd35a39dbb768247", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116943, "uuid": "5d0e0c82-12f3-45c9-aa79-1b8e35fbf6e5", "comment": "Malware payload", "value": "02533a17920ba664a9dfbeeb809a475743d7fcec342826d76f1c7c9b2df49149", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116943, "uuid": "e211861c-d52b-4498-8831-490b660e1914", "comment": "Malware payload", "value": "dff6bdeb8b83ad3571aa94910e3c259ee62a4946", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116943, "uuid": "ed131897-cef3-4801-87c3-a13aab32172e", "comment": "Malware payload", "value": "56bc879cacc29dec37aa9819da5d5bc5b82fd4ac37a6b02bccf8031a92d6fd44c14803a7192c6cd32fbb3420546ee76c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116943, "uuid": "0ad328d1-d213-4f22-bd26-311f0168abbe", "value": "T1CBE32A30D4504B17C2D213FAA79E825E3F221F9793DB33115B38BAB41FE279A1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116943, "uuid": "27f3be03-7b91-43b4-b280-c96333100cd5", "value": "3072:Cv/WwsLgaq353qHiCOvhOplqkDQHbeskmhxQwoVSUNu:KPLaq351hOplqkLskmhxQwoVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116943, "uuid": "21b41ba1-a877-4525-b00b-e7ba11248189", "value": 143019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116943, "uuid": "04070048-d26c-4d4f-b67c-22d6ef35f8fd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116943, "uuid": "cb3074c6-cb25-4f1c-b3a0-683c2f474646", "value": "5e736939a00da2e3dd35a39dbb768247", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb65bfab-846d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700131839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131839, "uuid": "9809e3bf-3778-44de-90ac-9516469b1907", "comment": "Malware payload", "value": "67377a06a11b274c7d823c088e6ae560", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131839, "uuid": "ba6fdcc3-1185-4e46-9700-f4bf6e9e7c30", "comment": "Malware payload", "value": "029c475d94b5febfea833a20f9b4c491cbda3ed941491a7cdeab400709d10ab2", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131839, "uuid": "3f361db8-c837-4f61-bbb9-3f955d51329e", "comment": "Malware payload", "value": "ffe11a494bd73866590472a256204e2eece0f2e1", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131839, "uuid": "82c80275-3873-4d8f-ad91-d75ca3b602df", "comment": "Malware payload", "value": "2c0555c0fd9bd453ec42c077eda3c57b78d6049195227bccd64a088f44e3e0b55355acd2506f05e90b152125fa0531b6", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131839, "uuid": "b1f462f7-662f-47aa-89a9-26f50c44a2f6", "value": "T19EB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131839, "uuid": "91493c62-aa16-4c6e-b21a-a4d8e13ca4d1", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131839, "uuid": "e23dd4b4-6cd3-49d9-818f-fe554aff8267", "value": "6144:xexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O71pUlLaEx:xeZeWSpda70ADIgSoxgUW/zFun7OnY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700131839, "uuid": "c97ea8cf-3276-4f8e-b1d3-98cbae06df2b", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700131839, "uuid": "160f1cbb-9b0b-49f6-953c-b954f85ba611", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131839, "uuid": "b4b4058d-6e96-4e18-a444-0e1002898ac4", "value": "Watchercli.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe49bff0-846d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700131844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131844, "uuid": "3530b332-312e-4b31-b117-955976013ee2", "comment": "Malware payload", "value": "0f3dbb146060c3c5e7387e23c7ff7967", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131844, "uuid": "13366327-6239-4ebd-802a-ac9f6da2eb22", "comment": "Malware payload", "value": "0352929d3512c9dac58caa18916b0e8a2b5804ebe746783b6d33954c42c770a3", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131844, "uuid": "e29c8eb9-07f6-47fd-83f6-0c1617acb9c5", "comment": "Malware payload", "value": "e122468f592bb34caad04d57a4e020936c574c8f", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131844, "uuid": "0e9c5886-6347-4641-ac10-9074ffd673fd", "comment": "Malware payload", "value": "14d10d9f651e7e89868272a6b7e88f4b8551ef823a8723a6e8b61ca650e78c32ddaf55c4ced072e330681e37d88ef6a3", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131844, "uuid": "3ecfc821-793d-4cdc-805a-c8b94d35effd", "value": "T19DB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131844, "uuid": "677881cd-3180-4147-a9f1-842bec289167", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131844, "uuid": "073011d7-1ab9-45c6-a270-9e20f62f638c", "value": "6144:SexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7DpUlLaEx:SeZeWSpda70ADIgSoxgUW/zFun7O5Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700131844, "uuid": "de494d0d-886a-437d-ad39-08de9127adab", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700131844, "uuid": "4683d996-6735-405b-a499-4e8f08b024be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131844, "uuid": "62a029cb-4230-4315-ab00-d9a2628cc533", "value": "tsnsign.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2aee8a7-8463-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700127396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127396, "uuid": "ee4ab2c0-8129-4b2f-bb85-6b3af7acd398", "comment": "Malware payload", "value": "d90b204663350be3a96a974ece378cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127396, "uuid": "9c4e9a50-dad2-46df-b70f-e620f6c8ac1f", "comment": "Malware payload", "value": "03cb060862934350fe3ec354409a8873ade75fd2481fcd2b7a60067d485b1bdd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127396, "uuid": "50a78bb2-94e5-4041-871f-ef42b5d965cc", "comment": "Malware payload", "value": "db91750e4e00a6ff3772f0adbdb9167846ddcb14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127396, "uuid": "de27b834-7c6f-4ee2-a812-35f61f9db708", "comment": "Malware payload", "value": "6ee89a8a8b2e637825fddce97fd97cdddab2a5a1cbf810a28c037b8d4aa665573f46ed188c4d0097befab43add1bc5d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127396, "uuid": "359cf806-0e98-42c3-8f65-41aac161ef56", "value": "T1807633343AE5C1BEF8E4417758E06AC6639426304F2468B7ABC9891D2F373F4C5D3A5A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127396, "uuid": "51205dcc-ba1d-436b-ab96-c3e726cbab40", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127396, "uuid": "abce8767-8173-4758-9dde-9e7346918346", "value": "196608:91O1x8NypHomKaLRrUlv2dIGgqNBfBcWQ1xGINMjMXFh:3OHxcy5EuiGgirPLjMXFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700127396, "uuid": "e42e44e6-20a3-4b36-9f39-fe0ac7cf2ee1", "value": 7519507, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700127396, "uuid": "116a53b4-396c-4a00-8515-4284ffec0d44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127396, "uuid": "4fc184c3-7dba-4af3-b8da-e6bc6e2d276c", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e0eb2b-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700116984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116984, "uuid": "41d5f9d5-c06d-4639-9e14-50b3128eed81", "comment": "Malware payload (Mirai)", "value": "58e3f524bb1c220bd988e043cded4291", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116984, "uuid": "dfaa98a5-833d-4a52-9927-f99f608a6088", "comment": "Malware payload (Mirai)", "value": "03f9578f6be9f7c7da4006b21b4757f3fe66dd9e398d5460d14255441b758303", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116984, "uuid": "afef75a6-6ad5-4b31-91f1-ef9d306c7b22", "comment": "Malware payload (Mirai)", "value": "da2f6da813c952987a5761e5014d6dceafdcf796", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116984, "uuid": "30d2eb42-77b3-4a77-81bd-72c4dba64a09", "comment": "Malware payload (Mirai)", "value": "55fde603c3c5047e54ca4742924fac1da33e39c32b9ab60eb66405ed639cd405db58c5382e02cb29dbb1b4e5e373faad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116984, "uuid": "6a99fe30-4080-44cc-ba3f-040eab490374", "value": "T140731881BC809E25C6C5177BFA6F118E331287A8E2DEB3538D145F6477CA81B0E77A49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116984, "uuid": "d54928a0-a409-4b73-8d74-c0430468c95b", "value": "1536:n1nbBGDOd8tAV9Og/b+8AYN+y/Nc5suxIw9mrsplDKZUCQBKXAVan9X+F8JyvqBw:1d3O2bfAw+sNosS79mrsplDKZUCQBKXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116984, "uuid": "b33219f9-8478-449f-8d93-9bc5126e9417", "value": 80108, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116984, "uuid": "3a746a60-3370-4ebe-abe7-c8ad7b9dbc63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116984, "uuid": "f86f3d72-6a3d-4076-ae61-f8e06e23f474", "value": "58e3f524bb1c220bd988e043cded4291", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6ed2fc-847d-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700138529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138529, "uuid": "2595db0d-a5e9-42f6-8ac8-93d1df78db2d", "comment": "Malware payload (Formbook)", "value": "d569c4642597d5b883b3ae598bcc19b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138529, "uuid": "29c446c0-0a36-4af4-b0b9-013886496349", "comment": "Malware payload (Formbook)", "value": "057157bfc3e5facd4c824784f5c0875a994218de1dba722223a12ec55022c910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138529, "uuid": "473cbbf7-5ddd-4c5a-b862-26766befc038", "comment": "Malware payload (Formbook)", "value": "7b8fa0006d9a7dc803eb1dd5c2ab2b4314942001", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138529, "uuid": "1deb2168-8f67-4830-9c31-89729306032d", "comment": "Malware payload (Formbook)", "value": "a7e05fe547739e2e1ed133361b2f487669a09390e390436df3141e2fbd09122a4aef1ff3488b0e51a65f7a157179598c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138529, "uuid": "3cb67801-67ef-47fe-8177-4a013f1a5915", "value": "T17DE412C2316A2F24E6BD9BF15972140607B9AD5B9C72E24C4DC270CE19BBF924B02B57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138529, "uuid": "98f75c8f-91c1-47a7-b567-679d0d12c8a8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138529, "uuid": "804d70b8-7a5d-4a69-8f97-cd561ca53860", "value": "12288:3uP4KRi4cu659UrnsLoaEYkTOKKvnZzxoYYxj9eKjRKvYqg:iJRik65iwuYZ1oYgi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700138529, "uuid": "29770fac-b3c7-4f66-948b-e3378bc9c10d", "value": 661504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700138529, "uuid": "0370f227-5e9e-4f62-81f1-30f97e05d2d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138529, "uuid": "9285ce2a-0ef8-42ac-b822-0deff5136809", "value": "Waybill.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5079587b-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700116950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116950, "uuid": "db383221-6df3-4f6f-8e8f-ce4b537dc6bf", "comment": "Malware payload (Mirai)", "value": "5c29244db51b9145c13eefff3431438f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116950, "uuid": "c3d69c94-c58e-4ea3-a19c-cf9b2917f077", "comment": "Malware payload (Mirai)", "value": "05a49901b0dc0fbc077ab304533881dd5c5bc2563005be9a6f5a039dca441e35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116950, "uuid": "aa022960-2346-4b47-9b79-f007dbeba1b0", "comment": "Malware payload (Mirai)", "value": "c422a53abd9a232acf52e85e78c6760cc8d19ac9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116950, "uuid": "37dcd5bd-a5b7-4d9a-9cfa-69104e97ff3c", "comment": "Malware payload (Mirai)", "value": "7463e0ab8ff7d8be9a8046e2a3a5429cc3b85677c7e3ab94a9e5a1e2d32bf3c454f60a605e822cdd89807d2f6c1c3b55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116950, "uuid": "00c98188-2e2c-45f9-b0b1-fcd7efe12f7c", "value": "T13983954D2E219F7DFFAC823987B79A21960533AA27E1C5C4D05CEA022E7034E745FB95", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116950, "uuid": "f853c837-4df8-4a48-8040-6f0c3d30567f", "value": "1536:o2Mx3DAoc6QncqO0vLEKN3TgPnEDg4iPK2PQ+Ut8:shDl0T7NanEDg4iPK2PFg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116950, "uuid": "fc735740-6a93-4fd2-a304-acb0434008e3", "value": 88000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116950, "uuid": "fd5add47-9b4d-400c-ba5b-ed29a1389652", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116950, "uuid": "fd06fe6f-c17f-4f93-b334-b3afd6fa8b4a", "value": "5c29244db51b9145c13eefff3431438f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c505faa9-847e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700139050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139050, "uuid": "398872fb-2f20-4b0a-a67e-351cab2903d0", "comment": "Malware payload (Mirai)", "value": "8ecf0fe57fbdebc5b56a5e622fd632ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139050, "uuid": "88994499-553d-48fa-a47c-f378d15b6260", "comment": "Malware payload (Mirai)", "value": "07f51180a92f55446e8990318aa4d802d0787948a77f8702741b9ec553dcd73d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139050, "uuid": "7861af7f-ed77-4c10-963e-3a086ecacfc1", "comment": "Malware payload (Mirai)", "value": "67b8b0a37bd7579abe151b10aa35b6caade44ac7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139050, "uuid": "5d4fc503-50b2-4c2d-9bc5-415351690dbb", "comment": "Malware payload (Mirai)", "value": "4466bd2bb41abb6c60ae4ab37dbb73d86ab79138c09a63041728dc6521e1915e8d75ab9da193d60ac6ca1edcde161326", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139050, "uuid": "81489c18-9540-4183-9d92-5fc8df6bf216", "value": "T1E723F131335AD4A0AF744975EE3886997B4944BCD2EF2DB3192E1210EB43EC197FC989", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139050, "uuid": "b3bce127-e3d7-4cfc-b870-712982f75b08", "value": "768:BgSmDMvn5kt0/KMrz6LkeCsyzI49q3UELsKutawiefmzcpuEGHtJM6bR1:OSsMv31rICJIhLpuudzuuEGNW6b/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700139050, "uuid": "9ad94191-f31f-4758-8650-e67d84e54ea8", "value": 45684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700139050, "uuid": "b5f55146-a711-4b18-8d1c-d104c46c667a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139050, "uuid": "ce66d5b2-c850-4207-ab67-65afd1351d5a", "value": "8ecf0fe57fbdebc5b56a5e622fd632ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a263e99-84b1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700160667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160667, "uuid": "464fe798-df71-495f-8352-b040a3ddb777", "comment": "Malware payload", "value": "c24a1dabb1317bf50bac152886909815", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160667, "uuid": "ec4da986-4165-4063-be53-e9b537ac541c", "comment": "Malware payload", "value": "094e85e0a3de0e0c907c942f6cb4d97ee434d2a7db81a4a19da65a4cd010c3f5", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160667, "uuid": "22ef5b18-1a28-4d08-83de-3657d22b8ff9", "comment": "Malware payload", "value": "06e7057329969bd1e784998844c0edcf2217f687", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160667, "uuid": "76b3814f-9742-409d-b70c-098368773b69", "comment": "Malware payload", "value": "270952f5b57240063fe8bb725b0b469a0789f6d0840945f080e533039c242ad3eab568542bc16f4c9b71c2233c61f608", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160667, "uuid": "91492957-cf69-4f19-941b-c1e0138ba7a4", "value": "T1306633C596A020AFFE7F0FF45E667CB2FA3EB625946D6D2040C4029B7012989C3F2657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160667, "uuid": "7b6c28d9-be49-4dfa-8e8e-5dbbda8f4060", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160667, "uuid": "5c0f9726-ab70-45c2-b2e3-32e72df2938c", "value": "196608:HrZ9ae2vQfoyoA3uXBPrfj0kHRkNCtItIuqaNNL/bQ:NIvGoyoKeWkaNCtQjk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700160667, "uuid": "cf62a077-d2cc-4d19-9f03-440b3de4872a", "value": 7058944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700160667, "uuid": "da73d411-4b60-416d-ab5a-c63bed60541c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160667, "uuid": "18768381-8d70-4867-b340-e48687b7c204", "value": "GoogleCrashHandler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae783c9c-843b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700110236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110236, "uuid": "860e7573-6755-4221-9508-55674d2c5801", "comment": "Malware payload (Mirai)", "value": "22bd06ae0d7a340b9d690b0ed7aedeef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110236, "uuid": "0910db5f-2182-4081-8801-edefb135ba0d", "comment": "Malware payload (Mirai)", "value": "0b4c5ec07f04c8b8a6ad6f185c6581a4b135adfd59ef7808da7daee5609d3e52", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110236, "uuid": "c7b7367b-9eb0-4559-90b9-ee4e06bc4278", "comment": "Malware payload (Mirai)", "value": "834351d5ff88af96dbcc2cfcebd1be3b7a95edf0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110236, "uuid": "5d307398-389d-46e0-88f8-23756c4dc895", "comment": "Malware payload (Mirai)", "value": "21f3883ef10d740af625babfd4e82a63ea3fdc241fbb0b15caccd58d6731e506e56fdcf1b66808cb937609e8414cd3dc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110236, "uuid": "f70c7aa7-23d5-4b66-accf-9a16fa094975", "value": "T126E2F1909B508A4CCF6A61BD03BFA971B730D08C8B272657CF2C0B1811E12FDD28538A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110236, "uuid": "89f0e0c0-9f01-418b-a05e-78e769ced6cf", "value": "768:b+vtdTWUSEAF3O5+FYvanvr3cgXz5/edfkbTJGgKd:b+FdT9PAQ+3vr3byQTYgKd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700110236, "uuid": "dc45c44a-67ab-4f1d-b6dd-26b2f2c9d5f4", "value": 33020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700110236, "uuid": "b6152605-41fd-43c2-9e61-c97b3c4fa4b1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110236, "uuid": "cdf12169-e2af-4c0a-a8fc-12f3d9b808a1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "007e90ac-8467-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700128841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128841, "uuid": "9a25042b-6d48-4e4b-93e0-da537b20c3d3", "comment": "Malware payload", "value": "9f20d542859a85f5929b60632a3be0cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128841, "uuid": "87e5e6d0-f846-4825-aefa-409e6aa32df3", "comment": "Malware payload", "value": "0e7692aa5b28b208eae8404a1686be9a5b20b952cd4f565405451ae751a133a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128841, "uuid": "dc79c82c-dfa7-4b8c-b42e-92f1b5770b03", "comment": "Malware payload", "value": "1c04cff3750a895ce1106ae8984340df0a1a72a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128841, "uuid": "cce78f39-d1ca-4414-b213-974d43fab17c", "comment": "Malware payload", "value": "e9f1f6c618c9cea0eff32587da0aea088a3960fecbe8bc110c95299c68c356ed2454299b9e70fff9d1b0438ed3f43fec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128841, "uuid": "6ca8d5cc-edac-4c50-94db-a6b7b407c2c9", "value": "T19BE53363B5943E4AF87489F11417D6B024B0EAD2E2E7CF5227897B4F0E31E566201E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128841, "uuid": "0d024366-71b2-4f0d-b5c3-2add399c76df", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128841, "uuid": "66b95f93-2660-4874-816b-3f73829182bf", "value": "49152:Y1UoYIrgYAxISlviwbjn0CkETyQNUXqGnRxceDLKBbW5JoGPu9csJulLT:yUVIrgpxISNisVymY3lmBKgH9c8wT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700128841, "uuid": "6a24b179-523d-41cd-b92a-0c8754dc57a2", "value": 3087672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700128841, "uuid": "11cdb353-97db-4608-96dc-885255527e5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128841, "uuid": "7a7bd39f-b130-4cec-9ee0-11b15857265d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51428553-8494-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700148304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148304, "uuid": "1624d380-9e65-49c6-a8c4-4e70aaeb71b1", "comment": "Malware payload", "value": "5df1ab06d71ee4a3e346017c6a579839", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148304, "uuid": "a3103325-3ed7-4fe6-ba8c-0eb27a4db218", "comment": "Malware payload", "value": "0fe3a1191b5f6d5cb9509f93081e04a063e5668c3fe10ab677887c1c3f7f72b6", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148304, "uuid": "4144f78e-666d-462e-8fcd-1746b0f4c741", "comment": "Malware payload", "value": "c6ae26c51a8997ab321d027d20b64bd26413b6f8", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148304, "uuid": "8fe85568-be39-44cf-b76c-62ee0a0ea770", "comment": "Malware payload", "value": "a9e494e777df4cb4fe0b4f09d581ba67cded4edc40c6eb23e9672d11a7214a404437f17c1b0db205c0341538dd47dbd9", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148304, "uuid": "b1403eb8-5584-4ffe-8074-87b85fe154f2", "value": "T1BE15238243E16DAEAB64A5DE410C7F53FE0D4CC7C9A5CD385F1F34A0EEE52622A74258", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148304, "uuid": "7d94362c-1e5c-4516-a9cc-4e7dbd3d2746", "value": "24576:e2m/O/xHT7XUcz2cmA20io2h178VnTXaXoPgA:elm/xHTQc6cMv7cnTXWGP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700148304, "uuid": "0fa19eed-3b9b-4080-9e0a-25c117e50813", "value": 925656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700148304, "uuid": "6d96741e-afc3-430b-814d-52735eab6c7a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148304, "uuid": "8a8b4471-38e8-44a6-aba2-b06671e2735c", "value": "ATTACHED INVOICES.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "365a93d6-84bd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700165869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165869, "uuid": "2bdac7f9-53b1-4a9e-8541-6bb8314c7950", "comment": "Malware payload", "value": "9ca304ac578853e5ec33680ba1fd4808", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165869, "uuid": "40c56aad-ec92-43c4-a325-7f27a89b845d", "comment": "Malware payload", "value": "100c90139737fcd9a1ea6ca19ea430e0cbda2b39a0642cb44ae80b5ea8cc9624", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165869, "uuid": "3a3d9bc7-6103-4f8b-a865-95887e6e9f07", "comment": "Malware payload", "value": "884dfcfc6be6922f8854d1a78b11bffbe0e9b844", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165869, "uuid": "6df45ef5-5a00-4c0b-a3aa-af540dda57ef", "comment": "Malware payload", "value": "706cf1360a0a578d0a751c531dbcc2cc9472a1f086508fb0d7518cf03ba77b1426f824980a14aca5142b0cc33afd631e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165869, "uuid": "3d199a86-a8f5-47e3-8141-01b66eabdc9f", "value": "T10F76338231E892F3F8D2C5704D158AE0B399E2496EA1462B73CD0B9D2BB854DE47F75C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165869, "uuid": "8fbbabe8-7829-4e07-91a7-685953b08c03", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165869, "uuid": "28e0d132-e931-4757-b57a-3374a886162e", "value": "196608:91O6hGiBfSeUZ7HlR//B5v0lgiWIwesbqi4V0+U+pqjJjU0PudmUq:3O6hGyfZUZ7Hl1B5v03WJeswRetLPupq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700165869, "uuid": "60049b60-7e2a-40d7-a935-2f685fbf6f75", "value": 7623171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700165869, "uuid": "ecdc3a80-c68d-4b75-9ed5-306e8e989f30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165869, "uuid": "e3180b60-9246-45e9-9d15-69c94d71fd19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddbb3af2-847e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700139091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139091, "uuid": "cd851852-879e-4a26-b47f-7a3dbf5f57d3", "comment": "Malware payload (Mirai)", "value": "c1d85a6a845f5fcff6f1eb8355adc762", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139091, "uuid": "06f3670d-5f64-42c0-a6d0-83ed3a674c33", "comment": "Malware payload (Mirai)", "value": "112af74ad15e8492d00c2e866cbd6406ce19740285eeb4e395c1a640fb56314c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139091, "uuid": "a85fe1a6-8a7c-42de-a08b-eefb0fdcfb10", "comment": "Malware payload (Mirai)", "value": "649423c6a6436166b769663346e1c5feaa8b2527", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139091, "uuid": "87b8f1af-b2b1-4b51-a67b-06e8b5507535", "comment": "Malware payload (Mirai)", "value": "64d5864af13c9462fc46a8695acdb75066ad69343f31378bdebe91f95e5f552a910d89528b19a4c90824537a725eaed4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139091, "uuid": "b67498f5-9792-47d5-8d15-05187e50f1d4", "value": "T133C2E1B44F0AD4A1C7319439C32C8D599BDF1AF868EA617726E549BCF8D204A4BB8483", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139091, "uuid": "74117251-adbd-4bac-b36f-5d79f0323a99", "value": "768:Os1n26pu3fciMLR5ZqXp+Jnq8POFQU9q3UELf+:H1n26SF16q8PT9L2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700139091, "uuid": "b44d3559-828b-4595-b9e6-32739dd557dd", "value": 26652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700139091, "uuid": "eb7a0394-b50a-49cd-9c86-34afa03eeba1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139091, "uuid": "b38629e8-12d0-48cc-87c4-4bd179421715", "value": "c1d85a6a845f5fcff6f1eb8355adc762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd4a74ea-847e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700139064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139064, "uuid": "c662246a-dd34-4a5a-bc58-f343ea96d9bc", "comment": "Malware payload (Mirai)", "value": "d4ecb8c47af91c8e2ce3fb317f9b6581", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139064, "uuid": "de917419-530d-47f2-94f8-9ee44d34b91c", "comment": "Malware payload (Mirai)", "value": "118893fa1e37dd5c5a99f123aa4a8100ddf8fdaff0b921d4a125a64b61bcaff7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139064, "uuid": "9049444c-c6de-4503-ac0f-aab12dd55e1b", "comment": "Malware payload (Mirai)", "value": "e674372f20e550c6990cd2042736e969cd52d84c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139064, "uuid": "4835a0d4-167a-48b9-b2e8-e50c7da0ec22", "comment": "Malware payload (Mirai)", "value": "b4f5e964a5e508ee4ce636190e39a175457b258a00bb3c1454d01116bfea139b6a65779ba09464172d9eebe565f51acf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139064, "uuid": "7a7f0578-f6b5-4f64-a0ea-d833e3f1c9b4", "value": "T15D037DA2C479AE90D1098678E5348E383B23E405DA537FF96E5987968047FECF6093F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139064, "uuid": "cc7ded72-75c4-4e38-b749-0b60628a012e", "value": "768:+aN5ZySwtCV6KcdeuFa1VFgD53WqPt4/qfC1PoH2CCu8+:+ajoSwthOrY5mqPG/qf5WCCu8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700139064, "uuid": "c7f661f7-195f-4ee7-8c49-c610f47cc09b", "value": 39156, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700139064, "uuid": "a36b002f-8dce-4e8c-a420-f88152f97dcc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139064, "uuid": "962b2fed-f007-4c88-83cc-1692e890d3d4", "value": "d4ecb8c47af91c8e2ce3fb317f9b6581", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49698a0-84da-11ee-8907-42010a9c0042", "comment": "Malware payload (Sodinokibi)", "timestamp": 1700178589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178589, "uuid": "6c451c9a-c61b-48c3-9ffd-59dab2d6a4fd", "comment": "Malware payload (Sodinokibi)", "value": "77be32b91561d1ac5e36464766b7b0a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178589, "uuid": "3e5c09cc-cb5c-4d6d-844f-062cc465cc89", "comment": "Malware payload (Sodinokibi)", "value": "133bf8be0cf7003b83b03579970997d408a930e58ec2726715140520900c06de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178589, "uuid": "6c9cfd25-0e57-48db-80a9-457ff96aa34b", "comment": "Malware payload (Sodinokibi)", "value": "9c72fe9c8e24b5c0bde50c71d74fb2586c4201ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178589, "uuid": "8f66f5f9-ff44-41bd-a0df-fa0a0400a13b", "comment": "Malware payload (Sodinokibi)", "value": "05ea748c2d198cb766f0bb1720a964d74d94fd5dd50b48e6b59ad92b7d94d129671e50288d73f47170faf1bbcd4ee43e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "REvil", "colour": "#F40D44", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178589, "uuid": "7eb89e37-0214-49e3-9dbd-cf757c34e4a6", "value": "T16BB3CF27FD6105E3D88341F2173F2F2B9ABDFA30512568FBD3608A884A75087E61B657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178589, "uuid": "51882c55-901c-40e3-9057-46a267cb4f11", "value": "7ecacfc6f1d64067e0047425ad885408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178589, "uuid": "f5080d8c-d2e8-4ac5-bcd1-5697b323b0dd", "value": "1536:FApx/1k2jbVnO3c+FpR5Q9JzY02pTmZ0ICS4AtebOMZzqFTj5vel1KkK3I:ck2X8M+Fp4vY06A2roFTj5vYc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700178589, "uuid": "5445e573-b64d-4bd1-aae3-6e3996e0e87f", "value": 116736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700178589, "uuid": "a0224aca-0740-40c6-a97a-65690d414343", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178589, "uuid": "4e6f8cdd-cf8d-42b2-8dfe-005713042abc", "value": "133bf8be0cf7003b83b03579970997d408a930e58ec2726715140520900c06de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f3854e-84bb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700165123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165123, "uuid": "33db1351-4db3-4005-b052-bb7f48d312c5", "comment": "Malware payload", "value": "227657a3dbaa093c847d8eb8b3adaf99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165123, "uuid": "013a0495-0a18-4859-bdeb-32ecce1878eb", "comment": "Malware payload", "value": "13569d8241fb4788f0e4f1199f91c9f324929e783cfe93c51ead94a185b1cac7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165123, "uuid": "d2bf29e4-f674-4b36-949f-424d5cebc593", "comment": "Malware payload", "value": "cafd0627f276f77bd9432a532598e6df3caa4b9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165123, "uuid": "a0790db2-180b-4541-9593-bd67a07651f6", "comment": "Malware payload", "value": "4883bc1627ee1590e957bbe0adb637d47a569ed11c4994f867e05c899c6ffe0a18a089fadfdb343366938fb10a6a7480", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165123, "uuid": "d33a2ee1-9675-4ab5-8fb0-178306e3a5b6", "value": "T17304456D934F01A9CBA2627B97164A4542FCBB3AF34412B134AC437933EEC3D51266BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165123, "uuid": "8dc5d6c6-c1a0-4898-9c4b-ca111f5d7ba8", "value": "768:nDwAbZSibMX9gRWjQBDE22mucyBYWW7lo7LlsadDOTqq2QzImFj5:DwAlRREXhHO76v+AvwzJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700165123, "uuid": "b94be5b8-97c7-4763-82af-5ee197c3446e", "value": 176094, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700165123, "uuid": "d499f4ec-e045-4007-8a15-cec60a5fb573", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165123, "uuid": "119cb11d-e043-4cc3-97ba-f3dd40bdf007", "value": "FILE-2378.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10253591-849c-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700151631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151631, "uuid": "4dcc2f66-42aa-4431-b865-efbf747f9550", "comment": "Malware payload (RemcosRAT)", "value": "285b17aefc234e222954f1e5754222fe", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151631, "uuid": "11f1fb3e-cac1-4224-99fc-804db6d7401a", "comment": "Malware payload (RemcosRAT)", "value": "176bf0eb2aff176a7e4a262bb522e136a7e3f607be1a84494dcfcd180024803e", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151631, "uuid": "a3c84cd9-0d02-49fc-8c86-f2502e6f629f", "comment": "Malware payload (RemcosRAT)", "value": "f8800a13f2d7412a5578db2a3dc788c932308b9e", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151631, "uuid": "87766a3d-f73b-42ad-adcf-55d5073a253b", "comment": "Malware payload (RemcosRAT)", "value": "839957468bc74aefcffc3b9b1e51a91fe03f68653b5a06df96c23366a820ee19fed285e6fb68ef5e38704fa274904556", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151631, "uuid": "a922a41a-1409-42c5-99ac-93aacb4395ec", "value": "T1E3742296F38F1161E13142797AB893136989A0D94D8F41A91CEC59DF28BF06CE0BF67C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151631, "uuid": "8279a30a-67c1-48e8-a821-76824f8394f4", "value": "6144:CrtaR5Gx5ftM/bQy2TXeyVIfjdwKLWRm7pvUXFyXl/G+12lyOIPc:CJ0GtcbQyKeyVIb7yk186le+1lOUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700151631, "uuid": "545f43a6-6b64-40d2-a768-a3668460f6bd", "value": 355066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700151631, "uuid": "9c01cae7-5f4b-4a92-8264-b0bace652e38", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151631, "uuid": "ce3426ea-b869-474d-a1ea-5c1297c50bae", "value": "PI0987654-0098800000.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a859a17f-84da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700178515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178515, "uuid": "30760445-b6c9-43a1-8f8e-86281b47c13f", "comment": "Malware payload", "value": "ca337c7130eef4f4ff8e8a4a8ec28647", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178515, "uuid": "abd6bdf5-ef62-4b33-b94a-0bcdeef7c948", "comment": "Malware payload", "value": "17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178515, "uuid": "d9b16b52-6d2e-4c10-b4b0-1332ff155bb9", "comment": "Malware payload", "value": "28558e35d3f9af01fe438eba7fba1c38201c86de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178515, "uuid": "daf4adcc-77e6-47de-9f43-b88060c59f60", "comment": "Malware payload", "value": "7379c35d3cdc3b6c8180b1d81b7c219c5c0a24493ae65a359bc99bfd43a4213ac8c31fbf681d2c372c2f0dc9ca3781a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178515, "uuid": "21cc2f4d-3837-4a43-bae1-59cc5f7d2d83", "value": "T1BEF3BF162D9001F3C9A742F1562B3FA7D2FEB978231915DF9350C8845E335D2BA2B62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178515, "uuid": "cfac931e-6de0-488d-b780-2e30be882c93", "value": "3072:LBVn11HzIOLbi4eTMlwDCnun4XbZIt+ypUF:d9jzvbnWJnu14p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700178515, "uuid": "263bc61a-d332-4675-97e2-c8e8486ad9db", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700178515, "uuid": "ae65fbbb-79bd-450a-9d6c-7a02f65cd6b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178515, "uuid": "82ffbc16-40ad-4808-a1fb-e56fc91b8b6c", "value": "17d153a225ea04a229862875795eeec0adb8c3e2769ba0e05073baaf86850467.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753c1238-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1700117011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117011, "uuid": "bf6d8ef8-685a-44bc-8b40-bf402f191e71", "comment": "Malware payload (Gafgyt)", "value": "fe687596bf218459903ab804b13eeefd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117011, "uuid": "14bbcf8d-3951-4a8f-94c2-90b845bb0b57", "comment": "Malware payload (Gafgyt)", "value": "19f26f21d69dc5dae4318b16282b3475562c8986effaf5912a56d02d9bcda48c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117011, "uuid": "ddf2b060-bd25-4109-b023-19f3c0c65258", "comment": "Malware payload (Gafgyt)", "value": "40f7a89175c6e15f65542a4e232cf98f42be070b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117011, "uuid": "6f60fdaa-ace2-4770-a534-e9a2e1043265", "comment": "Malware payload (Gafgyt)", "value": "30040e2ce0f2ec391f0408678652e2ae8036d93d397df8a5da4a173b39954a38ccabf4b956ce18919bcfab066624c299", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117011, "uuid": "7357a5ec-e6de-404a-b19f-6f66898c1351", "value": "T1E3A3F872E643CAB2C4430AF201A7DA6B0D21BE6B0A7A5A85F31C7CB09F334C57655F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117011, "uuid": "fa1a960f-e2b6-4ba9-90d4-8b649535c69d", "value": "3072:wW8FUmgujld6Mkxm6AJ+4frHmmFVcqq0GnDZT:wJFv4Lm6AJ+4frHmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700117011, "uuid": "124cae6c-1387-4377-8cd5-89d2fab562b0", "value": 104138, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700117011, "uuid": "c4d99fc3-fbf0-44f6-b43e-1fbd6b9a6aea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117011, "uuid": "73610c96-89ed-4b6c-9f8c-2717105e180f", "value": "fe687596bf218459903ab804b13eeefd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211f9770-848d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700145217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700145217, "uuid": "d80f86ac-bc2e-48b8-84e9-bea15eb94fff", "comment": "Malware payload", "value": "45f71899fe4ff1fd47a458a279bfbf91", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700145217, "uuid": "309340ca-15c1-4b1c-93a5-513556a1f1be", "comment": "Malware payload", "value": "1e669526e253a55fc4e23cdf33e207d9e68ac9a3f47cb2a296615b582ed7f1c7", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700145217, "uuid": "7e0220f6-5235-408f-bcc9-7558f1e35a2d", "comment": "Malware payload", "value": "9cfa384eccba7e91c9dc6a356308785f3a2823bc", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700145217, "uuid": "3c8abde6-e086-4b16-aca8-e36c56af7978", "comment": "Malware payload", "value": "d7f59550a8228199c92517c0770e10872e03e0706738f5e008cdf87ab1b6b9c577594e35c5b87fac1da4f5a7afd31c46", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700145217, "uuid": "12b1b782-b0f9-4384-99cb-545cad913add", "value": "T136B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700145217, "uuid": "f0f21432-56ff-4d0e-8170-9ca930c69c9b", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700145217, "uuid": "2a3891dd-b470-4481-ba47-ec01e144d347", "value": "6144:UexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O71pUlLaEx:UeZeWSpda70ADIgSoxgUW/zFun7O/Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700145217, "uuid": "8fc56d47-2b7f-4f1d-9dd5-8f5efacd0fd9", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700145217, "uuid": "5fb1952d-4414-40fa-b88a-5e13112da2ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700145217, "uuid": "c4b4da57-5dcc-4235-a143-5b663adcfff7", "value": "Systembackup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cb28798-84b0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700160323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160323, "uuid": "224a6ade-aaab-4337-9eb2-72f1a32fef4a", "comment": "Malware payload", "value": "e4d26a2f5c8155ed3a7b342cc68b8c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160323, "uuid": "623d53da-2044-41d0-9c71-7094432c9435", "comment": "Malware payload", "value": "1ff0aa7fa699962037fbbb90a7c59ee742c033f71a2aa17e088d74e7f1aed913", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160323, "uuid": "982f846b-0e75-40b2-b262-a53a058a5fd5", "comment": "Malware payload", "value": "4905f9a6043d6f5189d8e73b10ff41a1d4b37219", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160323, "uuid": "71212b74-6973-45f6-b61c-b81ef6c78562", "comment": "Malware payload", "value": "3b2a33e286bbac1a7429eab2168c6f7dda7ca1dc84706a687562bab49251d4e1d7ee61340fd0715f85930025e80e35fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160323, "uuid": "0f640d1a-f54c-4ead-a134-52f178ccdcad", "value": "T1EEB63361C0098056C647B0F5BFE2C233552C9E6B2B7B2EF9297FDFC9029D9A148F9851", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160323, "uuid": "93849966-5600-4c12-9bb6-8b1008febd53", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160323, "uuid": "693dc71f-7b81-489e-b4c3-7446db91919f", "value": "196608:kVKAeDP0W1lvIdt0InTEKGxkSHkA72AaDZ1/EPw4bBK:MKfD84qd2CEKwnkA72DDbEPJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700160323, "uuid": "7d5768d2-0583-4837-bf7c-eddf1f158347", "value": 10744320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700160323, "uuid": "8fa924ac-4f4d-4d46-b552-3848e45e6dd9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160323, "uuid": "72277a1d-a8bf-4fab-9ebb-eb6fac443a1e", "value": "Embmake.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3fc6215-842e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700104742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700104742, "uuid": "40c8e93c-88bd-4fee-8911-c5d9e6672e1e", "comment": "Malware payload", "value": "3f1ba0dace898dc2cee247de5e15f068", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700104742, "uuid": "96c9882b-30d1-415f-b051-071cb2052991", "comment": "Malware payload", "value": "2057c7a12abf4e22415003004e057868610c699809b749f10aa9708b4c81157a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700104742, "uuid": "345a27bf-8506-4d62-884d-51d6df00abbf", "comment": "Malware payload", "value": "e1fe1e8a75d490ea13736b38133a1ba930dca7e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700104742, "uuid": "10ec5a26-f6bd-47bf-b854-0ea5e29be672", "comment": "Malware payload", "value": "02ddf0f6994e507a965d97765c9aeb1d622acf122121d656151c2e79f2a670696fc3e4edb26d7198bfcd90d63867e189", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700104742, "uuid": "ddc0e7b1-cd97-473c-b118-5260464393a7", "value": "T132442A2392E2BD55E926CA729E3EC6F8761EF9508F097B6531286F2F14711B2D273310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700104742, "uuid": "15dde0a5-8bdc-4b30-8cf4-f5fa855c99de", "value": "2019e2f2e2ca0590589ed6b17ba008c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700104742, "uuid": "2758e5be-8e8d-4a1b-af97-64fb81443cd6", "value": "3072:Bjf6OLLuaZj8wp6wPZ0FHQzzdoPCU1C6g2Okt6iZ0R2RYcBXSJckSHCAu:5LLXZLGHQz53U1C6gJYRnCJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700104742, "uuid": "087c9265-ec5d-4862-a388-53d3497f8535", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700104742, "uuid": "3d81d9ad-1e38-4aa9-8044-8e652d674b11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700104742, "uuid": "73266ac0-9394-41b8-ae4f-ab161cd57335", "value": "3f1ba0dace898dc2cee247de5e15f068", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fdaf3cf-847d-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700138504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138504, "uuid": "21c50bb0-8c25-4d17-89ed-bdd073a10b85", "comment": "Malware payload (AgentTesla)", "value": "5e1b9e9a79b8b11e1805a06bb61e7961", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138504, "uuid": "3ecb424d-f871-4ff5-b1cf-e2b7d7e0c7c8", "comment": "Malware payload (AgentTesla)", "value": "21dc047f9ab94825e801f1459225100c58e688396b570318cc50fe8f53dfc66b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138504, "uuid": "eb510065-3618-442e-a431-c6a3aea2ee04", "comment": "Malware payload (AgentTesla)", "value": "a4188ef8449adc739a63016ad0b115298abacfce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138504, "uuid": "312eda83-311d-4f4c-977b-c58f337a22e5", "comment": "Malware payload (AgentTesla)", "value": "fbcd3ef7425500050c61e34b4d7c3472f47a9255e101fbdffc081359c898dcdd32c4fd72b0d25f2baf8973fa44946c65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138504, "uuid": "3bb0af47-89cd-40c3-bdf0-5b665cf8b4c7", "value": "T11F05ADF1B868CBA3CB348AFF1497507047672C266575D2D87DBDB5986EE1BE30412823", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138504, "uuid": "4baabf72-9f25-4b3b-b523-027eb8c93d9c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138504, "uuid": "81252557-f7af-47cb-acb3-8459c09a2a2e", "value": "12288:7J1VJW7p2iNkuPF3378B2P6qNIG7pz/RKizp//KQ8h:bW7p1l5L8K6q95/Uityhh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700138504, "uuid": "725b6a5b-be3a-4331-96f3-dcddf0e4a4f0", "value": 825856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700138504, "uuid": "e601144e-a973-473a-aedb-38a86d5585eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138504, "uuid": "75decbb7-8aa1-4cbd-b346-035fdfa503ff", "value": "Faktura proformasi.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e669aa4-849c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700151736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151736, "uuid": "f8ae1b62-3bcb-4f30-b502-10da270beac1", "comment": "Malware payload", "value": "6fc37afd1e80d8f4d251baf7fb202d48", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151736, "uuid": "be26f4c7-c225-4948-9f60-32059eaaba45", "comment": "Malware payload", "value": "2351899346089f710ac1c86de5d219b8f3dd8b2f6c17a1aac118fd2ec3a3db0c", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151736, "uuid": "9fe1361b-aadd-41a7-af5b-7fef2f56e573", "comment": "Malware payload", "value": "92af57979d551a5fafa718c23c221cc96ab5e1ad", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151736, "uuid": "4bfef958-4619-487c-a369-834b60a6d4ec", "comment": "Malware payload", "value": "217b290d4728ed067e9709dc65ff46debe497ebf936e0e4d7de369111b82693971ba647e5167b433c19734e66277d0d8", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151736, "uuid": "b37c865b-162d-49c9-a839-bcea6242fac1", "value": "T11BD423005A738E0980B0743D337A562357EB4C0E1AA067DEBA9E35E1C36F4AB9F655D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151736, "uuid": "e63519aa-8d71-4aa3-af55-a88b34bcbab2", "value": "12288:4TuK9VN8Q5w8CX2RdJJ85GmIW2hqDPWdvBqx8QE+QL9f:499VN8Q5SX+dn2G/W2h4SBJFf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700151736, "uuid": "ac430a17-24f5-4154-b184-0e07f9cc6e5e", "value": 610903, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700151736, "uuid": "b60d62ea-c340-4e46-89e8-c41d819b5ad9", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151736, "uuid": "885bcff2-c669-4a19-85b8-744515070434", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abf192e-8481-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700140214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140214, "uuid": "9b05f17b-849d-43bf-88a0-5618264cb729", "comment": "Malware payload (Formbook)", "value": "c1e5f30dc5bb0ba12def8b297eff2a30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140214, "uuid": "6792c673-7457-4a95-9176-8fcdbe65feee", "comment": "Malware payload (Formbook)", "value": "238407873549a12df471dde3759cb177f7c0ca91897ece9e45b79c3fcdacf7d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140214, "uuid": "af0499d0-cfbe-4c51-b829-bce4da7de4ab", "comment": "Malware payload (Formbook)", "value": "8e15af1bf7f9ba7bc4290a3ea31463fe318ded2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140214, "uuid": "16dcd050-4c96-4d34-9f2c-1fc21b3b9b98", "comment": "Malware payload (Formbook)", "value": "19e016e72c0d3ba154d1dbcba8896c89442fa7c0d493b986f3c583c4ef8427e6ae737e767327bdf360aefcb2f594d532", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140214, "uuid": "486c9241-0d6d-41dd-a6ab-e5c8cbc8fce8", "value": "T15584232330F05C77C4431DB273EAA61693BBC1158712E4974398AE2BBF38EE17A53256", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140214, "uuid": "4aa16590-5689-491e-9db8-21ee06163060", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140214, "uuid": "7f3c79b3-07a2-429a-ba6f-4547114e2875", "value": "6144:wBlL/75TTKvluajNQ2SHklbmxGxw0evYhrUxc8HnlPhzcRz1tldRk0BQ2s2SoTKx:CJNTKE6NQbkBgGxzjhac8HphCzlbFy2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700140214, "uuid": "47c1813d-7b92-4a27-9e87-30aa0c1963ba", "value": 372895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700140214, "uuid": "ce4b185e-30c4-4f79-ba2f-beed53e3c4af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140214, "uuid": "c3f14090-7818-4dd2-bd26-bbcf65cb5fe2", "value": "MTO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aaaffc23-843b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700110229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110229, "uuid": "67ca2268-7cab-4be9-bf79-caff5c487ad1", "comment": "Malware payload", "value": "729eb1c5221f9993a77abb1f03927031", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110229, "uuid": "1dc0a7cd-ec11-4e1a-afe3-a3898c80dca8", "comment": "Malware payload", "value": "240adc82310cc5150f814fa3f474778b039612365ea974a5a767c21527df8331", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110229, "uuid": "e3de0ce0-be12-4d4a-b3fb-da35bcad7b28", "comment": "Malware payload", "value": "cc511a28356d72297c6d6914dd5823a2a040996e", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110229, "uuid": "5ff13b6d-5859-4668-bcb9-30b3eb874790", "comment": "Malware payload", "value": "ccfb3abed21275a3caef4d6a915d5a613f131cc22a99b9b5a73772e28952153d70f6e5b830e637c3dc305c243e8ab4e4", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110229, "uuid": "4dae4288-92fc-4aea-8f51-66b4b56253b1", "value": "T1CE03F125FF06346FC879E870CA2E1C2F314AF945702AF585449ADA06A1F6F6B670ECC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110229, "uuid": "fa344c0d-0d66-4ba6-98ca-811e76a9cd69", "value": "768:3CGs6kk+t4byUemAyjFV5dSjm5hoCi2ZMEJXgZwTNNdu5nvtCsFqEd:3pkmy/mAyjr5IwhZaowZ6NNU5XIo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700110229, "uuid": "8a6a6c13-2e34-4797-b0c3-c5b402a08fa0", "value": 38720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700110229, "uuid": "1eef16e7-eb28-470a-835c-b202d89c8a73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110229, "uuid": "b0e6b83d-9fae-4481-a62d-82840a252cd5", "value": "arm4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c4c937-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700117071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117071, "uuid": "c9cc6b47-d6f9-4288-a9e6-6c804d1a1470", "comment": "Malware payload (Mirai)", "value": "307579119927b71a7b660eea4fd889df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117071, "uuid": "0e703002-68d3-44b3-8136-6436011f5fba", "comment": "Malware payload (Mirai)", "value": "259d7deb1c3b836653faf66821497289581f5e89e60daa7aaf385203bb9515b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117071, "uuid": "80c4cad1-d5df-47a1-949e-c123400d9ac9", "comment": "Malware payload (Mirai)", "value": "e1bf3f67fe4b5b8b5fd94538718c3220784078fc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117071, "uuid": "0c593c45-6bfe-4672-a837-f35c25c59e8a", "comment": "Malware payload (Mirai)", "value": "79ef33c43b7d892d40327c855bc3a07775156f6e9fcb00533f2af2b645be3154d233ed766f7ef8dc418ce915173e6bb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117071, "uuid": "3965ac5b-3450-484b-a446-44a69febc523", "value": "T16E532AC8A0D3E8F5EC14097D307AAF629E73F13BB136ED9BD7E85463A941202D10665E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117071, "uuid": "a65e90b9-4f9a-4c7b-a27b-a41367368b13", "value": "1536:qigOlzJBf4KliQ2kml3OaSWY/Pfd+700ngkoe:fzJBf4KliQ2kml3OaSWY/Pfd00+do", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700117071, "uuid": "ce959bdc-f53d-44a4-b10b-1e8ada8421ce", "value": 63484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700117071, "uuid": "613c27bb-15ca-4a19-89be-7a12490110ac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117071, "uuid": "2800844d-aef6-4fae-8e4b-f49e93042a69", "value": "307579119927b71a7b660eea4fd889df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a86bc78-84aa-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700157635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700157635, "uuid": "8961bdde-487a-4911-bdd1-78e0c88b649c", "comment": "Malware payload", "value": "a98a8703058d9eb61b2e3690baae637f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700157635, "uuid": "f3f64db4-6ac2-4013-83fb-afba49bed2f1", "comment": "Malware payload", "value": "26c06333185d16e39155b70b98856a868f239a3ed893223cbe8ccd86a858aead", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700157635, "uuid": "ef0a2268-e765-45f8-b678-8068e5de392f", "comment": "Malware payload", "value": "4281b376f7edc4cd83ba4748df660b741bff1e7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700157635, "uuid": "b5efc5c2-aeef-49a7-8acf-c2bb952bec7d", "comment": "Malware payload", "value": "caa0d833939f569ec56b6b4c3044df1d6b09dbcadd4cfe474e19e2a0a5e8f8e274aee912bcf38f7bf986af68615a2015", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700157635, "uuid": "df9a33f2-e648-4ebc-b418-b864e12f4f88", "value": "T13B169D426FA09E67F02E513BA6DE540C53B4EC1027D1E37B79B4323D5472342B866EBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700157635, "uuid": "43dab029-a4cd-4d1c-8655-d5eb012aa969", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700157635, "uuid": "39e2b8dd-3746-4c18-af72-a9a3d748a1e6", "value": "49152:Jk4Zj6N2Qq1CGO2kZqyYGa1i74EzTs6c/y3OjWpclDU0prvNyN0:FZj1GqyYC4E/wy3OqWlLZvIe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700157635, "uuid": "ebfe3896-58e4-44de-a97d-b8c902921fc9", "value": 4137984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700157635, "uuid": "8a60b3f8-294d-49df-bfaf-15602cc55921", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700157635, "uuid": "35a10e88-2f02-43c6-af8a-1d4c3ea13983", "value": "Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb9f2c73-846e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700132162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132162, "uuid": "39c5a1e0-02fb-4205-83db-e90168c115ff", "comment": "Malware payload", "value": "0d0e3a2db1cb8b4a15fefd5175c347b3", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132162, "uuid": "ae39d5f7-4acf-4b11-92ab-0c92822e645a", "comment": "Malware payload", "value": "29b807ee3e8dd1d08a4e91f92506c43e3919e375e14a47f930ebb9f8c201a4ac", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132162, "uuid": "f4cbe892-b332-490d-a9d6-241840b54509", "comment": "Malware payload", "value": "0bd1faeb0fe277d98a074f0f277fcf5fd8e0449d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132162, "uuid": "27757d20-4214-4919-8c2f-3f54d0d93642", "comment": "Malware payload", "value": "b9e29f9ab6b089d32a35f22a81a49188a5e0da15b30adad299a9fc0257ba18f3ba211150c600f6d6f61fc723376564b1", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132162, "uuid": "785c0661-ff0f-4f38-889a-9588fdb2b206", "value": "T15504AF11759181BBDB9E223454FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132162, "uuid": "b089d607-ae1a-46bf-951b-11005ea4d883", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132162, "uuid": "ff8d3a21-9835-4a31-a9ab-2c7f75344cbe", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLjbVaKoXAxOPYe:I74elpowsxizqyStZlpel5fyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700132162, "uuid": "eaae82fa-79b6-4409-be75-188a46e9f8bf", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700132162, "uuid": "81e99ec2-fb35-4a7d-95d3-baa9cbf20c0d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132162, "uuid": "5cfb7c8d-9456-42dc-9cd5-f6782666ee9b", "value": "WCUtil_1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4491ff98-8495-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700148713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148713, "uuid": "bc052e06-2221-4d91-87dc-0eb7da25326a", "comment": "Malware payload", "value": "3bf0369d7a59a62e40ac3b957256c3a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148713, "uuid": "cbeecf5a-d8b3-42f0-8cbe-bddf7976a4c9", "comment": "Malware payload", "value": "29da085a372470916f440dd7d72d7f6b2f4d634fc39880159786537bbf753efb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148713, "uuid": "d23a6d96-8e84-49a8-a969-5b2b41b36f94", "comment": "Malware payload", "value": "57494ab899dc06f6aa845bd32c006f3b6cd25c4c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148713, "uuid": "cb359c95-e907-47fc-9515-5df0b9f08c5f", "comment": "Malware payload", "value": "34fea0ff21a4e614a819f0540c311f9707bb9e43720b86749b962312c63940a87202122af3115f22bbd4670abab88d76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148713, "uuid": "90c44f47-84a7-443b-ad21-20b218e656e2", "value": "T1C8342903D2E1BD51EA268B7E8E2EC6EC721EF5508F5977662219BB1F04B11B3D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148713, "uuid": "8e541553-d8d1-487e-a9f4-e92e877eda4e", "value": "213f519d1d60f9b08b3f96159240536b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148713, "uuid": "c853d6d8-16b7-437b-bcc4-fe2b2a5bef89", "value": "3072:BFzWLgYT0oBED3xkmDTPs+ujEt+nBKObMM4RmVe6liXsKsik93:aLgw0ouD3qmDTnZ+B9q9G3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700148713, "uuid": "7a5e9c54-98d6-4acc-8800-57e6daf1dd74", "value": 248832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700148713, "uuid": "21a91ff6-aae0-4392-b61f-16bb603ebbeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148713, "uuid": "572cb691-6d46-4afc-b973-e6f6c732f7cf", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a99507e7-849e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700152747, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152747, "uuid": "c0984a42-f81b-4982-94d3-2b890ed11a53", "comment": "Malware payload (AgentTesla)", "value": "a8c6a584675d1beef4c97885bd99e037", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152747, "uuid": "5ba4610c-321f-40b7-985c-77d369adb5f1", "comment": "Malware payload (AgentTesla)", "value": "2a3d4ef67157e7f2e8773f92b33e697b70a44a6ab89993c0dd392e6d877d846a", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152747, "uuid": "aba2fd9f-447f-442e-809a-5b4a38306bac", "comment": "Malware payload (AgentTesla)", "value": "1e5fb8d8ead4b28414aedb4dc3fbd867c9af77fc", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152747, "uuid": "311923c5-0252-46b4-ab62-b650cb5ac88c", "comment": "Malware payload (AgentTesla)", "value": "5c1584360f266d542dad3fc778eade33e41df14d41cc369c23cb174a7d2b27a5058814cec5a97438ddd9804b7453a169", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152747, "uuid": "7eecf7fe-3925-491d-a1a3-03a0a8e39d5e", "value": "T124D4231388BCD090CB02CD4E0023BBF566E58C5A5FFBE2BC4590ACDCCD6DA5A69EE055", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152747, "uuid": "02172e51-4207-4383-b179-b5a00279aa4d", "value": "12288:pFXl2mA/CJD1BLAai8o37OqSwj9ORzP9gtM/APdILNVjlcnx47eJgNvz+QEwp:pFC/CN16R88Swj9ONPeM/GeVj6n2o6vj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700152747, "uuid": "2356baf6-1464-46ba-a2f1-d0b98eadd960", "value": 615119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700152747, "uuid": "cb4ba9d8-db7c-42a4-9c9d-d762cb378802", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152747, "uuid": "07226afd-8f33-4087-94e1-43d8766d2ff1", "value": "invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d547a3f-8492-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700147466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147466, "uuid": "4ef38e2b-2975-4e9c-9c0b-8348597b4af5", "comment": "Malware payload", "value": "dc18e6105ef066c4104b47405bbd2ced", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147466, "uuid": "2a61843b-6f83-45ad-aa7d-9a92116df2cb", "comment": "Malware payload", "value": "2a60a92e4cd452444330b671320883fa7f235254fcb1131fa32b26105528815b", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147466, "uuid": "3ff1ffc5-fe02-4ce1-ac3f-50d1aeeecf60", "comment": "Malware payload", "value": "2588963a8b7a0d678b16e5b7f7375c16dd995545", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147466, "uuid": "fe27ba3d-eff7-41ca-b0bf-b9f7091a9a4c", "comment": "Malware payload", "value": "39a65800b3342c2f6edae6df74eacf4cb365e2d82fd2b4df5ad045aa1d193a88e80cf2fe3af07d6d82f2d03dd8dbd208", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147466, "uuid": "85bad722-a3c1-4038-846b-8eacf82e7a08", "value": "T13AB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147466, "uuid": "a6e1da3e-b880-4577-b458-84c23f4ddc9a", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147466, "uuid": "5443664e-8502-4a73-85a3-c4254b61f98a", "value": "6144:PexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7npUlLaEx:PeZeWSpda70ADIgSoxgUW/zFun7OVY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700147466, "uuid": "3aaff379-0862-465d-8075-8b53e2182a00", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700147466, "uuid": "1cbad176-d9bf-4458-a61e-2005f965c3ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147466, "uuid": "d70baa1e-e9cc-44c0-bc8b-2bfe0b28ad21", "value": "exploreRemote_alphav4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "608e1b92-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700116977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116977, "uuid": "ecc46c2f-34ec-4163-b937-3395df681273", "comment": "Malware payload (Mirai)", "value": "065ad122f64d6412fdd86b0917077d92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116977, "uuid": "1b720519-c697-4a0d-a144-943dd6464617", "comment": "Malware payload (Mirai)", "value": "2b2e14bbb8b6dde01574e16b023517138b6351026eb0b5039ed0949d4f352bcb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116977, "uuid": "04317835-2088-4434-ae49-f9ced8af1db6", "comment": "Malware payload (Mirai)", "value": "99967404eb14b9089d192e525d22c58d47ce13bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116977, "uuid": "91f13fc3-f8d1-4da5-9b18-ae8f70e78d55", "comment": "Malware payload (Mirai)", "value": "2fbe619118cdc079c1c180bad1af586b1eb1fd26b047228ee4ed29006e78d4f763c9315a40ec9bafbfb47ea0426bf149", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116977, "uuid": "e976dbe7-f9ea-404b-84eb-6255683ca766", "value": "T1BED33A86EA408E13C0D61B76FAEF41493322D754E3DB73068D185FB43F86A9E4E63649", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116977, "uuid": "8e23c88e-063b-4d6c-a0dd-1d2f76549e87", "value": "3072:5gH6EVnGGtYVRXaCgk9mrsplDKZUmQBKXAVanJX+F8Jyvi4hL5AJI4+3jJNx13Sp:5gH6EVnGGtYVRXaPk9mrsplDKZUmQBKf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116977, "uuid": "9dcec531-f81a-4a6c-9a4d-fad137e1fa58", "value": 142651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116977, "uuid": "178279e2-8fe0-4b11-bea9-9a8631d9ebb6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116977, "uuid": "0aa0c827-99d7-49f2-ada4-6a7859a9ef06", "value": "065ad122f64d6412fdd86b0917077d92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aba41155-843b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700110231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110231, "uuid": "6d572ae7-d6b4-41b9-a97e-928479f7aaca", "comment": "Malware payload", "value": "a27aa39d2660e9e4675c27d7504c764c", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110231, "uuid": "62e154d0-ba86-4a07-a00f-4b33ddab6c32", "comment": "Malware payload", "value": "2da8d0097646be87d3e0e100c8787c9af2c12aaeb6da7f0b03a551f3b65c1194", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110231, "uuid": "87881d7b-9e70-4fdf-8465-cb14bffca951", "comment": "Malware payload", "value": "7563f7e19cc18e60da2aa67de4cf3feb8004a66a", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110231, "uuid": "7a7236f6-948d-4467-b520-2cc1d1ddd9fb", "comment": "Malware payload", "value": "bffca9a9eba7093321cf25095d6791b652cffda9fe9acb670f8ee3cd4f0007cdaf4d543ebc120ba578f7ad4bc3fd0531", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110231, "uuid": "14bcf081-1d4d-4122-9aa5-6a0350392373", "value": "T129F2F11597865093F9CCB6B89273F9F7600E97AC3FD53810F0D9851217B986E70BA6C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110231, "uuid": "8a726bfa-0abe-4873-9bc6-1f66741548d2", "value": "768:ClGa6kPmhll2jnN7TDJDTdHXBxBP5lCT4Qu+GUbh8yVLYVs4rZzx:CAhkdZXDJDp/BP5+k+RtLxuzx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700110231, "uuid": "db9e5de0-af3d-443d-89dd-d1b2332667a3", "value": 36632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700110231, "uuid": "55e5e090-7a38-4ba7-835f-e287ed5eee45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110231, "uuid": "31a9e511-dd22-497e-b27e-210c535fe873", "value": "arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f799f8dc-845b-11ee-8907-42010a9c0042", "comment": "Malware payload (SystemBC)", "timestamp": 1700124102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124102, "uuid": "ce1ec49a-2e6b-4d21-a227-d46dfd6bfad0", "comment": "Malware payload (SystemBC)", "value": "cac81707eba1be452f548e410275a0ac", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "cpl", "colour": "#36ED9E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124102, "uuid": "ed123142-48d7-4f71-ac76-ad6a724477f6", "comment": "Malware payload (SystemBC)", "value": "2f120d396f71ff9adb8fe11f0b529e8ddea8355837d955fed83bb0ae2a35de84", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "cpl", "colour": "#36ED9E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124102, "uuid": "9b5eeb55-edd5-4daf-8f28-6a2a7088e84e", "comment": "Malware payload (SystemBC)", "value": "dd4b3bbd8bf357bbdeeb593e94ff0bf9b5ae19f2", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "cpl", "colour": "#36ED9E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124102, "uuid": "519a94d1-66b6-4f21-a8b7-7a593d0315b9", "comment": "Malware payload (SystemBC)", "value": "07961c6ac59252650467f29b2bcae02be677b784fc3e6ef5c4fb9486f50e776d64c665bf852b6b410df5d3f12b05faeb", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "cpl", "colour": "#36ED9E", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124102, "uuid": "d067e829-83cb-4d77-bea5-4c6224129782", "value": "T12672F7AA386081B5C21586B43E9F6761907D65724234A029EFE04F1C3F7DAA3E726F13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124102, "uuid": "251f7376-4dfd-483e-b277-3a463000f060", "value": "ea47177789465ada573c717425469cd1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124102, "uuid": "44755306-6054-46dd-b407-e6f8705cf66e", "value": "192:RniGhkfGBpFH+Z0hZ1WW8B52daFX4/PqfZSCG0GGGdWoBrSKja1cDHs:Y/fAeZ0hZwW42doxR3gWoBrtW1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700124102, "uuid": "4d61d034-1b05-4170-9215-7c01bba1f033", "value": 16896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700124102, "uuid": "d10198cc-050b-48e5-93eb-66dd85d78773", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124102, "uuid": "cd6b25b3-c757-4abb-bb7c-ec8d272053b1", "value": "wizard.cpl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f41deb4-848c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700144999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144999, "uuid": "50fea037-6e4c-4cbc-bbec-7e3f76502cdf", "comment": "Malware payload (AgentTesla)", "value": "6d42a1eae1c8b8304ff349d919381716", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144999, "uuid": "82efc89c-8d52-40f8-b3e6-8b392890e558", "comment": "Malware payload (AgentTesla)", "value": "2fb8f2940043a26f22228fe74438848af86ba93356e4defcf3e6611bffed5aff", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144999, "uuid": "7c7f619e-d6ad-444e-ac21-73e5e62f7058", "comment": "Malware payload (AgentTesla)", "value": "4b64dffa366e6d74d007ff9d286af3e8e47f437e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144999, "uuid": "7519e9ec-3e49-4a16-94ac-6a5115249d0f", "comment": "Malware payload (AgentTesla)", "value": "391e81ea31990480c38e54ca8524e1fbabd6a1c76f709c15840ac9caff58871ead43c2b03175d1ce76564228a4793461", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144999, "uuid": "b0aa8b9f-8847-4d4a-8a90-a6c3be8c532f", "value": "T13515392C25296F8DF7A492FCB2714CFF13A46D2F90ABF5F7894DA4C706A97C05502622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144999, "uuid": "6de3f56f-3aac-4f8d-9ac4-f8ad99150a26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144999, "uuid": "c59d41ce-516d-446a-a4b5-cfd01193fe64", "value": "24576:ZdsXUpExO0toph1PmEmZ4ZsNV2WzpqS6Nne:bpExO0tE5mZQsu2pE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700144999, "uuid": "b3c4b9b8-9acf-4b87-a617-89b70310b8e7", "value": 913920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700144999, "uuid": "bbbdc555-98b1-4edd-be45-c7a31f04a8a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144999, "uuid": "5fed59a3-be89-43af-b90d-46f375e594b0", "value": "Docxc-xerox-Printinvoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d55a005-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700116998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116998, "uuid": "fbf9d11e-84c3-4f7b-8b57-179b7d70207b", "comment": "Malware payload (Mirai)", "value": "74b90e1aa7a0b32b6ef3d6da82e0102f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116998, "uuid": "1f023792-cea7-4b5d-add5-bb9159801aff", "comment": "Malware payload (Mirai)", "value": "32bd26fdeed6fa884d8e01fd74044c828d3ff408ccad9522405b3941cda33205", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116998, "uuid": "b0bba850-38f6-400b-9aaa-fcd963f1a39d", "comment": "Malware payload (Mirai)", "value": "f9a161a0dfe6ff0d0aac80b051694368fe1819fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116998, "uuid": "434971e9-d011-492c-adaf-2a7bf36bca71", "comment": "Malware payload (Mirai)", "value": "35ae5f6b4d47781d2ee6488f3bb149a5c5fa8e7ec6c93da196adfad043f863830ad7ee2174174c794fdad8e7b8285ec7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116998, "uuid": "4b0bfc75-de7a-4941-80f6-d4ab9d79d3e6", "value": "T1384309827C81AA39C7D0577BEA9F108E3314ABD9D0DB7347CC140BA176CA55B0D67B8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116998, "uuid": "dbf6718e-440b-4099-9ef3-d0e0bb2f3e59", "value": "1536:lZZX6+R1XCydJ/BpU8gbYQlzYJBb07NLz2yYceZW8eXfM:lZZX6Ze0RLz2tcwsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116998, "uuid": "23554bbf-a335-407c-9464-080501f5ff03", "value": 60180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116998, "uuid": "a6eabb69-2ed6-463a-9a60-0552581788a3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116998, "uuid": "6c00766c-7827-4c64-81bd-c08c7b6b2b56", "value": "74b90e1aa7a0b32b6ef3d6da82e0102f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a16056e3-844b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700117085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117085, "uuid": "bcb46ff2-1429-4233-8a02-e5565051c897", "comment": "Malware payload", "value": "580d2518f613c4845b00f07007bbc250", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117085, "uuid": "18dea40f-ec7e-4431-ba8c-d2f406ce2166", "comment": "Malware payload", "value": "33f8b88a78cd1b0f7d32d50a77d28dd6310bc900ba078f1db287297e8ddc1f57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117085, "uuid": "6e438b89-4299-4bb3-bd7d-4293986c3193", "comment": "Malware payload", "value": "9a4e1aa909009684f9c82be204436d9d7c198bf4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117085, "uuid": "043fa6ca-c191-4fa6-9846-0e58f01c32a1", "comment": "Malware payload", "value": "2f373175008fdb052e07342c0167397328e43bf40c7bfbfb76b46613942c4e4606a43654915b366869e8b45fe209d3ef", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117085, "uuid": "43901a81-0974-4407-a84b-af624db4b993", "value": "T1ADE38536B7619E77D80ECE7305A985121C8CD98702D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117085, "uuid": "3315881b-bf67-4d3b-99ca-92584d98281e", "value": "3072:dgZc9h1jlnLA2PiXYeyCc3VNMVGuo9mrThPaLEnvPrNb:dd7lnLA2PiIeyZ3VWDo9mrThPaLEnvP5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700117085, "uuid": "d831e22c-ae73-43f7-afb3-2d749ce01168", "value": 155476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700117085, "uuid": "45cf5b7c-31e5-4efa-9963-8dbb42d63e95", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117085, "uuid": "543fd9f7-3036-4c53-910d-9c785ebbf4a8", "value": "580d2518f613c4845b00f07007bbc250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "043b846c-847f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700139156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139156, "uuid": "3e235776-46d3-4831-b9bd-5fb94a7f7d81", "comment": "Malware payload", "value": "47d3b4abfd5ec0b2b8fd08134c9ac5be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139156, "uuid": "b9502379-ab43-4d7b-99c8-ed2946ab877e", "comment": "Malware payload", "value": "37583f944a88bba91be211d9c4e98ec713cb9f95301aa66741132eda6da0f59f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139156, "uuid": "88661fbf-5ef6-4465-af7f-92bccad583f5", "comment": "Malware payload", "value": "2655cb9a23e7de7143e7b3294c183528a0228c25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139156, "uuid": "7d16e205-33bf-4a4e-9636-0fd2fd3a9ae9", "comment": "Malware payload", "value": "af5abd944c7b93fb0e54808d384df3dcc3777ba3c402bb7c690abab24e16008c89c99815806dcee2b52298c926c36085", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139156, "uuid": "812473c0-6f27-4e82-9908-fe47e2eaf683", "value": "T17B85DF2268E0857DD012A57F8A1FB3246D17AE504A2865C1FFEB26CC5F3F7C16B1A163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139156, "uuid": "16d32461-36b6-4f66-be75-c32ec132d075", "value": "e90c85c71afeeab51059b3addfd33110", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139156, "uuid": "b758e60f-3936-4188-8fb0-aab6f63a39e2", "value": "24576:fBpoBedf5BUa0K30slpT/Qocbtz74shKiAPS9bVUp7620yjBUNPSr7awQwXN:fBVBURW0qjQ4oKu9Op71t7j1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700139156, "uuid": "799e79dd-4fe0-4c9c-95c9-8a7d086e272c", "value": 1750528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700139156, "uuid": "00cce6b1-9531-499c-9602-746bce89a308", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139156, "uuid": "521787e4-96fa-4564-bd7c-fc3da811443b", "value": "SecuriteInfo.com.W32.ModiLoader.YA.tr.6682.5085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ec6fc3-8436-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700107809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700107809, "uuid": "eb45e86b-7789-4647-9a1b-b849215bcf80", "comment": "Malware payload", "value": "0a0600b53524420fff66bd37676a29be", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700107809, "uuid": "741d445d-4eda-47cc-a22e-ca3cfb996248", "comment": "Malware payload", "value": "37c232d654467909a6f6ddcd25d59d81e0c8bb3b5873c8ee46f87d093bc10e8a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700107809, "uuid": "4b3dbd93-24a6-4f4a-8ec7-b677847b50a1", "comment": "Malware payload", "value": "4ad57624e8430efe95a073ccf56c83fd0d0572b2", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700107809, "uuid": "781e14b1-ad7c-4229-80c6-388e8ded67c1", "comment": "Malware payload", "value": "cc34d2bd46078f25f2867c2cf1de3ba2ee4d1c899546c0593dfbf82a4cf44ad67599092289e3e47025b42f8aff0b6477", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700107809, "uuid": "a12701df-760f-479b-b8f9-a09dbd53616a", "value": "T183E5AE03B696CBA2C269D737C5AB090C8770D1817B93DF1B798A236998C37BB9D43507", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700107809, "uuid": "130a548e-451a-42be-94c8-5314cf3e7764", "value": "98304:AM+nx2N2RZyh/woqcPA4nBP9jBml4yYwjWjrM:A782RIBLTACphU4yYwjWjr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700107809, "uuid": "a261b925-1e85-453e-958e-75dd1bd65431", "value": 3289088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700107809, "uuid": "3eac3ffa-a749-4c4e-bb3a-2e92d902d3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700107809, "uuid": "f13978c9-6040-43d6-9572-26d2cde6d425", "value": "0a0600b53524420fff66bd37676a29be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54abfe40-8424-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700100206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700100206, "uuid": "e437a03e-9464-4aad-b897-4269ce6b0304", "comment": "Malware payload", "value": "ee49400dd109cf2d3f46eb01c721b90b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700100206, "uuid": "fa1e914c-1d39-4f83-98ec-470e2e69fbef", "comment": "Malware payload", "value": "39c8e9229a2789a66a452eb9ccc656198aef60ab761f4a24794159b91ad67a4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700100206, "uuid": "77e7ed13-333f-47f7-adac-1b163f9a569d", "comment": "Malware payload", "value": "bb979fc37d3f28922354d6ec52fc9ec8c93fe9bd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700100206, "uuid": "2942053a-06bc-4d08-9ccf-d88357504c6f", "comment": "Malware payload", "value": "430b4919263ebfe7fc4dd0fdf36ee079290c0d4afda93863ed0e29ba1d2a00d5cd324def9439103ab1fd145359e1eb4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700100206, "uuid": "ec58dc42-a667-408d-84e4-5a09b516165a", "value": "T156F733B8475A4A9BC2D4F1B01AB7203BF69A6FC245B3314F121DD9675ACD607063B3E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700100206, "uuid": "9c681948-e1ed-408b-8bc9-ffba65f189ac", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700100206, "uuid": "0525613b-e711-46ef-866c-a635fe4e6abe", "value": "1572864:P4/4rzOchP3l27PnTmEkehqJUZO8DTDXzfQ90dPJ5BDkL/K9P+Y3/7:gkqcdI7vyUwyZXLTQ90h54G9P+Y/7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700100206, "uuid": "a817c8a3-06b0-4381-b4b0-2bfbb77823e5", "value": 74295683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700100206, "uuid": "d7e6344e-1eb5-4a97-9c07-e41a4a80c65d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700100206, "uuid": "f6805df7-0589-43a0-a8f0-cc780111e6fa", "value": "chromebypass.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7abba9a7-849f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700153098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153098, "uuid": "f7ea9d71-d88a-470f-bbeb-eca303728c7e", "comment": "Malware payload (AgentTesla)", "value": "7407a2849f0a33f95b2b27b48415e9be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153098, "uuid": "6aacd22d-3718-4fc0-a199-4e38d61b6209", "comment": "Malware payload (AgentTesla)", "value": "3c5e1993db8f454b72132cc7dd4b9180dccaa415b2fa9d0c8d55f768ebeffab4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153098, "uuid": "02b1887a-87da-4186-8e7d-c2ace211380b", "comment": "Malware payload (AgentTesla)", "value": "8544e9fdc67a0635c155756eb346080b61c6f4a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153098, "uuid": "d19fbad4-16cf-488f-bd31-7932bf19b755", "comment": "Malware payload (AgentTesla)", "value": "f2ba74e24f47c598519b94fb45b8d4eda45051173148ed191c4ec9d80053416b5d441a08e35d541108eb0f684b83734d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153098, "uuid": "5da49a6e-f02f-488e-87e0-a89a58b6ed21", "value": "T14315282C21696F8DF7A492FCB1718CFF13A4292F50BBF9F7894DA0D746A97C05502622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153098, "uuid": "4e7078da-5ca9-4ea8-9965-110c70d60407", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153098, "uuid": "4b262b7f-b4b4-4e15-b8d4-7fe8eec8775b", "value": "12288:hO71EuPUpEZA/jGrOrt5KC4uvBHWwWvtmLMdhovYOtk3Gr:ha1XUpE2GrcXKCFWwWv0vG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700153098, "uuid": "947fbbcd-1ad7-4802-93b7-9f4999aa358a", "value": 905728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700153098, "uuid": "c41b211f-2a54-4acf-a871-ac2db232f4ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153098, "uuid": "002f4639-5ee4-42e7-ade7-0d9b1f45d1bf", "value": "INV and PAK.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f43bcad-84bd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700166018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166018, "uuid": "0ee4202f-9f3f-4878-9c13-b8a6f51b2975", "comment": "Malware payload", "value": "5b54051c4e44a7aaecbdcbce005a41b0", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166018, "uuid": "4deeae25-48a1-49af-9f35-9b5c4dbdff6e", "comment": "Malware payload", "value": "3c5ebc274e755e8445ad65ef60db518a5c17fa620b4e3036f301d2030d343f54", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166018, "uuid": "eb7a11fa-3172-42f4-b8a6-008d577f4ea1", "comment": "Malware payload", "value": "83e1ce5be5080126fe30320270e685f49b99dfc1", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166018, "uuid": "021fdc91-6a7b-4aa6-ae7b-57aaf069bebe", "comment": "Malware payload", "value": "ae0f3b361287a651a6048bd61a7c1b5fb5499fd29280235fbb0d99382baa1c7e18d3da943374c2a805a6b30efb11ed45", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166018, "uuid": "06f5244f-7f60-4c1a-8c7b-0080060a92e7", "value": "T150F3566DD38B01AA8F52537B9B5B0E4845BCBA3EF34511A5306C437933EAC3D61262BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166018, "uuid": "0f8d7edc-5284-4631-bba1-130d7606e2a7", "value": "768:7wAbZSibMX9gRWj6SSem273an7sxAGWIHYhvcZZTMDYXqy:7wAlR4Sem23acPWkYhvcwYX9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700166018, "uuid": "2447857e-7833-4d28-8dab-b9d736d00dd1", "value": 171753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700166018, "uuid": "4e408630-b88f-462e-a47f-ef31938c6a33", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166018, "uuid": "de418277-31dd-4cdf-9433-6774bc373927", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.29506.172", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908b950b-8492-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700147552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147552, "uuid": "36602e80-0f07-4240-9d20-5fa781e50340", "comment": "Malware payload", "value": "9cfc677c374488719d07bc69d9f57529", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147552, "uuid": "df31c166-e473-4237-8660-7e079e51e69a", "comment": "Malware payload", "value": "3c8aabebc671990517968a7a761f265ebb53a4595d27d25567bd4606894025d5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147552, "uuid": "52fa4a1a-07b6-4da6-ac0f-152ebc537bca", "comment": "Malware payload", "value": "1d7e27cf67262709ef6b0a52f45ac513ce0924ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147552, "uuid": "4eed9db6-8172-4a65-8ae6-e2db1f2278f8", "comment": "Malware payload", "value": "e0a2f04846dcf04c357fd04e0169cd61ac2347a7d0c7d76d62ebf5b0f68f27a47228e643fb58988798b3db3b2e5573c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147552, "uuid": "0c3aeebe-b507-4ae4-b5cc-d83571205549", "value": "T11926BFA1D2F0550CF4DA467B9E6053E86273B42277A3E35ACD06D5AAB06C7D38BC0673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147552, "uuid": "e249141a-11ad-479d-8f86-0d4bc9cb6e42", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147552, "uuid": "0ef2795a-b014-41a1-aaaa-4ba2bd5bd06b", "value": "49152:2xNjytQ7IMcZxrdqFzILdCPE2OfC857pwt1UsA8wueAORMjTW0CURNABR36+HmKy:MuMcZz9LdfC+lpueDKklvw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700147552, "uuid": "3c444584-d34b-4269-b4f0-97f71da60aa9", "value": 4790168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700147552, "uuid": "2661a024-18db-4331-94bf-a878fd425b5a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147552, "uuid": "a18eb6dc-3d35-456b-a466-5f15c0494491", "value": "Payment Advice Ref 4567TR TT757.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648a3190-84da-11ee-8907-42010a9c0042", "comment": "Malware payload (Sodinokibi)", "timestamp": 1700178401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178401, "uuid": "af2850eb-0c94-47bf-afb8-782edd56ec36", "comment": "Malware payload (Sodinokibi)", "value": "340b6f816bfdcfcb466cfc126c976844", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178401, "uuid": "6a02ca87-1343-46be-a93d-1c20e8d4e002", "comment": "Malware payload (Sodinokibi)", "value": "3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178401, "uuid": "1983ed7d-a614-4088-8dad-78fb6d70d852", "comment": "Malware payload (Sodinokibi)", "value": "e2e3adfcf621166a9f5bb7ee9795b7914cda2095", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178401, "uuid": "3ff95cda-b45e-4290-8a27-277540a93457", "comment": "Malware payload (Sodinokibi)", "value": "e6734ae7e5563880fa31967ebc84b12559e5e7b8bf423907306c3857e8b8b227dd2f7896f2584da44895a184ee16680d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178401, "uuid": "102012a5-86e2-4a40-a086-d89fddd6b45a", "value": "T188F3F127E86182B3C8A780F3133F3E2BE6BDFE7441196426DB715D443A69092F617593", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178401, "uuid": "36197666-3905-4bd4-946f-1f6cbfc4f96e", "value": "7ecacfc6f1d64067e0047425ad885408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178401, "uuid": "df855e74-ed28-455c-bcf8-cc5c5c56f51c", "value": "3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QLOoBB2W:ZJ0BXScFy2RsQJ8zgLOYB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700178401, "uuid": "2ab5c2b4-2168-4e43-b048-92da097074ca", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700178401, "uuid": "5cc86a70-7778-4839-bbb5-d7df844f25af", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178401, "uuid": "4a313a5c-a55d-454f-bd0f-93c22a734800", "value": "3cff33197edc918d47d08f44d6ddbdda157337f0ad58288d15746cf72c0e4c57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b13f0167-8421-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700099073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099073, "uuid": "77e0d706-4d59-400d-a925-67f62a43c33e", "comment": "Malware payload", "value": "993479789ab17e3c15638358e06c6c49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099073, "uuid": "7e5e4660-c7f8-467e-a8b3-4c15e4b1dac1", "comment": "Malware payload", "value": "3e23c3ee33d73dfaa575173e9467fd32e7bf14c33723b19691a91abefb283ef8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099073, "uuid": "46690a12-26ea-4f2c-bd2b-062c86d5146e", "comment": "Malware payload", "value": "48b6a1f0723d529218fd80aef25eba603f2106a3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099073, "uuid": "b535927d-9cbf-4d06-b990-b210646ec554", "comment": "Malware payload", "value": "bde7ba98bdcfe1306c42d58d59a2be2349d72d69f86d8b81e6160cba09908d5f8a6437b5c0df2e72f45441de60f12a3d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099073, "uuid": "6929e2dd-d993-4ff5-9b90-3a2f388d625e", "value": "T1193523068BD89072C4F5077099B717930E36BDF68C78978B23459D890CB2AD6F536B2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099073, "uuid": "2459cdcc-72ec-46d6-af80-8de87dc24afe", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099073, "uuid": "826456ef-0810-4761-b0fe-12599e7825ec", "value": "24576:lyny3IFy5r7esAt6uLvbxhlW63fHJXBqmFl2/c7zoP3Kq+1aC:AyJxeNcuLNhlR3/5nw0wP6q+1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700099073, "uuid": "7956c1fb-d155-4d0a-9d0a-ddc0d4d55342", "value": 1133056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700099073, "uuid": "8bc7b844-3ef9-4334-b939-b7f83b28bb87", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099073, "uuid": "73723acc-ceee-4c56-9ef9-e9b270475ca3", "value": "993479789ab17e3c15638358e06c6c49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dda84a9-84da-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700178337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178337, "uuid": "a5534f8f-2982-4bdb-835d-17a2a0d57658", "comment": "Malware payload", "value": "422f5cdf619404563b0c3e249bd121d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178337, "uuid": "6a0a6f9d-8def-4c1e-a7c7-8ff92538a1fc", "comment": "Malware payload", "value": "3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178337, "uuid": "02d4f0ea-705a-462d-9931-0a4e1527578e", "comment": "Malware payload", "value": "1a364144342602074a8140ec4da5eb4f0be26274", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178337, "uuid": "957727c5-1e0a-42c2-a7c3-49faeb3caef8", "comment": "Malware payload", "value": "fc207fdb33a73d3038f6c8cc190456e129512790e12bc82f34ae15cd688f5ed09eb7842038a458e97865d2c2af9d2eb0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178337, "uuid": "1211d0fc-0f32-4ff8-906a-d6933ed70cb7", "value": "T15FF3C0126D9001F3C9A342F1562F3FA7E6FEF934131525DB8361C5885E325C6BA3A62B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178337, "uuid": "2dd3b01d-4cb5-4cc6-8f47-d25d2dde4ae4", "value": "3072:Hp5SexkWi1Lbi4eTMlwDCnu/q/IF+l4xjwKX9H:JvGWwbnWJ/gIF+lmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700178337, "uuid": "97104a92-53fd-4e5b-b87b-334e4e8ac6b3", "value": 164864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700178337, "uuid": "b06aba1b-d119-4711-a987-f2abf3560459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178337, "uuid": "eb40cbcf-16d3-4b68-b032-0c01a2f0338b", "value": "3fdad99a17a6766fe396081f82394f5e2da0142651427da64a5b6e28c9df2fd4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf21e745-849f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700153213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153213, "uuid": "e39f8288-471d-4a20-ac67-b8b290ada56b", "comment": "Malware payload", "value": "a40ba2b2180704fc9d02569aa87ae177", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153213, "uuid": "a153b103-5b83-4111-853e-9f5fcc3ba252", "comment": "Malware payload", "value": "406d734041e56066a93b174db78dc6a166cdfe9a710484822c6b06b7291fddae", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153213, "uuid": "b35decec-cc8b-409e-b288-b0a3aa738d57", "comment": "Malware payload", "value": "21779ee9ba68353b76f718876d4ce3eb981696c8", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153213, "uuid": "3673e6f5-5edd-4629-ad87-d594695d1ebc", "comment": "Malware payload", "value": "67d5632bba97b4713a2ed15c6c76571ced06a2696facb140c461b3cb14a84bcace1da0ccaee37895d9461e6289a56c4f", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153213, "uuid": "1d836471-ccff-490a-961d-e1d4d9f25175", "value": "T1AFD4233F5E7210A899A67F1CF0F37D870635727F6FE695A2F5A35A8BAC0170069140B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153213, "uuid": "34eae7f5-7a17-4a3f-92a5-8960156682a7", "value": "12288:8GMqRrrdWWbOrosOT5dByklysg4n7fk4CGMkipmSjnKYiG20yA:8GZrBFbJsJkMO7AkiYSeYdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700153213, "uuid": "1242d27d-08f3-42ba-94e9-915abc7c6adf", "value": 642087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700153213, "uuid": "ce53a3e6-69d2-4672-b043-1634039f34c5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153213, "uuid": "30ba9256-e86c-460f-85e8-d68c9917d141", "value": "confirmation.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcb19137-8421-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700099092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099092, "uuid": "8fa44442-dade-49b0-8c7a-b8bd3ba090b7", "comment": "Malware payload", "value": "5b4a87e9f95c2ca15d19e3954ceef911", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099092, "uuid": "1df9036a-7a8e-4877-9296-9bbf4a15611e", "comment": "Malware payload", "value": "4249959b292b1ff31e325395430cd1f438e432fa578d219bdb78983a30019873", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099092, "uuid": "5a9cab36-e2b2-408b-84c0-f6cc0b35907f", "comment": "Malware payload", "value": "141c10e661a37224d064c8b33dec326c126afb7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099092, "uuid": "0fcf2a31-535c-4112-929d-ca466b0e1a02", "comment": "Malware payload", "value": "c3d696e6966cf6e463e9fc68bec4a2644304fef7da55f4f7df46cd7c84ea40578f81f88bcafc2fd3d0c7760688abb807", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099092, "uuid": "b8df7a8c-9568-4b43-8f97-52e675596cde", "value": "T1D47633B479D1E878D282503336A13F61F3E5E70C0D664AA7B9DD470C1FE8581A19EF26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099092, "uuid": "c71d0047-29c2-4590-8074-b944ecb043cc", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099092, "uuid": "98cd0ecf-c301-4d91-95cf-06cbf1271038", "value": "196608:91OTOXOjQaMJDiu8YCYUfapMlxnX6PINIagY:3OTVjQfMLY52lxnXWkIxY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700099092, "uuid": "6f422a8c-841f-4e3f-8ac3-40f880697fef", "value": 7501450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700099092, "uuid": "997b76fc-a5e6-467d-a49d-6ea217ab889c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099092, "uuid": "fad728f7-ce8d-4cb5-97b5-551733e144bd", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1512005f-84da-11ee-8907-42010a9c0042", "comment": "Malware payload (Sodinokibi)", "timestamp": 1700178268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178268, "uuid": "8032949a-fdd1-4785-bca2-3c9b2b809855", "comment": "Malware payload (Sodinokibi)", "value": "43e9093ffc8dd69985a9ae65b26f5551", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178268, "uuid": "45e87eff-b6d9-4618-940f-78dd8f3d7c6c", "comment": "Malware payload (Sodinokibi)", "value": "42c28feb23c992a350673d63413bf11bc816d00a079462ab524934219d46430d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178268, "uuid": "90832b50-cd6f-4772-8876-f07aacd98750", "comment": "Malware payload (Sodinokibi)", "value": "7b268ff84e824ddcd8b7df3cf9993be012489d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178268, "uuid": "048f187e-451d-405d-90f8-36e8b3c11e48", "comment": "Malware payload (Sodinokibi)", "value": "173da48ad045f42b323ee5927066d6fcbcb675aaed152504b31218f0682ba8022cb569f0181d57601b689ba71e693edc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178268, "uuid": "c47571e5-bdd8-42d4-a557-65e992f85d12", "value": "T1EEF3F123E89187B3C4A751F3033F3F1BD6BDFE7401596567AB7188082A65092F217A97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178268, "uuid": "5f1a7d18-69b5-4bd5-b07a-7383891d72af", "value": "7ecacfc6f1d64067e0047425ad885408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178268, "uuid": "9e369547-6d14-4d63-9138-fa9888621901", "value": "3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QG9BEJfMt0H:ZJ0BXScFy2RsQJ8zgG9jt0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700178268, "uuid": "c7ea3916-0bdf-4705-99a6-79e0f445c89f", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700178268, "uuid": "ee530ed2-2fb1-42dc-912c-8cdbac3b6257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178268, "uuid": "219e6fa6-b7c8-46d5-a626-17b818b678ec", "value": "42c28feb23c992a350673d63413bf11bc816d00a079462ab524934219d46430d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7218dc5f-8481-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700140199, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140199, "uuid": "fe730d7f-1e68-4e22-ad80-bf9241553631", "comment": "Malware payload", "value": "2b5de32d0cc0ed3e3bf04b6fa0614234", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140199, "uuid": "34b46d03-1a01-496f-b670-0f18356c8b8a", "comment": "Malware payload", "value": "44d9cfd20aecce36b5ceed64bfdf0ac84aad28b27985ec5e2aa498605613effc", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140199, "uuid": "833cd052-4816-437c-9f41-84c045a1374c", "comment": "Malware payload", "value": "9aeb0503681e070f51dfdf330bb43c360f9939ac", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140199, "uuid": "1d57156b-685c-4430-aa71-33abc7fdcecb", "comment": "Malware payload", "value": "ca6dfbbaa857712691c8a5dfa06060610c01f2547ec4aaa18d7d2abf27b7ca7744bc670c03d691c65d4bc808f5d117f8", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140199, "uuid": "3f344ee8-57e6-4ebe-8cec-0b980bc819d6", "value": "T13EE42306353CEEDCE7BE5A780AB64DE14D194ECC369B9A0A02750FA5875B1D8083E7F1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140199, "uuid": "547bddbc-963d-4575-b55a-a7099e65f4c4", "value": "12288:BpvHx3dnpDtQLUKROLgc3jAdxQPaQjtzz//rC+Z3/L02Cuu/jQpEJKLWkOnIdMoN:zvHx3hpDtQLUTLsUJjJ//O+Zj+7kOnIB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700140199, "uuid": "22e1cf9c-dab9-486c-a880-e02336b6e644", "value": 688405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700140199, "uuid": "151bef69-5c38-4403-990c-c1b339de7d7b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140199, "uuid": "fbffde21-2cc3-441d-aa6d-6e41e3261128", "value": "DHL_INFO_10.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f522923-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700117055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117055, "uuid": "2f46193e-8b54-41e5-882e-332e3b79d351", "comment": "Malware payload (Mirai)", "value": "96abd0b4deb728f72ed91cf4c00688d2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117055, "uuid": "f723ab70-3095-437b-b423-8d1eae796a3f", "comment": "Malware payload (Mirai)", "value": "47a79e2b2ec3ce945f09f4c11feab7d6905c57c3b3ad73e3ed4ca11016f479d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117055, "uuid": "d1dd324f-e9c6-4f73-b75c-8c4b3cee17a3", "comment": "Malware payload (Mirai)", "value": "db06facc969744b348069f6f10334813749e638a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117055, "uuid": "2aff61fa-542d-483e-94c7-a2741b797119", "comment": "Malware payload (Mirai)", "value": "921fd5282297815615c2ad21a3cabb840312bbc095fec8f4c597b6fd25200fde03f4c350cb43b5b7cf9a4a87b0d562d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117055, "uuid": "48391abf-8c8b-421a-91e4-2dcc10e907fe", "value": "T1BE33198D64112E6DDAD65CFD90624F0E9D505220B4A3171FA3EFFDC339332A8EE62909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117055, "uuid": "233e4814-7bd5-4b10-804b-49a76297183f", "value": "768:IxxdecLCi5zZUmvufH3C47Re0kX86oWqnGvM7AGZ7OjUQy+f1prR4jHZqEQeW8:inL9zymWfH3CA9V8s7OjUDg1pt4Nqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700117055, "uuid": "036870da-ab82-43e1-98b1-5fbbe42f910e", "value": 52960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700117055, "uuid": "e7e63629-f20a-4be6-986d-49a4cb325384", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117055, "uuid": "63e24b92-fd65-4643-aea3-64612607a25f", "value": "96abd0b4deb728f72ed91cf4c00688d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a1b43fb-8492-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700147541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147541, "uuid": "3625af1f-9e90-4dd1-9c8f-0e79eda10b3a", "comment": "Malware payload", "value": "a533ca80891d30fedaf6c14f2427bbed", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147541, "uuid": "fbce4e9d-3bbc-4906-8f1b-4a6ce363d444", "comment": "Malware payload", "value": "47cf2d1830f75e4c47b8b2b993a549236d19e8eb461406c34c8f6ce8efb8842e", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147541, "uuid": "a8361852-c5f9-44ae-ba2c-58250ecd0fd6", "comment": "Malware payload", "value": "48e7bda81fab50e64d34af5079bc42788cc22ab3", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147541, "uuid": "4ac521c8-0560-485f-988b-9ba5ed405d34", "comment": "Malware payload", "value": "f2d86fb0e575fb7d6ebc0239385f2c3da6b9b3d335f9ecf57da758105e82e06e4ec3af7e7983bc1ea4d708c7b538c886", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147541, "uuid": "14ab217c-7998-4cca-a29d-1c064a4e8c23", "value": "T19FC53347CB2517FEDF078904A5F25C1B322BC19D9306F3F2629690397B092B989A75B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147541, "uuid": "16cfbb58-74ea-4285-bee4-52052e77bc9a", "value": "49152:aDVN6c6yA1Z0guF5WZ5ISTwCb+fhjDC2rP8CVOHf0k6mBapr3:aDVt2qgunWZk5fC2zHOH60ap7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700147541, "uuid": "24351da7-fc6e-4898-a00a-81913378ae41", "value": 2661646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700147541, "uuid": "7f8e9365-e631-42fe-9738-e383fb22f776", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147541, "uuid": "02fb43a1-1f8d-4ad6-b5ba-485ba49cfa63", "value": "Payment Advice Ref 4567TR TT757.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb1d7346-848b-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700144697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144697, "uuid": "4b4fceac-30b3-4eba-a222-5c0c5676231c", "comment": "Malware payload (AgentTesla)", "value": "5f2bcd565f28a383cacc56522f618643", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144697, "uuid": "0dce306a-44ed-4476-98ad-5e05f2edc33b", "comment": "Malware payload (AgentTesla)", "value": "4da7a20e6f4991dc19fa6fe495f08f677b0ef8cd718e6a860b530783b6631bb4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144697, "uuid": "9945c69d-c933-4c1c-8bf6-bdf9c07b4d87", "comment": "Malware payload (AgentTesla)", "value": "399f89fdf891c10b3cc77007f8e2effe44bafd86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144697, "uuid": "c41e9f4d-6880-41e5-833c-b3add8a63ccb", "comment": "Malware payload (AgentTesla)", "value": "73c176baba473c8b6e5a8eee1e714b44e5d11107c5abc06eb542cbde7ee1759da9ca13405983da8f53be1d428a8dee9c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144697, "uuid": "5bd8372e-f2e4-4137-bcd9-cea955d87ff9", "value": "T1A305BDB421A5E7E6C7B987FF586344704BA7AC166175D3883EBE30C90DA1B834A51E33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144697, "uuid": "be531b46-78d6-43be-aaa9-b08fbaf80996", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144697, "uuid": "53fa7da6-bb31-4c35-ab07-20df9c57cd87", "value": "12288:uXkRp2iNkuPF33LV1mt/rJAzJJWcscg79EjXS9ahqBajGVfj1rI2XLTEShYZ1:xp1l5bvuq18cscg79EjXSjfXXEo0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700144697, "uuid": "c011b59f-345d-4907-a91b-19092ae1da1b", "value": 819200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700144697, "uuid": "8d65568c-898b-4f9f-bc79-2baa733436b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144697, "uuid": "f056ef97-dc9f-4d95-a2bf-4ebe1c1e1e2a", "value": "SOA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "307c5de3-8462-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700126775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700126775, "uuid": "5efa1f61-4708-4f56-800e-f54f9d3e6b42", "comment": "Malware payload", "value": "fac7ccc940aef2def5a1869a94e9f968", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700126775, "uuid": "c2f62e91-765d-4b57-b8b9-254adec5a4ca", "comment": "Malware payload", "value": "4faa085bd6d92df1a2c0b38fb3a17c30d8f49d9d1bbe9323522278af0cfec027", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700126775, "uuid": "a2e7dea4-7ab0-4584-9b98-1e67ce35c601", "comment": "Malware payload", "value": "3a197b0e871edeee832198ec96b59bb88bd47788", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700126775, "uuid": "acbffe15-a882-48c8-9530-2e217e08f679", "comment": "Malware payload", "value": "8f1d8d86149631d47ed53cd86d78e5e73657dab80953685dab05a100ee3df5084d2bdd2a47947bc7c1fdf8066480fc1e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700126775, "uuid": "a5d39f02-5c82-47ce-92e7-480c2fceb9d4", "value": "T106E42309DB9E9952CAEE02FB580158E8A7B49097F293FBD31DC163738E837C6041679D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700126775, "uuid": "91a545c5-af2a-4f92-8305-22365cc7464b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700126775, "uuid": "c7c78916-aeac-4e0c-9f39-07d0ed0c0464", "value": "12288:qe6KzpXLGoevHlbb/f5BHwJn6pyxPFSff/YaY5F9jmNjjF2VDbnKv+:qSzVev9wsyx9SffFg9jmNjjF2Va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700126775, "uuid": "d5d04c87-198b-4895-be9a-e3ccff0cd490", "value": 711168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700126775, "uuid": "d4f26c2d-2211-4915-825c-8c72d2f2f8a4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700126775, "uuid": "de5d07bd-2b46-4258-97f5-5a677d90d1fd", "value": "ZAM\u00d3WIENIE_N.2311780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae63d019-849e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700152756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152756, "uuid": "7d77b08a-63ac-4f6a-8c75-109cc833b395", "comment": "Malware payload (AgentTesla)", "value": "2a62b3b50dc20a361eaa8956ca312a81", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152756, "uuid": "fb53dd14-ef41-4d3e-ad77-110f8ef7a0c0", "comment": "Malware payload (AgentTesla)", "value": "4fb354ecdf9b230311b7b6bc60b1016f5f17653a1653e1c6fa1fbbbc92a08a30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152756, "uuid": "4eedf3ca-a244-4e0b-91ed-b0a205765cc3", "comment": "Malware payload (AgentTesla)", "value": "835dce3de7679964b51f14c1d7efeac5e795fbf5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152756, "uuid": "1b1e23ef-e040-4ba8-9bc3-f4f5b0ad1218", "comment": "Malware payload (AgentTesla)", "value": "c443f5d78efeb0a7962db955a34b459c66be1fb346f8ca86c11e5a7f9f94234fede950511df077a566b33e8ca4ce75c4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152756, "uuid": "85351500-ca00-407b-b70f-b2dfd8c6f239", "value": "T133F4ACB420A9C796C77497FF242795301BA7AC1A55B6D38C3EBE70C90DA5B834A40E37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152756, "uuid": "14353bfe-ac7b-49df-b192-8f92a7294cf4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152756, "uuid": "8165844f-275a-4e1f-b02f-2529128440c1", "value": "12288:oXkNp2iNkuPF33L1BL4yE8M37kEGMj9WHpP92tMRdIrHVTlcZxB8Dbya24vA:fp1l5b1et8iGMj9WJPIMRUVT6ZU44v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700152756, "uuid": "66317d63-1469-450c-8901-76781d78784b", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700152756, "uuid": "ce184a3d-1e83-462e-a2f4-f7d5ec445f83", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152756, "uuid": "fc0f5033-6537-4958-9ae3-a76c602eeac9", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d00e777-849e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700152512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152512, "uuid": "5bf6196b-c919-4eee-a0e5-5de9f21bfbe7", "comment": "Malware payload (AgentTesla)", "value": "d1ec89679bdf01f15c8a7116adf6eb2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152512, "uuid": "c5742087-7043-42c5-8247-f7b6f65c0273", "comment": "Malware payload (AgentTesla)", "value": "4ff941485883fed31d9aa7d36b80094dc3c40498334ba9cc58cd5a40775ec56f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152512, "uuid": "d4a55319-2b8b-42d7-be86-53bdeda60d62", "comment": "Malware payload (AgentTesla)", "value": "f095f5ec3c8d863487820058c996ebf4aed3ab1f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152512, "uuid": "fdd8d762-427f-4707-ab48-dc61c27927e0", "comment": "Malware payload (AgentTesla)", "value": "c7f072316025773b9b6dde43d721fc6106998d021fd7901892af592cce5a3e5ca7bedca0332a6f28322db54438a28aef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152512, "uuid": "33d82016-fcb8-4b54-b747-f2141f72d844", "value": "T1FE05BCB821A9C7DAD3B987FF286740705B67AD165174D3893EBE30D80DA5B834A11E33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152512, "uuid": "38c573c4-2bf8-4b1a-97b7-2e2fd6405f2d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152512, "uuid": "15b06eef-b56a-4737-9778-de9e34141ee6", "value": "12288:zXkSQp2iNkuPF33LfJgYNRavVZhqXl8HeqC3LZ+fblr7ya9Pc9Z:NQp1l5bxvivM8C3LZsyw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700152512, "uuid": "ff6a1ec7-ca24-439b-b1ed-8f0f9bb8d6b2", "value": 820736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700152512, "uuid": "919a5732-bcb1-466d-b2d6-bc19240e1dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152512, "uuid": "befa459c-ce78-4504-bd5a-369666d35fdc", "value": "Quotation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "665c6aae-8464-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700127724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127724, "uuid": "3908b630-548f-4de8-a66e-6e11fdb332c8", "comment": "Malware payload", "value": "696bbf18a42dc0a7b6e1a8f7fdb908e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127724, "uuid": "3ff148a4-f92c-4ca7-894a-4434c2c73680", "comment": "Malware payload", "value": "5086698d16ad4032c245ab11ce33925a03b372fd4ce5b687b450361ec1ceb841", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127724, "uuid": "d7e3d089-6406-4422-997c-5108053333cb", "comment": "Malware payload", "value": "8033d843e95d6a67413116a81b278bff17afc217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127724, "uuid": "9cb6f631-b370-4bab-8f0b-799fc4f7ea17", "comment": "Malware payload", "value": "a06266df17e81c023b4e9fba2623476f17cdb26f4cd5aaccc1e1d9e44f13cfd465ed1840016449124b06313946ddbc7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127724, "uuid": "533ec5c0-d502-458d-8c5d-8ca354b6dc3d", "value": "T1F5442943E2D1BD50E9268A369E1EC6E8321EF950CF6D7B6622197F2F14B2173D263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127724, "uuid": "c2c5fd16-8fd8-4971-80f8-07ef8adef1d0", "value": "3c071df9f91908eb18d041533a3c969c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127724, "uuid": "bb12300d-dde7-4207-9a94-11840d92fcb8", "value": "3072:5EfLtnBeJkgH8HGH5gR93IcxX/Ij+P/3sEM5HfhcOoRWx1KsicBIr:mLtQheauIcxX/k+P/3s75/hnxqP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700127724, "uuid": "9b21fe55-d737-4df8-9698-5e3a335079bf", "value": 257536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700127724, "uuid": "310e51ca-fbca-495b-8b9d-71c25708f72e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127724, "uuid": "41b2262a-4faf-490a-89fa-28582877a3b0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78d2d3da-8481-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700140210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140210, "uuid": "caaeee9b-d0a2-4433-a96e-c7e3d9ac9528", "comment": "Malware payload", "value": "672cc458101948990f807ed1a64dfba5", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140210, "uuid": "a27ea423-3fab-4e70-ada6-39ec55849e75", "comment": "Malware payload", "value": "51b917b4a0d3eb587f3308178bab11e5e8b63b61a7646a514567b2b39eba7cb2", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140210, "uuid": "d4c0c50c-bc6d-4b42-8879-8e5cbee71945", "comment": "Malware payload", "value": "1bb219126e8679da64a3f9ca1a665e5449b3fdeb", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140210, "uuid": "4dacf92f-3c35-4038-8a25-bfaea4fd4755", "comment": "Malware payload", "value": "e6a8dc1f87c63197fba5fcf6eaf1fb04fd1311ecd2438c04a4e8120e98cd96be69880c8042118ebc582532b8bf4ca525", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140210, "uuid": "8790f585-5950-44be-a8ab-ebf63569da55", "value": "T15474234D9A9DCE745412A709CE0A32FF76B490EFFEB080463649021D1D996CB8764BBF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140210, "uuid": "c1de5f8a-ad91-4d68-b69a-539d2aa9448d", "value": "6144:EW4GZtHR9pZ6ddyu5L8n+VMS3nOzKzJVi7qdV0CmrG5UN0Kbt4Sumhc9H7:drn2np5q+VM8OOu7KVAo00K54jF9H7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700140210, "uuid": "092c223f-115d-4728-91d3-4676427efa60", "value": 359403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700140210, "uuid": "1597b307-d3fc-495d-b7dc-2767653fadf4", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140210, "uuid": "f763f585-ad27-4261-a099-564bec9dabe1", "value": "MTO_1.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241707a4-848d-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700145222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700145222, "uuid": "c41953e9-3a7c-4a7f-b10c-51d4eee87979", "comment": "Malware payload", "value": "a112bf1f92a3dfe9a90263870d848d4d", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700145222, "uuid": "91a2291b-f045-475a-872c-72a87f0f8420", "comment": "Malware payload", "value": "52b9738156333fe91cfb8facd9fa6dbc31427141548883c537dfbb2ec395ad1a", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700145222, "uuid": "369b958f-1e21-4065-a889-f78b2db64b3b", "comment": "Malware payload", "value": "6c75c69ff0b6a31daffc3dbb0698b2551467ff17", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700145222, "uuid": "d55fc6b9-a624-4bb9-8f42-6dcb41ac28fd", "comment": "Malware payload", "value": "182ada40e38aece83c801f60fdc45ef72cec019516470c437281292b9718cc456274aeb63268526149ded48fba03d785", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700145222, "uuid": "54f6ef37-bb1d-4a04-8a8e-3b5cca4cc0c0", "value": "T167B49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700145222, "uuid": "e632a72b-416b-469d-ad6d-1f93bac856ae", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700145222, "uuid": "9512fe2e-a007-448b-adf7-fc1a4b42bedd", "value": "6144:texbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7ZpUlLaEx:teZeWSpda70ADIgSoxgUW/zFun7OjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700145222, "uuid": "41e3c71f-1ca3-4d29-933a-801ee36952f5", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700145222, "uuid": "7cce37d8-9179-4f3d-ba81-45abead91334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700145222, "uuid": "69d6b097-73b2-4d81-a571-78b16052d062", "value": "monscan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "483f36bf-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1700116936, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116936, "uuid": "ca08c890-c483-4c3c-82a5-56bf707d590b", "comment": "Malware payload (Gafgyt)", "value": "89b2ebae0c71ec720ee131bc18b59bc6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116936, "uuid": "b48f8e7f-196a-4dfc-b17f-37712528f4f5", "comment": "Malware payload (Gafgyt)", "value": "52f5bb76be39dc1916a6f163fe55df902adace65f31aacd546f50600e84787cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116936, "uuid": "353689bf-96d5-4cb8-b4d3-712ad48a5166", "comment": "Malware payload (Gafgyt)", "value": "3d7fadc63cd3814dfc8be87cb2fb39bc03141c15", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116936, "uuid": "55d1794c-eac6-478f-8c2b-066fbf0aedcc", "comment": "Malware payload (Gafgyt)", "value": "c509c3c25a85339d6eb7442d347aca6c4256656160af95509a89f6161f2b4d2d25c6f852337fb67e6e9b03a96983322f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116936, "uuid": "306d401e-9846-43c2-b447-abb2d68584d2", "value": "T1BEC3E730E8044B1BC2D223F6E75A869E3F351E9797A733155B3879B02FF27991E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116936, "uuid": "5f7ef2ae-f3f8-464c-9e97-44548f884998", "value": "3072:4jDy/+mh1vtbPIKafbpcUPium7/L7QsvmGfIiNb:mOJ1vxfafbywm7/L7QsvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116936, "uuid": "6ecd55b3-2b20-4fff-8db6-90938a22a2fd", "value": 125008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116936, "uuid": "139fb974-6ab4-4e86-8570-8f53f565ad63", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116936, "uuid": "79553e97-c6e9-4bf5-aaef-ab7297f5a05f", "value": "89b2ebae0c71ec720ee131bc18b59bc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1f6be96-847e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700139098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139098, "uuid": "0c9f84c5-f0f1-4e37-bf52-f95392d4e8cb", "comment": "Malware payload (Mirai)", "value": "89cefb36eba728024b3cf33333576c33", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139098, "uuid": "dc623cfc-3216-46b4-b837-9cf187ae11ba", "comment": "Malware payload (Mirai)", "value": "547c60493fb18069e12df2c32f4780b9765063e9f3fa73278c957c08f424c851", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139098, "uuid": "749fa404-57d8-435a-89f5-eb5d50b91a85", "comment": "Malware payload (Mirai)", "value": "8cc447da04bd7b3c8b2035cd13ab30c5085270a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139098, "uuid": "52de5dc0-1dfe-4b35-b3a3-95e2ce952553", "comment": "Malware payload (Mirai)", "value": "9ad4e60001817f8a608d8e983074b687903fe8ad4a5ead51ac925ce5a4b52ee5569ab816630704ce7a5014569d7698f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139098, "uuid": "6248f8c4-1c66-4844-8e29-03119ceb3b75", "value": "T1AE233921B97A2E2BC0D8A4BE51F34324B2F9535E25A8C62E7D320F4DFF64940A1536B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139098, "uuid": "b60bfa99-7385-4b69-9b77-cac7c2f7a022", "value": "768:ITo1qbq9jfHdFCZBRQlgT8rlSDyGdgwA4XthwMjO+C718vk:ITCqbSjf9FgBRQlKLfpbXtk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700139098, "uuid": "80a49e62-5303-4a10-99a3-55e5bd92bd48", "value": 46948, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700139098, "uuid": "bb1e5261-a46d-4477-88f1-a5580534a99d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139098, "uuid": "74857092-2be3-4e2b-8b83-4d703c92ee9f", "value": "89cefb36eba728024b3cf33333576c33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bfe14d5-8496-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700149181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149181, "uuid": "00cb5d21-a42a-48f2-b57e-b3f8759cf0e7", "comment": "Malware payload", "value": "f33fab2037146cf0ad7e52f493401e15", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149181, "uuid": "60ec96ff-72c9-498c-b314-9b0ee62028cc", "comment": "Malware payload", "value": "585d9696b6875fb0d009ba282596d75ea409b88ba27d125996d791899d008d68", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149181, "uuid": "33322366-5994-4940-9881-323c6de95e48", "comment": "Malware payload", "value": "022ed75acb1834c9e4f8c3219b07602e5732410c", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149181, "uuid": "02bb7b28-61ab-4e41-852a-4b0095e5c4d8", "comment": "Malware payload", "value": "4db1a5755b1b469d13b302ceac4ef9ed7c09659c5509981cd25eeb30d99273c576abbb6453dc3025b307aa51c5380eb2", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149181, "uuid": "ac237853-aa77-4dc3-b223-2d42b25bea2c", "value": "T160B4236118C986F112D265773D8D3B081E5826D72A0F798FBFD8F8249AE29F7B50C706", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149181, "uuid": "7587ae83-98fc-4bf3-8e1a-ff3ac8d635fa", "value": "12288:IbzSNuC99HgrM0pUq+nSwnpZsk7YGgp4Piu5AsZkG6s/K7oko3:nrrgr/+qCSwnpqkU3pju5tx6sSoR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700149181, "uuid": "6dd04b6a-a35d-49aa-b2b7-5476c7773ac3", "value": 499539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700149181, "uuid": "cf0f3de6-e225-4526-99f6-942d792d3be7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149181, "uuid": "ae9e45f1-4f8f-4b36-8d62-e9f5a9d5ad3e", "value": "wpo28029 Changzhou Tairun.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794a2807-844b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700117018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117018, "uuid": "c645e32d-78f7-4b69-b9a8-0bc0a5063980", "comment": "Malware payload", "value": "8294fd480280f2aaaa9774869df11043", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117018, "uuid": "697dba74-03ff-4aad-8b56-5692ebdedd8f", "comment": "Malware payload", "value": "59b74d04dbdea4eb451b0c230b6b6b3cd1303b4052ba8a742322f91e718a25fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117018, "uuid": "09ff7bcb-2822-4152-976c-1f0b244f1a63", "comment": "Malware payload", "value": "2ffae6a675dccd207c144d6e872c597cf822966f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117018, "uuid": "ced7aea4-149b-4bad-9414-1a7ca9382864", "comment": "Malware payload", "value": "ba6502790911be8587bb1ef60a530387af90356db45863ea6ca2057525ead4da9c08378bf76ff19f9ae6be95a538667e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117018, "uuid": "c5dee9ea-f7de-4176-a30d-40de8b60d613", "value": "T102B31977A4654F73C045A5F125BA9A310F12AD931B1F1A88763CB6B04A3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117018, "uuid": "e7a0edf4-4cd5-4608-9d69-e9385e366cb2", "value": "3072:MDVLSItJP+Xsp4JlN3HxjmH1cuEgvniuN/:MDV+ItJH2l3HxjmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700117018, "uuid": "f95bc4ba-1db0-4174-9828-4806dcc79fb6", "value": 112633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700117018, "uuid": "68d0ddb2-6fbe-4e6a-b15c-0e91cd6f6177", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117018, "uuid": "41141a21-2473-4a7d-8ee7-f7decc5a8ea4", "value": "8294fd480280f2aaaa9774869df11043", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d8a4498-84d9-11ee-8907-42010a9c0042", "comment": "Malware payload (Sodinokibi)", "timestamp": 1700178041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178041, "uuid": "519549c6-3309-42e9-a707-8a92e0d981e1", "comment": "Malware payload (Sodinokibi)", "value": "8cbc25e4d5c3dd1ee950c9eaaa67049d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178041, "uuid": "617dfab0-0dd2-4c40-b7ee-1946a0990a9f", "comment": "Malware payload (Sodinokibi)", "value": "5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178041, "uuid": "25ed21db-6e7a-4ffd-9883-6615135df63a", "comment": "Malware payload (Sodinokibi)", "value": "2e3bc332df0adf7b9aaffad3e91d55463c858fd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178041, "uuid": "d8ab25b6-d22c-44bd-855f-558f302f327e", "comment": "Malware payload (Sodinokibi)", "value": "a8a62dc7418053982d5d5022a299f6cb3ab5d1852fbbca8e00d4270d47c97587df7baa4baa1c0cae2b8819bc96a374e5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178041, "uuid": "c2721a28-611f-41a5-98fc-517af3c71687", "value": "T110F3F122E8A182B3D8A781F3132F3F2BE67DBD74511A68279B714C083E75053E616697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178041, "uuid": "08e05c28-9614-44c5-b9bc-9195c86b2c06", "value": "7ecacfc6f1d64067e0047425ad885408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178041, "uuid": "a59a1f1c-e527-4823-b112-1282803f0c0a", "value": "3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QZcl+UNO:ZJ0BXScFy2RsQJ8zgZcl+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700178041, "uuid": "aa88f2c6-671f-4e23-a0cf-0d2a668e469f", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700178041, "uuid": "62c7d373-39f8-4bae-93d5-08015bcec891", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178041, "uuid": "02a8524f-9e70-4cd1-8ea5-3de2e09114c9", "value": "5cba3e44271279e747a67dd312d4dca18832b5a850ea6b85a460846ef0101fb6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "545dddbe-84d9-11ee-8907-42010a9c0042", "comment": "Malware payload (Sodinokibi)", "timestamp": 1700177945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700177945, "uuid": "5898b9e1-f5bc-4345-94cb-63f86e04a9e5", "comment": "Malware payload (Sodinokibi)", "value": "17d54fde8f0dca439f4c32a02598e382", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700177945, "uuid": "fa65c927-096c-4d64-8437-4392bb227cf2", "comment": "Malware payload (Sodinokibi)", "value": "5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700177945, "uuid": "056972e5-7ee2-4bc1-96d9-38e41d57236d", "comment": "Malware payload (Sodinokibi)", "value": "5eb54861db41b62e9fa296f703f06b8e52d1941d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700177945, "uuid": "2a32dbbc-ea22-4170-a169-b0b1b5550627", "comment": "Malware payload (Sodinokibi)", "value": "412b6c5f67f436a1e05f62f1503b93439387966f721c41034f3483177bb2ea0fa85599afcbafab83b4c19af6c57872dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700177945, "uuid": "3928d22e-9a50-4efa-9dc4-09e85531402b", "value": "T122F3E063AA6041E2D4D300F3032B3F6B76FEEE385025667BE77155489A751C1F21BA2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700177945, "uuid": "47961c3a-e9a4-4e0f-ad14-24dcedea7fb0", "value": "c88f20b29592f2107a629e815db6afae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700177945, "uuid": "92ae2143-3da5-4cb9-b777-c24f2d9407a4", "value": "3072:ffYWjswg4fQlt4ndm8jX5IXzs+M9VQHDOVFI0kmit3:ffYWAw9fcUdmwIXo+M9VQHDlZmit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700177945, "uuid": "e24059fe-f7d7-468c-90ff-f62c2c2c3156", "value": 167936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700177945, "uuid": "eebd1284-5a8e-408b-a5eb-9be25a175406", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700177945, "uuid": "5347e1ac-17ba-4726-af2f-e7e431bce2f3", "value": "5d9b75e2cb84333c6b56604ce47af75b11f80bf9079054f6619251b68357d87c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2c0c2d4-8443-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700113652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700113652, "uuid": "052290be-4863-47a7-be98-cf623c814484", "comment": "Malware payload", "value": "b03255c3d620eb4d9e69c958a2d641d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700113652, "uuid": "c50a1985-5d9e-4641-8e07-398e05b9066c", "comment": "Malware payload", "value": "5e1b71c3a8fc788cfdabb6edc9c755258ba218a64fa59e0d6681ed52706d3cd9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700113652, "uuid": "59500286-1460-4caa-b7a2-024bbe981547", "comment": "Malware payload", "value": "6c65f0c3221c3a55f89cedda5cb9bd12ec1fe7af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700113652, "uuid": "d4c09228-db06-4c00-8b4f-7a2212af928e", "comment": "Malware payload", "value": "f3370db190f7a15fb77d67fd6b860c6f806c7487546e9fec28a3d96f0fedafd815fd6278b46a25db18287db675472f14", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700113652, "uuid": "f2103bc7-3f9f-4e39-ab05-0acadf005ad3", "value": "T18A443B43D2D1BC50EA268B3A9E2FC5E8721EF9508E997B663219BF1F14B1173D263311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700113652, "uuid": "e2abea9b-3a76-4fac-a13b-f7675ab1cdd5", "value": "cb006aeb614c0887ced2ab5d10258afe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700113652, "uuid": "e830bf69-a9c3-447e-8904-a447cb6aa2d8", "value": "3072:rjQLLF240TjBzv75udq3ar6+XaMxTpkrR5zvm0ReqNKsiXjM:ILF2LPBv5u0kHHxdGR5ifI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700113652, "uuid": "e6917296-ea8f-4727-ac6a-d14b7cf61018", "value": 257024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700113652, "uuid": "1a66b743-ab63-46eb-8900-5b011b382915", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700113652, "uuid": "3ba9925a-6a12-4879-804a-8574ce7cd326", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cff5a14-8437-11ee-8907-42010a9c0042", "comment": "Malware payload (DanaBot)", "timestamp": 1700108408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700108408, "uuid": "a5bfecc4-577f-404b-b1ba-98debcbd587a", "comment": "Malware payload (DanaBot)", "value": "50afb496cec91682987c87bc9b4cad4d", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700108408, "uuid": "edd703e1-05ac-48c8-b10a-3425e9e0ddf9", "comment": "Malware payload (DanaBot)", "value": "5e5b42ac0cb3163dd4d87a9fd92bc4ec47dcb23ba829df540448d793ecea5fbc", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700108408, "uuid": "1c842935-119b-4e4b-897a-05f7d77c0687", "comment": "Malware payload (DanaBot)", "value": "562d5ff478b66d593bb4a49e290565be9dbee808", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700108408, "uuid": "20993d11-2ccc-46ad-bde8-325d6ab1d403", "comment": "Malware payload (DanaBot)", "value": "c05d3dc63447620db04038b7245a44a703805b459cc2593625686fe928b474ca24824205e917432f3dd24e8b5cc11b75", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700108408, "uuid": "4a5b3b53-4b61-48f9-8d79-f127980f8bc4", "value": "T1DC656E22B248A57EC4FA0A3A4627654C553F77327A558C1E5BE009CCCF392C16A3677F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700108408, "uuid": "3cf4dcc0-eb73-4e4c-86ed-45a06b171b02", "value": "f9e81afd2870aaecd8ace36b2893b1d3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700108408, "uuid": "9a7a1758-9ec8-4fda-84ff-98e5751bdc9d", "value": "24576:4u9eawqFvymPU8ChCNQVw8+6SgImw2qX0TaLrS:RE0ilVwf9mFqX0T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700108408, "uuid": "43df29f1-4216-413a-97ea-572b53b46737", "value": 1419264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700108408, "uuid": "a3947fe4-4896-4041-9da0-8f9fadbe73c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700108408, "uuid": "620b7ee8-0a30-4080-b5a0-74ef430bdd44", "value": "Trojan-Banker.Win32.Danabot.jsz-5e5b42ac0cb31.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c544ddd8-846e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700132178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132178, "uuid": "2e849e8c-2fc5-4014-ab00-0a564dd15356", "comment": "Malware payload", "value": "9447980720dd10e24c60785f20048560", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132178, "uuid": "e0f0b131-81ec-44b2-8c94-ad4db393cd51", "comment": "Malware payload", "value": "5fc7d917b021dfa755b63d001baa14a6f8fb1a90e3ed8f68b2d30ebe2b860efe", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132178, "uuid": "75a360e8-25f9-48c1-97d9-aa220fdb3e91", "comment": "Malware payload", "value": "be0222a6823c505a438c7887208cf5018f007688", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132178, "uuid": "a52571a2-ff50-4b68-8714-4323129b60f8", "comment": "Malware payload", "value": "efdcb68b557990fb07ca4fd6ba7fb3432813909203b4b9fd55fa9b93fdfd1c3f8ee20b32d224a0d19d234134fbb2a9e8", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132178, "uuid": "323d6096-7e5c-4e7e-92da-2a4a28180d2d", "value": "T1CE04AF11759181BBDB9E223854FE6F3AAB7DA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132178, "uuid": "18b2aab9-7278-4f4f-a8e5-aa1c557bdcb7", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132178, "uuid": "ecbab3f1-619e-4f63-a3a1-fff87ea203d3", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLGbVaKoXAxOPYe:I74elpowsxizqyStZlpel5iyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700132178, "uuid": "c1a97078-c00f-45d5-bdb7-4ef06eaa9023", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700132178, "uuid": "8a422fbd-fb40-4676-8821-d87181245db8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132178, "uuid": "7b7e812e-6ee9-47b4-bbdd-4ec68158c67e", "value": "WCUtil_2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c5dffac-8481-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700140216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140216, "uuid": "3b538c64-303f-4b57-b0bc-0926a284f372", "comment": "Malware payload", "value": "69d798c7cdecfb41cb813729dff14719", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140216, "uuid": "50e65a99-1352-4d47-913f-a74bd43c766a", "comment": "Malware payload", "value": "613d36c609ba0c4289ebfcf1236a0a631e409af4b59faa74f229609637185c48", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140216, "uuid": "27218ac2-2228-4ade-bad4-73838fc7c9cd", "comment": "Malware payload", "value": "7a0a7cca0cf6c73a3e2de0f8302b9d4fed4b0153", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140216, "uuid": "6e1e7ae2-4ee5-4083-bce8-543178f35de3", "comment": "Malware payload", "value": "38ab1db67ef9c6894990a1948cb1b99d2a290f9284f33843de99c40d5c58c1f7bbb9286705202bb6631da8759239580f", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140216, "uuid": "b00996b7-2507-495a-ba8b-1f4fa2b50243", "value": "T10CD423E3DFD45B870BC8DB147AC216B6CD82D970AFF60650D87AA8D8E9237493913714", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140216, "uuid": "393a0314-920b-4f31-95a1-832474caeaec", "value": "12288:7xk0XMQ/FVpi9kFfQxeWb/LGfPPGbBsBEaidNgBfAGhFFG/yJsU6:61sVGkFsbjSPGVsBEFdqfACFFG6if", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700140216, "uuid": "197cfe75-3e34-4779-89b5-4ca115d41cd7", "value": 606797, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700140216, "uuid": "f6ddefc6-783f-4031-8825-49451c6f7767", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140216, "uuid": "7595e693-b336-423b-9809-5f6930bc0eb5", "value": "REF 21654 P.O 2023-830715527XXXXXXXX0023.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a59046-845c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700124233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124233, "uuid": "559ad2e5-d6e4-4443-adb7-ad3ead61015b", "comment": "Malware payload", "value": "9125bafd876eda003abefbcfd3280900", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124233, "uuid": "671653cf-18a9-4d4f-9f96-68ce5caf003f", "comment": "Malware payload", "value": "640ef9afce45a61a02970462b829bf37a845948c17d72577dc70c1c21aa55b23", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124233, "uuid": "7ea588ed-3eeb-431d-b264-8b4fb5c7cb66", "comment": "Malware payload", "value": "5d045bdedaae6242de78f8a89fceca748f279a0d", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124233, "uuid": "e8354bb4-6ae7-457f-85f2-cbe03102ac18", "comment": "Malware payload", "value": "ca200f52014484bf390cd11e86bcb7c2e47bcf992c439ecc98de860687c53fe1c3e30d5a8db5bc8d3d8d637c2049bc4d", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124233, "uuid": "70681048-36d6-41c2-a510-cf5b51f5a01e", "value": "T141D0220C8A4EC1A1D0421C1B80D8BE9CAC0DB01429E2C84C1280DA8B9C8A0D4DC8BEFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124233, "uuid": "dbb07af2-ad3c-4b53-a608-5869e64a0e6d", "value": "3:HRAbABGQEb/5sQaOUlFI8EIS5z/KbycAI9RyJ25YdimVVG/VClAWHn:HRYFJb/5sZOMNyIyc1yc54vVG/4xHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700124233, "uuid": "ecc07eeb-9b51-436c-8122-f6cbec152e00", "value": 204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700124233, "uuid": "2216bcad-811b-4108-ab0f-f15f44dda4c5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124233, "uuid": "ecd741c6-b83d-4e71-bee8-80d33201a4ee", "value": "wizard url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7751aeae-8481-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700140208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140208, "uuid": "9072af79-7d8e-4b95-afef-679d578fb325", "comment": "Malware payload (AgentTesla)", "value": "74b27015495b66431d501702e8d53796", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140208, "uuid": "ac665615-26ae-4bba-a204-f794e94862bd", "comment": "Malware payload (AgentTesla)", "value": "65327a449adf03742f34bbba9782c91f87e542101d680a763235287498a4f942", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140208, "uuid": "d74c3116-b075-49d5-afa4-ffb920e754bf", "comment": "Malware payload (AgentTesla)", "value": "af018fd44e2c3ef70b2a1ac526b44c806c810264", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140208, "uuid": "ce70a42d-85da-4f0d-9e64-0234e40ad1a4", "comment": "Malware payload (AgentTesla)", "value": "bdf4e5d503efcbd268562f20822760cb985e3435011d64e6fea0e4322c24cc3e5374d6a251e702194867be413d888dd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140208, "uuid": "8a9dbfaa-778c-4de6-9cdd-4c77d91b6229", "value": "T1270512D2A69547D2EDB823F224774C1503B37D7E9AB1E18E8EDEB1F416337920112A1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140208, "uuid": "550fff3b-c0e2-494f-b81d-0e710441d14d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140208, "uuid": "9318ef09-5b3a-4d9a-8ace-98756bdfbe74", "value": "12288:LuPkFyjZ6BBIF1MVGM6gCuRAQSRSoQwFZ22h9bOZMLmJOdTWDy:ekFyyyKcICx5RYwFlhBLmUdqDy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700140208, "uuid": "963a09b9-def0-4a02-b903-68b56ede8e63", "value": 803328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700140208, "uuid": "ecbcc780-9e33-4930-abab-473053fb019d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140208, "uuid": "c9c0430a-e01a-4f18-9101-87f724388504", "value": "DHL_INFO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0917c918-849c-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700151619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151619, "uuid": "d0360ae1-1080-4cfc-8f2a-a723fac80c8f", "comment": "Malware payload (RemcosRAT)", "value": "baa40e739a7b86a71f5ce1cc9ef151b8", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151619, "uuid": "ced92750-7595-4ff6-913a-f4243477c38f", "comment": "Malware payload (RemcosRAT)", "value": "653f628893de874793983dc90b8868c7e56229e28f7eaf79d615c55490179411", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151619, "uuid": "a8f550d6-76e0-4c8e-a3e0-6dd8fef3b6f5", "comment": "Malware payload (RemcosRAT)", "value": "67c7f0cf57aff173413f0ba17e9ec5052f1aac86", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151619, "uuid": "313d257d-cae4-4469-a617-f5e4627f2b55", "comment": "Malware payload (RemcosRAT)", "value": "1926cd7d94fb1aa66f99a6a522b9cd5006b02c1919137aa638a5042091dd7f0b699d7ea79408c6c203db96e1e497ff48", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151619, "uuid": "6d2ce1c6-8fef-4afe-b02e-b73a4a915cfb", "value": "T109741266F2C60477E02243746AB9D323E6BAE1450857418B0BEC4EBF2C7A0DDD46F679", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151619, "uuid": "8208da73-2fed-4241-9a84-4b3942ce397e", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151619, "uuid": "c298df5a-190e-4563-a54c-169315428549", "value": "6144:wBlL/71aRFGx1f1M/bwy2TtkyVIfjdiYfoRK7pvcHFyXX/Q+dClyOIyS:CJ1GGdcbwy2kyVIblgc1E6XY+dxO7S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700151619, "uuid": "7b983f95-f5ea-480a-863b-61c58086c496", "value": 368839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700151619, "uuid": "60107b10-3dcf-46b4-aa04-485501fb7068", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151619, "uuid": "2f5f8492-27e2-43bb-94e9-17216f89c8ce", "value": "ORDERI0987654-0098800000.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73b57743-84db-11ee-8907-42010a9c0042", "comment": "Malware payload (Sodinokibi)", "timestamp": 1700178856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178856, "uuid": "d9ab6a7e-eb8f-427c-b201-7a35e2d0be92", "comment": "Malware payload (Sodinokibi)", "value": "44c753ed1faec948b0d98bc9ba047469", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178856, "uuid": "4c16b3b1-7aeb-46e6-b70e-f58877f754f4", "comment": "Malware payload (Sodinokibi)", "value": "6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178856, "uuid": "4e3c261a-a703-4fad-a178-6e4990549f45", "comment": "Malware payload (Sodinokibi)", "value": "1aa2d575752dcfa73ea8bd2fa666e18588be353c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700178856, "uuid": "9de78305-5f2a-459c-b494-64a36302906f", "comment": "Malware payload (Sodinokibi)", "value": "98b734a0b19ff028450f45e43afdba5c61209c886fd8a0d8f3967abc6f922ed76353fc53a31bb3be18841b91c3d1350e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Sodinokibi", "colour": "#6E2BED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178856, "uuid": "77311d76-8066-4232-b7ca-52e32a89fca0", "value": "T1C1F3E123E86186B3D8B780F3033B2F1BE6BEFE7141567526D7714C483A650A3E222597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178856, "uuid": "8d60c166-1b6a-42bc-a715-fde08b8d9c2b", "value": "7ecacfc6f1d64067e0047425ad885408", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178856, "uuid": "6309f6ad-c97c-4f68-954e-f8e6728e17f0", "value": "3072:1LFrb30BRtBZZg+i2ayy2RjLTuVyu7CJDgoMT3QoIeXt5KCn16:ZJ0BXScFy2RsQJ8zg9edTn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700178856, "uuid": "58d7d412-9946-4738-95cb-29e5f292fb3d", "value": 170496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700178856, "uuid": "10f87bd9-1bc2-4e8a-abdf-b1a484cc3882", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700178856, "uuid": "861fe452-ec9c-4de9-83a7-7855f642dcff", "value": "6628de7ffbbe168a4fa9ff0a1a29b54e88a32e5963db0dd1aea4b80102c8ce01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f40acfc-84bf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700166662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166662, "uuid": "af004e77-157d-4a2a-bfc4-bf5db817779a", "comment": "Malware payload", "value": "3db6bb6579369a60ff4cf41f091a401c", "object_relation": "md5", "Tag": [ { "name": "PowerShellDiscordWiFiStealer", "colour": "#D6B658", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166662, "uuid": "1a0e56d8-4937-46c4-9a59-04137383adc7", "comment": "Malware payload", "value": "66d75f84e516278d3e609abb99b3c20bc0d816f50b0344e6a0764ed33f386674", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDiscordWiFiStealer", "colour": "#D6B658", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166662, "uuid": "33932fc2-15d0-46d3-82db-9963842c3e4c", "comment": "Malware payload", "value": "fc0dff9c9f70575d35d9d7e57a4ba6c419d860ab", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDiscordWiFiStealer", "colour": "#D6B658", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166662, "uuid": "7d28f2e5-ad5a-47eb-974d-2066b7b12a2c", "comment": "Malware payload", "value": "c646f11e57e32a2b82df59ea8235f85823dc707166ec05d2ecdc1a9caa5ed9dafca9357c0f96db6020725fc3a21f2555", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDiscordWiFiStealer", "colour": "#D6B658", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166662, "uuid": "19968538-51ae-4203-806b-7526af54a59d", "value": "T17FF0E7A330AF41200939E5BEDE761554BFC5709E42B95E61FFFC449D45F0601D560AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166662, "uuid": "9dd4bf9b-7f75-4ab8-9fb0-c1f769ae6143", "value": "12:gm+GiNu/SmCy3MzvEF1hlef7j71YMVnN3h+sxbrtJonlUP/Un:gmkk/Sc8QF7Qj7TN3giglcc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700166662, "uuid": "e54c84de-91d2-41cb-8686-f0769c87dc1e", "value": 618, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700166662, "uuid": "5c934353-9b82-4ea7-9867-e646027350e5", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166662, "uuid": "7879dd17-970c-48fb-9d64-799c97814335", "value": "NNwJU0zB.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cc43245-8438-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700108917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700108917, "uuid": "848d5e64-c9de-420e-9add-ae24bdeefac1", "comment": "Malware payload", "value": "c666aaad956bd628efb0a1fc29b856d0", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700108917, "uuid": "21f2a338-3d98-4c3d-b849-c64c7b3f5d64", "comment": "Malware payload", "value": "671dccfc7c2d9db6def026be514ee9142ddb9ebbae07fb130b1a11801499eb7f", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700108917, "uuid": "5044eac4-3038-49d0-8cd7-18093cf05bc6", "comment": "Malware payload", "value": "0a951fc49fb5de7289f88dd40fb6fc9890cac81e", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700108917, "uuid": "02e7ef97-e094-4205-b935-b3ae1371df85", "comment": "Malware payload", "value": "09e89618a7fbde2b3a56463d8d4665f618a2f0b225178b34377da59f7d26286aff31086c41d049cb1fb1308771330a4a", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700108917, "uuid": "639d052a-95ef-4294-9ea6-21ccf7876d7f", "value": "T1C5916B72D954E49EFB51CB32DA3A11189366200B865ADF73281C62FA302E489B4F6F34", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700108917, "uuid": "7a0d2b83-62ac-4215-955a-341229cf0c21", "value": "96:ifBJnZkuuOF+Ra27y7kSuoTrKYkq+uEfwM2s:yThea2Wnl22s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700108917, "uuid": "da4b44b9-b8ac-4f17-bd81-42f02662c770", "value": 4226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700108917, "uuid": "f1b5a2cd-ba04-4094-ad93-e88b9b6a35bf", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700108917, "uuid": "ea4624c0-2b7d-432d-8954-1b595ad3be56", "value": "malicious_chrome_extension.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e41490af-84bb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700165301, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165301, "uuid": "8d159213-70b2-461c-9203-0d968f13d12e", "comment": "Malware payload", "value": "923dc9ef49ab73150f94b6765e00a8a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165301, "uuid": "1a8d21d2-cf38-4692-9862-558c432034f7", "comment": "Malware payload", "value": "69bf1a1db3d5c434b0e07e0915063c5e9536562beeeeeb7c236eba57ddf15741", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165301, "uuid": "a1f7e071-9681-4e62-a8ff-a6ff6bfa5885", "comment": "Malware payload", "value": "b7701c008364ffc5b3f29e4ef29290313527e131", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165301, "uuid": "1ca688cb-fd59-45ea-9200-b1d8a83f2c90", "comment": "Malware payload", "value": "884228115681c606b656bfc87091095215aab0c29abb8cf0c0d3335bef993b52d2864be789b86692277c1fadfe2da78d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165301, "uuid": "a8f04c7e-4282-43e6-9d9a-9b385c29efc4", "value": "T194345B5392E17D43E6A68B739E2EC6E8761EF6508F4B772D22189A7F14F00B2D163350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165301, "uuid": "888b02c7-69c8-4da8-ab8d-aca4d155e153", "value": "d95f0de2d3200302100bf757ee3e513d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165301, "uuid": "e63c4a63-d188-4a3f-aef3-5d3c21ef60e0", "value": "3072:ktSJLLaTYuO95l0cvQ9OEl1lSty5Ke5AysQJGh2XROZxLweJN1X:7LL+YuO95l0c49Dl1lSesQAfZxL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700165301, "uuid": "fa656830-57fd-450a-b3df-878468d85438", "value": 232960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700165301, "uuid": "57cd7680-8c97-4833-a1ef-7131fcd7fcf2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165301, "uuid": "26c20f95-2061-4960-9b57-92138f13748d", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2df9e659-843c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700110449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110449, "uuid": "3d9f5922-fd14-4685-9877-cb4318c864fe", "comment": "Malware payload", "value": "27f3ee84cf6c103db746602bd309b4ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110449, "uuid": "a9607bb2-07e3-4cdf-9147-d676db878e21", "comment": "Malware payload", "value": "6acb3b43d98f272ef65bd7499ebd99cc2e55b5e361cde052d0c2f49ce78d4bc4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110449, "uuid": "ba87aee3-2aa6-4fa6-a2b3-a7800f9b41ee", "comment": "Malware payload", "value": "e7e88cff99c7fec0e8661f1066f6503a967e424d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110449, "uuid": "30e0d056-3b95-4932-9dca-513af981d0df", "comment": "Malware payload", "value": "f616139e45072ccb33316f3d05892c378300c91087bd3d50eda6bf257a7197b3aa6f8fcb1079c1b3de75c6e1473bc951", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110449, "uuid": "298a6758-86d6-4a99-97b4-9ddfe555558f", "value": "T186849E2392D1BC5DE926CB728E1EE6F8720EB9509E497B6532287F2F14711B2D273311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110449, "uuid": "187fc6cf-df9c-4512-9757-b01aa539542c", "value": "2019e2f2e2ca0590589ed6b17ba008c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110449, "uuid": "d5db7af6-c4fc-4ab5-be44-5c8339384350", "value": "6144:fLhat7FJYk9idwSOr0TLlDtIY6wR+fjSTyHeZ:fts7FJnqZhDtr6wofjSTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700110449, "uuid": "433f5379-8bfd-419a-9197-03e6e71a20c1", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700110449, "uuid": "e9f572ff-9100-448e-a1fd-558459d5379c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110449, "uuid": "57a6de82-081b-463b-9ed5-6d937cff70bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f053d99-843c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700110532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110532, "uuid": "08df6a6f-e36a-4157-98f9-92c3cf498015", "comment": "Malware payload", "value": "19c8c5f16e7222fff47d98330fadf654", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110532, "uuid": "67dd286c-dfe7-4ed8-ab13-d05ffb58bf37", "comment": "Malware payload", "value": "6c2fd9890091213f759f6cfe01fb00531a5efc4bdbad60542cabd86c1aabd9f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110532, "uuid": "7e73337c-2ba3-444c-b0d6-ecb157cc11df", "comment": "Malware payload", "value": "8fbe61ed8182d6beaf52238f44e3ee5f7bbd74e8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110532, "uuid": "816e194f-1dcc-4fae-beeb-8f50aff9c326", "comment": "Malware payload", "value": "3ee901cbef682c2e651cdf7a643ddb1c9104c7fb7eaa66d8b23c3954b1f81612a0e95163552d0b3f03128a23971e20a8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110532, "uuid": "e2ccb8ea-185f-486e-b293-69abcc9f26a6", "value": "T16AE3C257536A4DF3D06C17B80646CB5AB07A2938C7E6CA130B8C607B358579834FAE04", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110532, "uuid": "6b7f8c7e-87bd-4650-8d2a-892aa90be8e8", "value": "6:idq2vVg3F+X32GfnGGyG8q3V82S/eglHitGI0E6:etGSG4CqBS/eglHiwII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700110532, "uuid": "a2ea0ca5-75f4-4a8c-9529-13d02156aa9e", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700110532, "uuid": "54b84d69-99dc-4a89-90d9-45e3e595a4ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110532, "uuid": "9704646b-de78-4231-956e-dc60eb2e390d", "value": "carved.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "112e5407-8489-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700143472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143472, "uuid": "d38b8da3-d5ba-40b4-9fd7-865c01bee740", "comment": "Malware payload (AgentTesla)", "value": "30348f2f86a8d2081114da55eaf5c1df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143472, "uuid": "eda022af-c8b0-42a4-8977-ca6b5ae2d783", "comment": "Malware payload (AgentTesla)", "value": "6d7cb54af6a89d11c5283dd577ad03c498ad5aff6f37cfec9ab4e685c48e545e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143472, "uuid": "97544d9a-8579-4777-ace4-f4ee895fefe8", "comment": "Malware payload (AgentTesla)", "value": "4061be661550374db9cc321d13e3b3378708236b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143472, "uuid": "abe2f711-5c31-4dc6-8e35-66c7a0dfcbb1", "comment": "Malware payload (AgentTesla)", "value": "a51aef3244be367dc792c23e3809a852b236be91586087edeabdcc6710859ab6cfb00ef9bccef9626fbb9e93ee643725", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143472, "uuid": "b14725d7-e0f5-4e7c-a9b5-03dca181b8f1", "value": "T18305F10036B86E57CBA141F40B62A98C77F53D269166DBFA1F91B1CA38F2FB05209753", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143472, "uuid": "bb45e4b8-7465-45ab-98d5-8b9793e5c7bf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143472, "uuid": "a479eb22-9948-4857-9ebc-ce425af4fd41", "value": "12288:PyoVzjuP0LlpG0e590u1F7sVmJJ6srQqUDzo2AbFO0us/qhULFfhS9WB:Ko80LlpG/5907QJUrzKbFVqhULFfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700143472, "uuid": "99231bf5-ba24-4b95-8636-3b14c0c1e0e9", "value": 798208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700143472, "uuid": "d254a613-41c7-44c9-bbbf-1b42ce4e86c9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143472, "uuid": "a0b7725b-ce30-4cbd-a08d-f55c07a9079a", "value": "overdue payment pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f3de01d-844b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700116921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116921, "uuid": "af7bc916-5788-4f60-a294-11dba9da8110", "comment": "Malware payload", "value": "e365921dfe40784e6b4a13021e9ad25e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116921, "uuid": "7595b591-841e-47cd-bf98-2668182ec7fb", "comment": "Malware payload", "value": "6fbf3ff468328bb6c5ad279288ba2c40ca4630c0dfc929d6306e2d6ad340cf34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116921, "uuid": "55c3fe18-a542-409a-a6c8-5e09a9dc5bd3", "comment": "Malware payload", "value": "ca398f256ba0e8a675acf8dd895f1073cc271c66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116921, "uuid": "705b13e1-9ae7-4075-9647-bf88c6930a15", "comment": "Malware payload", "value": "68f6feffea2b516c3397e45f2048f6a99d012aec11d31962b830ba9727d9184a0522d1388c9dc116d51509d2cb5dee37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116921, "uuid": "786dd598-8ecb-450b-9527-d95c24f101f7", "value": "T1A2A3F831A641C973D04305F212A7DB660D32FDBB1A6AAE56E32C3CB0DE360C5B565E9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116921, "uuid": "3bf80020-d5c9-4d60-8cc7-6a050a697348", "value": "3072:VK1z13U6HzHoXRtmTUhQogHEmmFVcqq0GnDZT:VK7DDeKlogHEmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116921, "uuid": "32d45eab-a293-4357-aebf-2e7fea2ae64b", "value": 100042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116921, "uuid": "4fd0a4b6-02bc-45cf-8c0e-56018afc8769", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116921, "uuid": "1a1ce75a-ff38-4d2d-8f78-bc90238e7cbe", "value": "e365921dfe40784e6b4a13021e9ad25e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fe1b48-848c-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700144854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144854, "uuid": "b22935a8-d75c-44ed-878a-2823fdf52c27", "comment": "Malware payload (AgentTesla)", "value": "9c7aef281dce8b4681588d60bdab153c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144854, "uuid": "1c47b345-b29c-41ce-8cab-8ca5b7dc78a9", "comment": "Malware payload (AgentTesla)", "value": "7045c1465bc70e0f8a8eaac0515b457496c9641e7ce11fdbc1dab8e8ee08426e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144854, "uuid": "2779d55b-fe28-4627-b388-ab801ed0432f", "comment": "Malware payload (AgentTesla)", "value": "a4ac0832c3dfda05c1196ad3edf753dcd26f7ac0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700144854, "uuid": "fc98ec16-1b4a-4e1f-8a8d-4fa3b2a1b1eb", "comment": "Malware payload (AgentTesla)", "value": "79abc55205cd17b92d1418d90562717b05a5f2de6265c3ef9e0e97ab8f78bcbde1015bfaa400254bf0cd347c83a277f1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144854, "uuid": "213c71c0-db3b-4861-bd31-e80578049e23", "value": "T19205CE85E68556A0DD69ABB06A32CD3503337EBDA834E41D28DE3DA73FBB7931021153", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144854, "uuid": "905631a9-493d-471a-b2d0-9de36ecec72b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144854, "uuid": "c4c3b60b-5ea2-4a09-9223-6604095a6cb2", "value": "12288:cuP2w40dOrytOTLRvORP3usgih7fk5pGiFiHQSM72YiGDP7r9r/+pppppppppppP:vF4ELttPmi7oFiwS1YdD1q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700144854, "uuid": "a0f6e1a6-b500-47ff-9d15-1b2cb796bc24", "value": 855552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700144854, "uuid": "2b51be13-ceae-4c5f-8341-8c481bd7ad4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700144854, "uuid": "878291dc-e0d2-4cf2-9c5b-50f03f0fb5e4", "value": "confirmation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e048c2fe-8441-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700112896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700112896, "uuid": "dec68004-f89e-45b5-bc10-d4548fbceb27", "comment": "Malware payload", "value": "557a85c1233fd59bc4cc707b44231c6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700112896, "uuid": "8f79616f-5fac-47d6-b823-215204916756", "comment": "Malware payload", "value": "70b2fbdbe34e05f0c3a84f5c9068e7f4970d7fa25452fa561357ca7d2e2be2ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700112896, "uuid": "c87d4100-0ac0-4467-9086-89a84884ecda", "comment": "Malware payload", "value": "0e13d167bf632a8a65fb1ba5916af8c11e671872", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700112896, "uuid": "2e6ade54-c373-4dee-9fb4-129839760eaf", "comment": "Malware payload", "value": "3e6a6d6f0a8ee6326b4dbb905975ed8974e488f1e5696ac347062319764a577a2e964b598956e0602a709c19d27a6b7e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700112896, "uuid": "2dfc94fb-9be7-4577-8fdc-d879eaf244fb", "value": "T1E8443B03D2D1BD50E6268A7ADE2EC6F8721EF9508E6D7B66221DBF1F14B1172D263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700112896, "uuid": "d23acdb1-3a0a-4ec2-b194-f964e6e788ef", "value": "cb006aeb614c0887ced2ab5d10258afe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700112896, "uuid": "ba38ad1e-91d4-4c76-a362-099831621d10", "value": "3072:7TfpODPLkwn2pBF4/Hu+FxIrPop3Cd2eEm0ThJ0ReN77xbnrrq5klzQEPdMFJyGX:ULkwn/O69p33ThZG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700112896, "uuid": "3000b470-fe74-47c1-a229-844bde3b0efa", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700112896, "uuid": "cbafc0fd-f269-44df-89df-96140349b2ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700112896, "uuid": "7529f950-54bc-4138-8678-685264f0c6b2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cdc5b5d-848f-11ee-8907-42010a9c0042", "comment": "Malware payload (GuLoader)", "timestamp": 1700146149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146149, "uuid": "d0cadf60-7c2e-46d3-9739-3ad66e2d6018", "comment": "Malware payload (GuLoader)", "value": "14e04dbdfa3836cac53b4c1430a2b620", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146149, "uuid": "40ea936c-b514-46a7-a22f-c431f0b3f6e9", "comment": "Malware payload (GuLoader)", "value": "70c5897be4d10a28f6cfd2daad75860f52aca523fd9299aa29073ab14408109a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146149, "uuid": "fbbdd1e0-372d-45bc-8bce-8f44fb9eaf9d", "comment": "Malware payload (GuLoader)", "value": "16e4602d4c1bf3bb32a2276fde8a4d56d304d9a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146149, "uuid": "ffa4d4f1-c482-42b7-a724-0d28b66d2642", "comment": "Malware payload (GuLoader)", "value": "463b2516e27eac2e00477f28ff361d27e3c1686210a88a6a25d795a6cc9a71f39528d436afb5519f66e8ad0d8c219a47", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146149, "uuid": "dc70e7da-a3a2-4537-911d-7a8b8606d512", "value": "T1BAD42321A618C652D752CB721EB5A077AF673E136154066F37027B8CB8B6181CEBEF13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146149, "uuid": "4aa2ecc4-099b-4234-976a-049eac4f2c36", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146149, "uuid": "85f6e275-9ee0-4fab-bba5-94ee3e3ebf7c", "value": "12288:gkyzLo1c7XkSEo+ZBT+N8v2ocCSivrlicgTzJSq:Iz0uXZ4zw8vcKGwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700146149, "uuid": "e53cd33c-fb67-42b7-a4c0-d326c2334e4e", "value": 599696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700146149, "uuid": "d928bd40-f42e-4e8a-b5ce-53332dcf1d4e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146149, "uuid": "530a00a2-1e11-4192-b637-854a558539af", "value": "Invoice_1-19580161\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "811fd205-844b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700117031, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117031, "uuid": "e85df84a-669d-425a-82ad-eae45ebc9227", "comment": "Malware payload", "value": "33fa662e2cf3a4cf32c97abb19ad5b11", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117031, "uuid": "9e3a2402-0392-46e0-b087-33cef7acf1f8", "comment": "Malware payload", "value": "7196e9bed1617006a3a8eef5a9f6e95b2544b66f92cae738077f46f9acec2a57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117031, "uuid": "191c6909-4126-4ddc-ae1a-b89a39f8733c", "comment": "Malware payload", "value": "d104ae88ea7555fac572411809e5e6947b864b8e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117031, "uuid": "1450ef85-39dc-4a88-b9ce-e87c5b2846e2", "comment": "Malware payload", "value": "450b991eb1841d2b029544ac8caa9ff842951b25370bea09a50fe87471ba9d7a689467026b189c4d6efdd7ffd9352ba5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117031, "uuid": "b7ed4e87-4a4f-4e39-97f5-1a743b448421", "value": "T13FC3C63B67170E23C0CA50B101E34332AE75DE9B34B952D7AAD07D686F36A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117031, "uuid": "d958a14b-29a2-45dd-86b1-a363550383ad", "value": "3072:wsrp9xV+GZTZepNPhj+e3fSqP0L7ymm/QMurB1nKGNb:SMQplV0amm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700117031, "uuid": "e8c6afcf-fc76-438a-a403-8900f00e93d0", "value": 129856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700117031, "uuid": "869bbf4e-deb8-4ac4-b111-2e32ac2fcfa1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117031, "uuid": "cd3e43f0-2ec0-4762-b687-b4705a2ef296", "value": "33fa662e2cf3a4cf32c97abb19ad5b11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ce2868-84be-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700166512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166512, "uuid": "e06c81b5-ce4b-431c-92f6-7665791a1554", "comment": "Malware payload", "value": "d2ec4306f6f7711fe7c26d9d3f1bb309", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166512, "uuid": "a83bae38-97b8-49ba-bb1b-e2b8d1ee35ce", "comment": "Malware payload", "value": "745d794fd8a4efccfa11efa67e9232f31257931e4d846b2ab0a92bb8c4aea7d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166512, "uuid": "17b44cd4-adbb-4818-906e-bca074b8b1e7", "comment": "Malware payload", "value": "8e7cfd40698a4ac0ffe6ed345930ee3da4c0165f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166512, "uuid": "3ed37318-e987-4db5-83f5-d52fb8326398", "comment": "Malware payload", "value": "5c2750d5a3cb935622b6ff89e4a7922a6ea31d96871cc35f12c01a4dd78e1fdf2acded235ce7110c504d731bd2c222cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166512, "uuid": "32fc056b-d1de-41b5-a05a-31f5e22b2f70", "value": "T1EF369E91E2F1A65CE4DEE572DE3463E462B2A453BB13E395CE00E521346C3E78BC8563", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166512, "uuid": "35518dac-58f8-47e6-bc84-e4a7259538a0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166512, "uuid": "53693298-d0fe-4036-ae18-eff5bb6fcbb3", "value": "49152:tbmgwCzl8qW5A4kKbdANLxNoARLxQ9y5eg3WyFGbNF1uZsksVOhA9hDeFwaAxgpV:5mgDRii0nSsXVbKvAp5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700166512, "uuid": "acdcc5ce-dcc9-4d7f-8d0f-6efd54c07b8e", "value": 5029736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700166512, "uuid": "0334999b-0bb0-481c-86b9-865528a5e4cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166512, "uuid": "333c5b45-4485-4838-ac6d-67e0dece8965", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27ac5bfd-8465-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700128048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128048, "uuid": "cd982c05-61ec-4ac8-9344-7d55b85470ec", "comment": "Malware payload", "value": "07ed9e086474d0f8d70dfb2ca9c27904", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128048, "uuid": "fd40d200-4c16-4c7f-9503-f5c1e89e8f83", "comment": "Malware payload", "value": "7641c8716c89830b2b05ef92da76bbb5df735ab1190d3e1c9a885659e36dd870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128048, "uuid": "c1fd799a-3941-45d2-b665-98b7bebd179e", "comment": "Malware payload", "value": "400e90f6b7396e1d9a72d379ae97f64c01c5c908", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128048, "uuid": "75e14db8-7d5f-4f0e-99b4-fb51da9cf458", "comment": "Malware payload", "value": "5117de154ae5a30bf0d3c1db78508cbed54c4fb6f3ff36149f9af0385d3c4082ef07ac99ff7ec7af47fa69a1bcaf5fb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128048, "uuid": "1451fb09-f532-4d3f-8d3c-d4c2fc82881f", "value": "T1FC84AE03D3D1BC50E9128BBA9E1EC6E8761EF9508E6D7B663219BF1F24B1172D263350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128048, "uuid": "0d7be050-11a4-497f-b17e-4622bdcc2a1e", "value": "3c071df9f91908eb18d041533a3c969c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128048, "uuid": "ed7290c8-0869-4ee3-8c30-6cfbd68a9419", "value": "6144:zbL92a91LVTPQBA/JlyP0oa9Gd+5ggDznzpvjxf8Py:npLLVToBA/be0/2e9DJvjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700128048, "uuid": "988d55ce-40e1-47bf-aa91-8e419afa1196", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700128048, "uuid": "b98e884d-0542-4e36-87b5-22abb76319fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128048, "uuid": "d764b685-c715-4bcb-989a-af8924e7911e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919fc202-8490-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700146694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146694, "uuid": "2698a8be-da7f-47b7-a7b1-33eff76c0781", "comment": "Malware payload", "value": "6e25aa6c69ac70de1f3e0dee91590ed5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146694, "uuid": "8d9cd54d-ce68-47cc-9763-7669b50bfb86", "comment": "Malware payload", "value": "77af94c3b936d3278109fb4cee978425972f13e1b6166a022935980a78ca7ae9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146694, "uuid": "18904ea0-0bab-43f3-9b52-d5bab7475f33", "comment": "Malware payload", "value": "fffc89467e562fef5a005b2c72515fbff54b9bcd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146694, "uuid": "a36d47b1-85b3-4eb5-b875-7e1af5d55b31", "comment": "Malware payload", "value": "bcfe638cf0cd4287a61f11efce326617c71a44c1ca98bc46f9998408c2a5e2c62a00bc21e39ddf9701a9c34e39f82f06", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146694, "uuid": "ebbddad4-e795-4e43-9fab-310e320c2eae", "value": "T151D5338662613E50F53064F0A04BC1B03399EDD5FAA3CF22974EB7532924E86CA55FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146694, "uuid": "55565f5f-19c0-42d5-bb99-8e27474b776e", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146694, "uuid": "660e05e2-b9f6-4d97-bb21-8976a15119c0", "value": "49152:k/gc0/jr/WUaUUgOHf7Z7qqon2kXB8FjXVBIMo0AxL3w8sZD3nr/IM6nyGN:kc/jrzUguf7df23B85lDbayzrgM6nLN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700146694, "uuid": "ad88cf6f-a02e-43a5-ac34-1bd8268eb5cf", "value": 2817336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700146694, "uuid": "81d3876e-86da-4c49-8428-792000694038", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146694, "uuid": "e7ca667f-9efd-4dfa-a9dd-60a41c58e7c5", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5b0ddfc-8494-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700148553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148553, "uuid": "8242cec8-9203-4bfc-8e50-a0575e0cf80a", "comment": "Malware payload (AgentTesla)", "value": "d1c529fabf4e775b5567e388248dffd6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148553, "uuid": "1b823d13-df95-435f-a0f0-03cc3047a1e6", "comment": "Malware payload (AgentTesla)", "value": "77e81778ac192589a26dc35e0d24e3ba813a833dae62951094e5ec0251be844a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148553, "uuid": "82a61614-2be5-4d1e-afab-55371fee30dd", "comment": "Malware payload (AgentTesla)", "value": "1d3eacb9fc3e08a1352563c2a8f3832e413be886", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148553, "uuid": "e6908a6f-18b3-4576-80a7-5ee3b72a9fe6", "comment": "Malware payload (AgentTesla)", "value": "58b1561f56a15a2a65e92e52bf89c053d615a7d1221b2c3318c4b55a08ea2671cb93dcd43ad37e671c43c7e288e49e75", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148553, "uuid": "d5266fa4-76e0-4a37-bc57-d282563b6224", "value": "T10ED41240B6AFCF4AC97E67F4085252001771A8A77637E70DEE85A1D69633B819E21F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148553, "uuid": "c156d5f8-ef81-4728-af3d-61f7c2a4d7d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148553, "uuid": "478910c3-d9de-4b89-ba32-70372777fe92", "value": "12288:YgNuPI1w9QcdMsefAptXJNSpviknHdueqQRyu3mvqYKhPpQkNdPyL3:9Y+w9tefAptXJNS79u6RCv6PdXaL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700148553, "uuid": "cc01ee1d-6fcb-4ecc-8050-d0b512f51436", "value": 647168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700148553, "uuid": "b3437cbe-7016-47ca-a1a8-8b77954eeea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148553, "uuid": "0b627979-3e82-4cbc-a71b-5d33e65e70e2", "value": "Factuur beheerskosten.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd0f23de-846a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700130554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130554, "uuid": "b4e6b203-9ed8-4142-9af7-ece2e9200b4f", "comment": "Malware payload", "value": "7a0499dd0fb44c57b9bdc0683a187cdb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130554, "uuid": "acb66f9a-b290-4640-8219-1f144e8bad39", "comment": "Malware payload", "value": "787c7572ea0492bdb433eb344fbc7f52e4ebdc62be69a2a3f1fa6180d4b22646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130554, "uuid": "b22bd5b6-4be3-48c4-a03f-bb55706abc50", "comment": "Malware payload", "value": "b59d7689b3b7544020bffe2fe933368b05845ac8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130554, "uuid": "30846ee5-4359-47cf-bf76-f8c246dc7168", "comment": "Malware payload", "value": "782e62d3b7a523c5ac700fede3155b7d28a2fa770e79db66335bcdbb20366b5ffb247e47a7a8d065c4e407206e9d70f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130554, "uuid": "ff5b485e-3548-4a2d-8826-1bb4a9f26d13", "value": "T12D342903D2A17D40EA268A36CE2EC5EC771EF5508F697B66321A7B5F04B1272D273714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130554, "uuid": "abd35101-d953-4170-9864-b623c07122f4", "value": "3c071df9f91908eb18d041533a3c969c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130554, "uuid": "2b6d39c5-6714-42ac-a8d0-036af4b811d0", "value": "3072:e4FL5R6ucfiYdG4G2TyZPZ9pvWsLU0OT1M7n5QmvIoRWM56oKsikBI:dL5R6DPG4qZQsLU1T675QP8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700130554, "uuid": "6b64034d-2e55-48f8-9b97-6d155f045b71", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700130554, "uuid": "46dc73be-43e2-4135-9284-0494dca2f496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130554, "uuid": "9d27f195-9603-4836-8547-8b9fee16ba2a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "310386ed-8472-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700133647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700133647, "uuid": "28d69db5-716b-4f05-89f8-14e3190521b1", "comment": "Malware payload", "value": "15170a4582543bbfe6f2214e37de5a36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700133647, "uuid": "1f8fca1f-73f2-4c7b-9bd0-aba0f0b7b71b", "comment": "Malware payload", "value": "79d2214416c077593f283e8a2251666fb17871edb053e708566009d743ec16c6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700133647, "uuid": "2fcd85b7-147d-4d80-89be-82d492c0bf23", "comment": "Malware payload", "value": "c759a322309e3b60218cc2cebf6a81b8f039b2fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700133647, "uuid": "0a5f4923-5b77-4a89-9bcb-fc079bfa54a7", "comment": "Malware payload", "value": "96eee625fbf19caa6b09e068e20b1e45af342d937060ee193d11bd58381db06d5e7b5b369d9c7050dfddd72424377d6b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700133647, "uuid": "2faf744e-6b2d-4aa1-b22d-5cccaf37946c", "value": "T1B7A4E09A93F48A5DDFAB1678B4A053021F70DC899972B74F668CB5A10F733B51F2420B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700133647, "uuid": "76c72645-954b-4987-b07b-17b8b15899d7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700133647, "uuid": "bf7f7c50-fcb0-42ef-97dd-59031e5071b1", "value": "12288:EF5Ny1/TqGEU4y7iAqtgpXEE461yhdDj/U5d:EF5Ny1/mU4P5g5BEe5d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700133647, "uuid": "212f45b9-d3bd-4591-80ac-6e7ac296408a", "value": 491000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700133647, "uuid": "bd698435-5f93-48ad-8540-312d17ae06d6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700133647, "uuid": "c81a767d-bc21-405b-8581-740d5b510973", "value": "Booking 20137562.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8b8395-843b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700110234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110234, "uuid": "5e07937b-f3af-4ae0-85e3-1f9f24435eeb", "comment": "Malware payload (Mirai)", "value": "a910cdcb83dbad3ccbdf905b2acb200a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110234, "uuid": "e62b0875-11f4-4f55-8cf6-558097b8222e", "comment": "Malware payload (Mirai)", "value": "7ab8c857cfbf408b79793e6a0acc3c873244ff64fa322670980662d71a26ed50", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110234, "uuid": "e673a2a8-42cd-4e47-a8c4-b946e2ddfa34", "comment": "Malware payload (Mirai)", "value": "479177444c1e9e739a880aa7a350425ee81071ff", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110234, "uuid": "f68a4b64-9082-41fa-a1e5-9007c6ed28f0", "comment": "Malware payload (Mirai)", "value": "a78958557d76e2ef20cca58b4729b65eabad34d23b0fcd88a9d9c31aab1bd11207de48288bffb84c47ddbe0283175d5c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110234, "uuid": "baa3236e-f830-4ba6-b75f-b3e45282e879", "value": "T1796302A2717D29CFEA6D1CEB0B314656282138D70BFB1AC434D6AB50794EB818F56313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110234, "uuid": "fc2fcbb9-a02c-40cc-ae50-c9ddcf9b131b", "value": "1536:ogaZWh17OfMHAaPhRRncftjl1M9GmnknIK3lipn:Ai1Aa2ftj2GxnXiN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700110234, "uuid": "797d16e3-8765-474e-8ea8-fa938982072a", "value": 70444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700110234, "uuid": "96837b80-95b4-4deb-8152-568b39e7e009", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110234, "uuid": "59deaff2-ce42-46b6-98c2-833580cc1b4f", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e954c8-849e-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700152503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152503, "uuid": "d8e52fe4-dceb-4fdd-ab27-ef5033a96265", "comment": "Malware payload (AgentTesla)", "value": "8e7849f5baaaebfdbc6bcd22a587fa7b", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152503, "uuid": "13326a01-8fc0-4118-821a-6f6755193c6c", "comment": "Malware payload (AgentTesla)", "value": "7c7060159fb904e634c34229dcd4d1f976b87fd37df8012ac98123e77f8e856f", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152503, "uuid": "da21fc84-7d76-4440-99af-7077f96ad5c3", "comment": "Malware payload (AgentTesla)", "value": "6335927095bfcd09be56914926a1c5651554779d", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152503, "uuid": "a89b2f72-e134-40ed-9f51-65de660e00bf", "comment": "Malware payload (AgentTesla)", "value": "eb7fd37bd8063c61cb3cca7304e3031aef1f2302e41a06c9c2e1f31e31c7b609cd2b6f92ab95d57cc76005ad6c1ed85e", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152503, "uuid": "8c8bc3bc-1a74-4751-962f-6935139673ad", "value": "T123E433FEC196FA2C419ECB6D784321D7D7E0EB92970CB32289D0273217D6BD0A4B5916", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152503, "uuid": "db385cd1-f9d8-4b9f-9789-220ac042ccca", "value": "12288:IKLXQDritCYGaJYzRIvV1hqrl8xU4iDxZABbB5702s9pit6:Itrv+yWvAQiDxZw+2k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700152503, "uuid": "bd1230a7-5478-46dd-9bcd-26cc05b6bdd4", "value": 690615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700152503, "uuid": "2f30129f-9bc1-4e02-9c6f-8de356399e11", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152503, "uuid": "fc05e651-34d7-4156-a5a3-818fc0403181", "value": "Quotation.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "721f7156-84bf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700166828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166828, "uuid": "cf148727-b538-498c-b380-ac040f1b1675", "comment": "Malware payload", "value": "39031b603dfec9cb262b06b023e75162", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166828, "uuid": "bfa56559-85c1-4c2c-b57d-ab29eeab2d3d", "comment": "Malware payload", "value": "7cf75feeb9ad3bda1abf8bc0178d09db7fa7789f196211089009daf6710112c3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166828, "uuid": "de322cfa-5a5f-4ad7-ad5e-af1f3b655df3", "comment": "Malware payload", "value": "ea4becf8795bfc19444e01f5ee05f96505650f83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166828, "uuid": "97568e39-3902-4c12-af4d-cbac4c89a938", "comment": "Malware payload", "value": "3aa68c3508e12f95dbee445c74decb7e3aa43ace8c3e888fd5799de13463a7862f7b8de16fc79dad1eafdb5c3275da54", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166828, "uuid": "23fed464-8b30-4cf6-9623-def0a25f47a2", "value": "T17B84AE1392E17D46E9268B739F2FC6E8762EF5908E4937AD22189A7F04F01B2C173751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166828, "uuid": "66371012-c236-4c0d-8722-04cd4b90348b", "value": "d95f0de2d3200302100bf757ee3e513d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166828, "uuid": "17a2fdf0-8ba9-4852-9bd0-18203b286b3a", "value": "6144:0LulNUMh/jih8MugQ6uFG6nqqCBvnVOY+XJ5ezwv3gCEpOtlpD96q:0alNUMhGhDuJLnqqC1VH+Z5ezwfgCEpu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700166828, "uuid": "9432aa11-61ab-4b7e-94a6-9088932ff0e8", "value": 379904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700166828, "uuid": "5b136b09-5a7b-4bee-a06a-be84cbbd1d36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166828, "uuid": "86e7dcf2-0c53-40e1-8bdd-5645d1a8986a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "806750dc-84af-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700159980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159980, "uuid": "fc12bef1-7d3f-412a-b9b6-c4eefe6add71", "comment": "Malware payload", "value": "bcd827fc49b7088d03ad1441114c6aad", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159980, "uuid": "04dbb9bf-5ca3-4efb-ad78-cfea52f203c8", "comment": "Malware payload", "value": "7f16cb7b70229203d4a5c342f622ba961d97d7b2c55ed9ce6cb9ba977971e5c5", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159980, "uuid": "b64faf9c-4e4b-45cb-82c5-7573b34f67de", "comment": "Malware payload", "value": "977247f71a471dbe789cc2dc86f75428ed415be7", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159980, "uuid": "71076598-4f9b-4438-ad1f-4c43bb92467e", "comment": "Malware payload", "value": "f5954f7b5e12076b1de1564d2ffe3f7126ef8a641a4014c6859b09f9ffd1c446018699c1328b7cc6dc23711c005aa08a", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159980, "uuid": "54581e22-e053-46df-b055-1668a03290b4", "value": "T161368D31724AC52FE96201B1192C9A9F512CBF360BB254CBB7DC2E6E0BB55C21736E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159980, "uuid": "96ae57dc-5445-4869-bde7-34ced958176a", "value": "608505ff1e7e27ff4a42ea9c4e9f4192", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159980, "uuid": "d926add5-0589-422e-945d-eb1efd336d06", "value": "98304:lr99u4kc8Hao8eRjYBU4UAir2Y5dkdynym/hFRWSYA2/hL4Sro+LbvV:H9upko8Rr6r2dyymZvWG2/+SrogbvV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700159980, "uuid": "20eb481e-ddc4-4620-bcf7-25d0940bd5d6", "value": 4951920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700159980, "uuid": "1d0ce51f-36fb-48ac-a0ae-71eacea7947e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159980, "uuid": "d35bb9b8-5cba-47e1-ac1b-cafba91abf31", "value": "winrar-x64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0d4b45-8492-11ee-8907-42010a9c0042", "comment": "Malware payload (RedLineStealer)", "timestamp": 1700147331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147331, "uuid": "d595735e-201d-40b3-8adc-1357f7f7b10b", "comment": "Malware payload (RedLineStealer)", "value": "f1269255ba88a71955f1ccc2d4576629", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147331, "uuid": "095344dd-8dc3-4800-9d35-ae04a4bc667c", "comment": "Malware payload (RedLineStealer)", "value": "7fe58a57ec935872f4c4d04330cd28bed9ad7838ab7f06722505c04c72eab0a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147331, "uuid": "7d3fe0ef-648d-4096-8ed6-a908c359ff19", "comment": "Malware payload (RedLineStealer)", "value": "c13a7009925d564d57d0386386df162287529f50", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147331, "uuid": "5c666a79-9b8a-4b27-9147-eb920dd4a1b7", "comment": "Malware payload (RedLineStealer)", "value": "eb4bcbeb593e984ae8d8f78a579f2811706a33d294732932664d6eb9c3e2eb1aae8edcb8016d4fb48495eb9c451e6de8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147331, "uuid": "8a094a01-d14e-4c45-b355-0f937d861dc4", "value": "T112457D21FCC48721DDA210B3429CBE6A826CD0704B3195CF45DD1AEDEA627E12B76E77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147331, "uuid": "8b762bac-a0d7-45d9-beda-794c2c9484b2", "value": "954a638f7d616d50845d17dd2901de21", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147331, "uuid": "e8f65d28-2983-4d7e-bd32-6718a7c1a23e", "value": "24576:gYzarSx8Xfg+g+tHNbGaqn4/VzSCwU7iG+xFa:gKx8Xfg+g+tHV/H7iGCFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700147331, "uuid": "52011553-7228-4744-b234-aea02349cfcb", "value": 1199672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700147331, "uuid": "e42ce3fb-ccb0-40b5-9590-943fb27d235a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147331, "uuid": "57c80be7-a2e6-4736-b462-ed1f8a99cada", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "395a78ec-841e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700097584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700097584, "uuid": "f918e318-6773-40ad-9f02-a18d6e99759f", "comment": "Malware payload", "value": "13be4101e7d77605bd1035459b94c346", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700097584, "uuid": "00f004c7-4f73-47f1-aaee-b6e224ef83df", "comment": "Malware payload", "value": "827f8d64cd3023b078e30dcc014306c90fb3383b75b58b9479d0d19dcfc15894", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700097584, "uuid": "4aafcbe0-e19f-4ad3-89fd-7e19aeca0c80", "comment": "Malware payload", "value": "3655c35b8937c7d631a2f87a2434f31f09f63bab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700097584, "uuid": "ba945c77-067b-49c6-8bb3-f736c31d35ef", "comment": "Malware payload", "value": "7d20a832b8967b0727c268754c9091c1a048438c198d6186f096816088491f1432eeec925001880313dc9db0deb43e21", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700097584, "uuid": "ca6338c1-986a-453d-925b-eaaf46a7b617", "value": "T1D4051283BA5C939EE7A5C97238790B7A4B48DF171151AC82B7C4FD9E69312CE7D062C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700097584, "uuid": "e9879e3d-a5b2-4dcf-9919-8b4c34c16d76", "value": "e2a592076b17ef8bfb48b7e03965a3fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700097584, "uuid": "e0db7c66-61cc-4223-82b6-4709fb1ca99c", "value": "24576:bkspjpQqF0H+25N9gpAhaZqMM7at4yYixxloyTzh:bxpnaDdxYILLATz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700097584, "uuid": "84e17731-10cb-4263-bf08-ca25366e0c2b", "value": 809312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700097584, "uuid": "528b6f65-cc59-454a-9e83-233c43aead1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700097584, "uuid": "5b837e73-88b8-4abe-91f6-afa942e46e4a", "value": "SecuriteInfo.com.FileRepMalware.26243.571", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad0bb806-849f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700153183, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153183, "uuid": "6f777865-3b49-4f5d-8a52-bb716bbcbf2b", "comment": "Malware payload", "value": "0a9e7a8ef0321777c3c2d935f342b32c", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153183, "uuid": "a87701ce-d92f-46dd-ad21-e4e84bc47204", "comment": "Malware payload", "value": "84ba7cf993283fd1bbebe77051354d3000a2559cd0a358b4d92ab2a1e6893597", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153183, "uuid": "8ac2caeb-32ad-4992-9107-eee974daab8b", "comment": "Malware payload", "value": "c4a172bbb2ccaa4d28f7e2fe5a80da23b09f99f7", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153183, "uuid": "4192596f-3de5-4771-aba6-279772afc733", "comment": "Malware payload", "value": "b3daefcd23c6ba6c1964faf9d66a11c1dbd725970694734ba705cb2bcec02a841efae59c7745f9bec1092e39779d3242", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153183, "uuid": "ee0164cc-e6f6-45b5-ad57-fa218a4923fc", "value": "T178C7334AFB2CAA2FC477D6355C62113222A39D0679934B1325A0372D2DB7FE44F1A7C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153183, "uuid": "2ab6029d-0d95-4274-8dcc-8b2fa1aa2ef5", "value": "1572864:OPbWQXs/rW32iGFOVbl+9pUvQbnxOKnrWWT:UUp8l+QQbnxVrWWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700153183, "uuid": "60ba72a7-0992-4b28-91f1-99589042557c", "value": 57252345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700153183, "uuid": "3d8d7e0e-bdea-4ae3-b3a6-86edebe1c55f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153183, "uuid": "c8bc9ffc-810d-49f2-a9f7-76b0058d42dc", "value": "WhatsApp.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9496a2-843c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700110665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110665, "uuid": "c721d907-fec6-448a-86f8-ed8df801db9e", "comment": "Malware payload (Formbook)", "value": "5b691330acaa3c5432b9caadbeb82003", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110665, "uuid": "5ddad9ae-cc14-4b40-8237-c719c2f39bf0", "comment": "Malware payload (Formbook)", "value": "860b90ba1c36e237b2aca9e77024d953e5aa3b9d4a736130d355da6c76cf0930", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110665, "uuid": "198e9f74-473f-4a03-b0f1-f0d8c62b8f2e", "comment": "Malware payload (Formbook)", "value": "7084d84dcc45be8161bc3c044c02d02f05d46b95", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110665, "uuid": "c0d3ee25-0007-4aaf-a7ab-ec351ca5fbb2", "comment": "Malware payload (Formbook)", "value": "bbe0d9d533fb9e86c947cb8af98990450fef97eb753e7471a40e0c602c1c8766e718834ba562586b2b3b36f6e776f4c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110665, "uuid": "ed1fa4d8-8e26-44bd-b915-b2cbf0ca4317", "value": "T1A87412A579E1CCEAE15242B02E65F2FDA3B57D11EC95028373D03F6F34B66C59D1A082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110665, "uuid": "a7e6e900-8422-42bf-bef0-29654a3440c8", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110665, "uuid": "b44d2446-520c-42b1-aa61-e3ebefcde4f8", "value": "6144:BBlL/51hWPefvD4kFdshzsQ1tmlwOctCRUDkBYz:HHTfvD4kqsQel5IZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700110665, "uuid": "23fe07e2-ad7a-4614-9b5a-f377549cb474", "value": 340747, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700110665, "uuid": "6c506f95-e7cd-4aae-905d-fa804fdae588", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110665, "uuid": "f24d7f27-dc45-4b25-b281-e82351dc1bbc", "value": "5b691330acaa3c5432b9caadbeb82003", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ccb825-846a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700130380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130380, "uuid": "21dece92-79d1-4f21-a59a-2c6c8db254a7", "comment": "Malware payload", "value": "fe83020e23254c5bbf95a33dc83eafae", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130380, "uuid": "2c857b9f-67ec-491b-85f8-c20f2891670e", "comment": "Malware payload", "value": "86bb5e18da0ed3a8793cc3b38b57aa972a5d9ed0f07182712165f9703d81f27c", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130380, "uuid": "1066f824-205a-4873-b05e-de9fcafb6209", "comment": "Malware payload", "value": "bc4c2dd6ce89b611bae910c3b358649e91fc678f", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130380, "uuid": "b64837b8-b88f-48fb-945e-02c12afc2924", "comment": "Malware payload", "value": "09ecaa37e9673053d7f5df22cc43f3fb946db6aea9d4896dce1f510cfad4b84b137d77cfd63fc5502b6b7a26d7de72b7", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130380, "uuid": "1cf223ee-2edd-4148-ae56-b3ff42a37a8c", "value": "T165B12EB175CD842996B28053A2307EC292EFC93103615A257BF739BFE5C28F01A625AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130380, "uuid": "75f0259a-8e4a-417d-ae34-bcd49c139bbf", "value": "96:h6TdXb+xiTb5NLTbpvNsvvR3B5v+mbBf5KJL6wZHq99q++t6BVARWMDqxMtQ296N:YRL+xiBNLxCxXtZ5KJLZHqPqztaVARWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700130380, "uuid": "f344301e-61da-4ded-b74c-f9bc6e3a941d", "value": 5335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700130380, "uuid": "a99d88c4-4849-4d4f-9eb1-31fde266758a", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130380, "uuid": "89864132-17bc-4679-8fc8-d3b80579e7cf", "value": "fe83020e23254c5bbf95a33dc83eafae.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51426acb-8491-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700147016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147016, "uuid": "a7caf39f-b40a-4240-b3e5-d59b07e384b3", "comment": "Malware payload", "value": "2c0a1bad4462afef55cdbea3d4fad922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147016, "uuid": "fda894cf-569e-437a-aea9-84a2ef5e4d8e", "comment": "Malware payload", "value": "877c560137d8ec8a0b9131bc2f9770c2033d43ba4ceeb1255604d9188afb5603", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147016, "uuid": "aee623c4-c94d-4d86-bf25-869afe01512d", "comment": "Malware payload", "value": "be4b8348d6d9558092ca15a93c0167502482c4d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147016, "uuid": "ac95cf6f-1d79-4096-a3a4-5f146a928758", "comment": "Malware payload", "value": "d52911fa527112af927a92ecead8237ae49937e36fb0e40f3b5fe46816ff8a3039d84432d6afd2d2ba727b163293d81b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147016, "uuid": "beb2baa2-efed-49b9-a856-5e7639d92ffc", "value": "T101366C72698BA59FD45605B8D892F903D36C47F801105DE6E9F83C35BAC3C6A1AC3EB4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147016, "uuid": "90527966-d227-4abf-bf97-0e5f2d37c495", "value": "d835b9d287a6a0ab022189fd9a6457f7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147016, "uuid": "06c04d60-09c5-4596-b217-4fe5561e7a2f", "value": "98304:C2DB7Fh5ppsVKPVo01EuwnadFZo2shs0ytnJKPwKAYPGLKQP8a:C47xo8P2R69shwtnJKPiYPGLK+8a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700147016, "uuid": "a35c1770-7d4d-4c22-8acd-29b0d57212de", "value": 5086008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700147016, "uuid": "31de7c15-5db2-4343-8d7d-bf6b5455d02e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147016, "uuid": "fb22540f-d979-4371-be9b-389e2ca333ce", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cd5350c-84ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700159410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159410, "uuid": "8fe61aae-88cb-4f92-910f-2517f86ff783", "comment": "Malware payload (AgentTesla)", "value": "8ce3976a60c301c1c793fc369da14269", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159410, "uuid": "ecbae483-ca71-410a-87f8-a5aab5d35f6a", "comment": "Malware payload (AgentTesla)", "value": "87c143225cbd6a7ade7b75353db06c18ec3a991b8db39c067c7028d33ec9d48c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159410, "uuid": "378a400d-00fe-48e2-9c87-dd7fd9d91cb0", "comment": "Malware payload (AgentTesla)", "value": "ad428a8342482d6f7c161598879be3c1d23cd8f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159410, "uuid": "55427079-0f73-42b6-b14c-e50fd2e77ccf", "comment": "Malware payload (AgentTesla)", "value": "589b8de99d1324b10b8d9d3d6674a82957785b1a43832ecc64ed969671111e91693554752f29a3bae73a7669ee5e0900", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159410, "uuid": "bb789916-e216-44ff-9646-0fce8272df85", "value": "T13CE4021133B84C27E67D16B5942701E44771BE236160E3AC1EA73AED1BF6BE187026DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159410, "uuid": "e08f649f-ef2e-4a58-9933-d8b9050c343f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159410, "uuid": "b21ca60e-f265-4655-8166-63df013db4d2", "value": "12288:gJX4QtLaBlP7fS8zAWXGSHGNVzf9iD+vbaFvs2xS/JGNkKue625:s8/uRAaTaFvpo/cNlh625", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700159410, "uuid": "6a414102-2559-42b3-88cb-ccfecc6011f0", "value": 672768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700159410, "uuid": "678dc13c-46d4-4b2a-8759-e899b26e4aae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159410, "uuid": "1ae9aba6-1b19-4035-b24c-f082f39afeaa", "value": "Order List_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49693cd9-849c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700151727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151727, "uuid": "4d14674a-f004-4a7c-8adf-5905e43bf760", "comment": "Malware payload", "value": "eec9ea262995c07e42e560fd18a6850a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151727, "uuid": "3215d555-fdf0-41b7-9b57-434551064343", "comment": "Malware payload", "value": "8ca0042e3a2c1aba55e64ca29f37d57d3771f28342c07265bf8ca086f4671822", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151727, "uuid": "13596540-464a-4b53-b198-dcbb438bf220", "comment": "Malware payload", "value": "399d6340960ac20f307549631b7db74198de4afa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151727, "uuid": "e070902b-5138-4107-8d31-3fe121e1959d", "comment": "Malware payload", "value": "17ba6e1397d62b2a591c184350594d72505c112b73b1cbc5ce4275926d0d15e61721df589746746074cff3bb6723d6fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151727, "uuid": "fbbf0738-057e-471e-a7f1-83028495e75f", "value": "T11D347D1179D1C872D572153208E4D6B95E7EBC610E358F6F6BE80B3ECF34181A622E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151727, "uuid": "262d8c5d-0c73-420e-a610-b0cab756ccbf", "value": "4d9ccf1fce9e51c2875886b4fcf753c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151727, "uuid": "5fb81ef1-3924-43de-a960-44fed70c5344", "value": "3072:9db6eeptBFdM84ZWroc3WccOIOyMxK2JtbLoQtUQrIfBcCgOOuN4eAg0FujjZAMZ:9dbItST4xcOjyMsStoQtUDfP7AOvZBX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700151727, "uuid": "9a65104a-d72c-4bda-8b10-3b79fe57e6dc", "value": 240128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700151727, "uuid": "8b572400-0027-492f-b6b8-1840480e71d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151727, "uuid": "bf2d32de-1b4e-4d38-9088-a760806b0269", "value": "SecuriteInfo.com.W32.Injector.BSK.gen.Eldorado.16314.22714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7043b569-849c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700151792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151792, "uuid": "631689be-80ba-4678-bc45-40b93796a0fa", "comment": "Malware payload (Formbook)", "value": "80a1a1d88464cb28a847d511af8c87dc", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151792, "uuid": "d47d71ac-ba35-409f-81bf-2ae3ccedb16d", "comment": "Malware payload (Formbook)", "value": "8ed132af34e760ef8a2c14981304d40c962a348c519b3861e1c496680ae1aa17", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151792, "uuid": "ae672713-58fd-4b00-9f17-acd6a5954dd0", "comment": "Malware payload (Formbook)", "value": "a4a415563ca4084138e39c3180e348c5833ff907", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151792, "uuid": "cb059ec0-fc45-4be0-baff-0270e41033dd", "comment": "Malware payload (Formbook)", "value": "96b9bd585646d79ee6ae0d9d79180547daed89cb1236e71cdd2973e924e6ef212bb685660b2676d8957107636082c324", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151792, "uuid": "86b4b23d-95d6-47c3-9174-1c6b253ecf84", "value": "T162E433A2CC43F855A2C94A2D038371CD86CD89F024D467DC79DFBAF2D592A3AD393958", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151792, "uuid": "500f15da-92dd-4be9-bcae-f14889b19be1", "value": "12288:AMgZ1F7toS1jF1gbgYeuQx6X1K0UH9nqxalHlas/nqo6kxgs:6Z1F7toSdFug1y1oHBYabaOiggs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700151792, "uuid": "3ecb1976-81ca-4eb4-bd45-cc964880a47c", "value": 664386, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700151792, "uuid": "ee47938e-adea-4842-85e7-793e739091a8", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151792, "uuid": "14b88def-475c-4394-823b-c972ff912c63", "value": "Shipping documentsInvoice and Packing List, Certificate of Origin.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c58ecbc2-8427-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700101684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700101684, "uuid": "563c209d-4c81-40f7-93d9-fba82a657687", "comment": "Malware payload", "value": "36f15428619932b29c4e4a685c801cc5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700101684, "uuid": "3cd6c830-f6bc-4686-9b77-2d588f9fb123", "comment": "Malware payload", "value": "90e4f566d5c15666ff4037b6876350c449e5b0f0f9a87bd0f950012d0d42541b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700101684, "uuid": "54a50144-b9ad-4b60-832e-9a61dab563d1", "comment": "Malware payload", "value": "4a8096d76d95ea9fec24813c917c55d5fb1d9c80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700101684, "uuid": "c0bb294a-4b4c-4148-8eae-f866f427f6ee", "comment": "Malware payload", "value": "27a6fef24decb06fd82452db74a141ff79b40bc9e4b02e364586d9e5aa5df298ec809191c2ec53b34dd940ac2e5e8dd5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700101684, "uuid": "351cdabb-c69a-412d-84a7-f6e7c7da303b", "value": "T13D047B213AD1C071D57342324AE9E6351ABDBD724F729A4B77C80B0E1E74492B736BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700101684, "uuid": "79c571dc-2e48-4133-8526-745320a9f825", "value": "e5dbf4f8ccc1f4276248f5791017efa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700101684, "uuid": "82953238-0274-4ee7-a175-a63e6318726f", "value": "3072:M9nIVXbydeVXR380t+GB9mYkH4jDiAV+mMGthlvEaXOZ:wnkxVXObHMvVflvEaeZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700101684, "uuid": "aeb985fb-e105-4766-b1b0-e25eba5b5882", "value": 180736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700101684, "uuid": "2eddbcda-5be6-4cf9-9ea8-4a7ce45f8d9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700101684, "uuid": "87e1b8c3-6116-48f2-bf77-4a279119939f", "value": "SecuriteInfo.com.BScope.Trojan.Idunn.8792.5266", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efff0158-845b-11ee-8907-42010a9c0042", "comment": "Malware payload (SystemBC)", "timestamp": 1700124089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124089, "uuid": "9070ed90-c0c1-459d-8b2d-cd345302e908", "comment": "Malware payload (SystemBC)", "value": "4839cf7cf6b828cd5f2f920510b2356e", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124089, "uuid": "40067eb2-5bf0-40d3-b1da-13cdcbff0237", "comment": "Malware payload (SystemBC)", "value": "9124ff5f4b0866441bcb1d0bdc93c80e7d5eb09700ecb05daa68c38a12ab54bb", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124089, "uuid": "e2bded23-c98f-4769-9cf9-261268cc4c15", "comment": "Malware payload (SystemBC)", "value": "be3459d3d16fee82011e0af0dee3e5dcae45472a", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124089, "uuid": "639358d4-a4b9-4fa0-b7db-c343d0799c68", "comment": "Malware payload (SystemBC)", "value": "b4893d3648049a7bbee1ced95a061d42ed4365269c863746dad41ffd43db719ecd5ca4221a146b411a48b6a07ff24d94", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124089, "uuid": "b0b5de74-67eb-4512-acfe-5b5fb0082374", "value": "T18F02AF4406431262E026B3192FCBDCE7BF2A1B429710203D09E827278E936C6DD72D5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124089, "uuid": "d968ae95-4b89-44c4-ac24-523c2b347a7b", "value": "192:BhXdwT+lq5a6cbQmKy3D9rsGsNcQOiXadTpKLKzatO9DI:fCT+lB6WKyT2tNxjXa2LKzd9DI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700124089, "uuid": "c343af64-61be-4594-a245-75c9ed7bbc4b", "value": 8614, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700124089, "uuid": "1c24c212-be62-494a-9fb4-687e74428939", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124089, "uuid": "6cb8cba8-c7d7-4655-b3db-053be5638fa3", "value": "wizard.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fe83c7a-847a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700137243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700137243, "uuid": "4edf5a68-3b10-4a8b-a756-c14695685925", "comment": "Malware payload", "value": "825ecb14cbe78a23fe8289179dd06f96", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700137243, "uuid": "c74e5614-a327-4a52-8789-d02283110538", "comment": "Malware payload", "value": "92e6b8d53d11281d15d88f06991373639a0a42c7b8b8e8666e25f0cfc87f44a8", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700137243, "uuid": "bbcdaafc-2e1f-4188-a12d-63ce566785e3", "comment": "Malware payload", "value": "4b45e7f9bdf5ee6cc75a094262864adbbcab3371", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700137243, "uuid": "9f02d5da-702f-40e1-806e-dbea46933765", "comment": "Malware payload", "value": "6ae2cc0a853fea938c3a37def19a3db88557c40439858e3375db623c95b772434f4ca946128a93c17bb6e1cfd4656592", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700137243, "uuid": "2c6d0fff-44c3-4220-8826-5d73b3fea941", "value": "T1CB1512DC78741A41F6F543BADE98BC71C76D92108376BC9FCE045AAD0A87485BB2A3C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700137243, "uuid": "aa80b92b-e4a4-4d32-9d32-669b4ca6fe56", "value": "6144:yQg75q9zXqJBTsrHWEdD8OXPa+u8Ba0KuAmM7t90Fol+KLKiY:a5ql6fTQDFXC0Ba0DeEF6+Kw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700137243, "uuid": "ada35d0a-2bdd-43b0-89bc-077eaea126e5", "value": 878695, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700137243, "uuid": "d564f3be-1288-4859-8a8d-3d2c8361c89c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700137243, "uuid": "2e933fd4-faac-4707-bc16-ef225f7ed29d", "value": "Additional information about the reservation.jpg.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af36c9aa-8450-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700119256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700119256, "uuid": "93e15a98-9f0a-40fa-a8b1-90d879d48a2a", "comment": "Malware payload (Mirai)", "value": "c6297ff7da72849451b1604898b73cef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700119256, "uuid": "bef815ed-b394-406e-b1d3-87792d68cda8", "comment": "Malware payload (Mirai)", "value": "941ee80a58dfe4a015ba29f1226906b9e3eb5e69170751fef856d60ecd0685e2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700119256, "uuid": "186e197a-22b7-4638-9568-c443f18f878d", "comment": "Malware payload (Mirai)", "value": "1f437349025c81b79bf40b1edf876b8d91fedbd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700119256, "uuid": "f8c15349-90a8-451d-b8a0-e8f628f97019", "comment": "Malware payload (Mirai)", "value": "7a4bcec3ffd5eb78dde6c91997677810dbb093b552635a918abd19850c2fedfe16abda4403c959d3c88fab08b00de4a6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700119256, "uuid": "eacd6450-4409-4bae-a75c-322ac47c2811", "value": "T1CB734A24A97A2F26C1C0B17F22FB8351B2F5260E25B4865D7CB20F4FFF24554A8162B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700119256, "uuid": "dfd1b50e-7277-4373-8bee-fcbb30480c69", "value": "1536:PryK1cTFSpc9zaqDxhYWcS8GhKxV6vVgFpqxfrFFm:TyqbWcv8vVfxfjm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700119256, "uuid": "8067ddb4-d93e-4ddf-87b0-38df9cd1a852", "value": 74572, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700119256, "uuid": "b33921fc-8e32-4da1-bae6-dad77fd3dccb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700119256, "uuid": "d309d5a2-e489-425a-95e7-17744ecb0b12", "value": "c6297ff7da72849451b1604898b73cef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48056ad5-841f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700098038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700098038, "uuid": "bacab413-df7a-47a9-a549-552778b71ef0", "comment": "Malware payload", "value": "eb5ebcaf2604789213a3e520fd5c943c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700098038, "uuid": "07eefee6-e4cf-4c7e-9565-b8464b83f0d0", "comment": "Malware payload", "value": "9526a4e0b40f262bc5cd1e07a8b80f465e052c18b3698e496ba0e2dd6549127a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700098038, "uuid": "77984c46-08b6-41f3-81e8-d3619dbfaa35", "comment": "Malware payload", "value": "283c81c1ff6a73a5beb00b93af906765bcbf863d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700098038, "uuid": "dfc0b2d9-4e5c-4fec-8c20-f0f3aca9edac", "comment": "Malware payload", "value": "0e3496fe9b8ba42c8d4a677974b49bdaca6dbc5b40d870563130c68acafcdf2d1d3a691a398b856e4605a34c9f3316d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700098038, "uuid": "261c93ba-509a-481a-a490-23297dc36f59", "value": "T11A44192392F1BD54E926CB72CE2EC1F8761EF951AE0977663228AE1F14B1572D273310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700098038, "uuid": "9525ca25-f4a3-449a-bed1-61a9dbaf6b54", "value": "2019e2f2e2ca0590589ed6b17ba008c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700098038, "uuid": "0ec1a9ca-6364-4128-8c29-17eb71a02419", "value": "3072:mmG38NLq4MyN0Aag6UxjyHx9O9nsJ4j6CXxr/A0R2uojbuckSHCA:HLq4MydagThscs0DXquKbu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700098038, "uuid": "0d6f3339-f488-4dd7-9c47-e4cfccb3b276", "value": 276480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700098038, "uuid": "b6e50e8e-ad1c-4beb-9e76-ff7168ee708c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700098038, "uuid": "f206856c-99eb-46f1-b6a7-77b2dae52f31", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c92926a7-847e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700139057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139057, "uuid": "b0853348-86b0-4bb7-849c-5a2136dbf91f", "comment": "Malware payload (Mirai)", "value": "0fff4de2e008d4a2f3c1f318cce3d9a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139057, "uuid": "53aaeb36-68f8-4291-a54c-28d7019fcb74", "comment": "Malware payload (Mirai)", "value": "9605d9c9e1ed1367b0bceb7c59b20f26b7e038ca9f94a4cce86a774d859cff9b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139057, "uuid": "606b65d2-e3e0-4b0c-8e1f-6d30811c05df", "comment": "Malware payload (Mirai)", "value": "23642417f938042178bc6fba5209164bbeaf202f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139057, "uuid": "4190317c-97d3-40f4-9cae-1a1b92dca6c6", "comment": "Malware payload (Mirai)", "value": "07700b2040538d2a4553255f32d6c95314787b39275472663f823c89af590802f96f9493486ba310054d3c1b7608d1f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139057, "uuid": "a8b7cc0c-b996-43b4-95a1-8aa6a692d475", "value": "T106131A96B801ED7CFC4BEBBE84174909B531735081930B2B6377FDA39D321985D26E8A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139057, "uuid": "1e265db3-d4b7-4f46-bf87-99c064eda1e9", "value": "768:opPH8E+htTUbwuLqH9vCmIM7ujWea/pg2ZJTBs9rM8Jol:Uv8E+heUX9bIMijpsg2ZJVs9A86", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700139057, "uuid": "5093cc60-b67b-4c1a-9ca6-d162f9c64841", "value": 44736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700139057, "uuid": "b435ac95-67f9-4b12-92c7-c71c81be8b3c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139057, "uuid": "a95f589c-3ed5-491a-8de0-3f3f3529bfb5", "value": "0fff4de2e008d4a2f3c1f318cce3d9a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45282669-849c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700151720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151720, "uuid": "0690bedf-b4b2-4a45-ae95-ee04ff518c01", "comment": "Malware payload", "value": "29dc3af1f43e0b6066b4a10298e94cc1", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151720, "uuid": "9ebb15a2-030e-422a-a0ad-f8f37f3df598", "comment": "Malware payload", "value": "9cd2b3c0ed7d13a8b8f0ee98eca318626ae64586faea43383760a6d59b607ca8", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151720, "uuid": "c42e3708-7999-46b7-bd53-844a9ef6b1db", "comment": "Malware payload", "value": "b8ec1b9eeef0a0382a4e951b1efbea80c6533dd9", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151720, "uuid": "9ac4b5a9-de96-4fe0-afd7-235e7594e1ac", "comment": "Malware payload", "value": "86b111ad62d6276ec90f15e49ec41685fc2426b79aca20650c04bd442bfe27b020cfeac0c775121aac0d320949717499", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151720, "uuid": "0d27039e-4eb1-4e63-af10-30c402ec1c8a", "value": "T1209423998FED874218B76B2B38E64073087352B7CD64379C6A97F894329B354E1D2CB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151720, "uuid": "09574316-a209-4359-9765-8781d691b884", "value": "12288:qp718ZcRY/EmxXpME4Utlok+ClVyleNKYtBr2nI8hHx:qv8ZcR0EMXpIC+k+gylSK2Br2nI8hHx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700151720, "uuid": "f7e48acd-4e83-47f3-9cca-3a5c7e38a4a8", "value": 432913, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700151720, "uuid": "98060522-c88b-4adc-8cf5-c07dcd378e2d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151720, "uuid": "14e660a7-d2b6-47c8-9b94-e684d535fe09", "value": "PO-113.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9da90b3-848f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700146359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146359, "uuid": "e73cbc2a-1303-4cf1-bd77-b682bd8f73b1", "comment": "Malware payload", "value": "73fce1f1189113ee288ff29558464fd2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146359, "uuid": "42ec9b35-364d-4965-b908-a284a451f4ad", "comment": "Malware payload", "value": "9d180b3b8219292c40814afbc36db5d36771022b39429b41ec0e7485433da81a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146359, "uuid": "e647aa65-86fa-4e46-a050-bd18c5b43292", "comment": "Malware payload", "value": "d7fa40f815b0fc8305066e4c02ba7950b21a2dcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700146359, "uuid": "68043a24-6c0e-4bd6-91ed-08a77a0cd82b", "comment": "Malware payload", "value": "4746900f946b56c507c294c932984f6b70c6f9f65b2314a71c0c790f7eb04f092dc26076098bc886d95dffe3093c1312", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146359, "uuid": "f0a83c4e-0c92-43f4-9fa1-665e3dc82e16", "value": "T1E2443C43D2D1BC50EB268B369E2EDAE8772EF5508F5977672219BB1F04B11B2C263350", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146359, "uuid": "86053b89-5a0c-483c-9cba-9ae149857374", "value": "213f519d1d60f9b08b3f96159240536b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146359, "uuid": "01bc9482-ea3b-4d33-a39e-39b4b9a8849c", "value": "3072:HLCILvqhgKJ0JWMyXP1PIBnueYoo8kEmZw3SOiqUsqa34RmGz3Ksik:9LvqhgKJ0QMyXNenxiXTZw3xiqdj8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700146359, "uuid": "cd5d68ae-8cdf-4716-b550-f6783d391d0c", "value": 268288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700146359, "uuid": "9c386790-5af2-4514-b43b-3aea40aac105", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700146359, "uuid": "0ab0987c-47e8-4775-9722-1f3c33b04cb1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68c4e7ad-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700116991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116991, "uuid": "67f4b643-e5eb-4c9c-aef0-c5ee233ec157", "comment": "Malware payload (Mirai)", "value": "70a2a25aacd0636c950eb0cf43a4fe5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116991, "uuid": "6336c687-b788-4896-bef8-0cf47b341b3d", "comment": "Malware payload (Mirai)", "value": "a1319ec13259b460f5bc9c1fc0abac274c15f8bcc1f3637a92e52650bebf99b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116991, "uuid": "09e633dc-3b13-4a33-9314-db1573a73632", "comment": "Malware payload (Mirai)", "value": "1eb146ebb248a7bd213fc8c6e7525747f895ce91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116991, "uuid": "a0e03a8e-1123-4b69-8664-845e4dbe75df", "comment": "Malware payload (Mirai)", "value": "03e2093df85a121cc0751b65a9da2e64dacaa51140aaf495dc4f3469dcf7a953332c35065735fcd0a78cca867b23330d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116991, "uuid": "a741cfa3-fb83-47ff-9208-88776da7468b", "value": "T122539FB7C4A8AD98DE255578F11098399723E008A1A72DF6EA46C656D05BEECF00C7F3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116991, "uuid": "c1ac17fb-f2e3-4536-8fe7-1903f1ad045d", "value": "1536:kaT/8N6GOJ80OG5Ne2f2sOqEqX3sUEfs3C+/sMDr3d3C0Kti:ky0NsEG5Ne2gqEqXyf+/Lrt3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116991, "uuid": "dbe1f599-95ed-41fe-99ab-d902322ffbb3", "value": 64344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116991, "uuid": "fcdf382c-8f73-487e-900b-75330878616e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116991, "uuid": "b0c189eb-1fb4-4bad-b683-0198c36613f1", "value": "70a2a25aacd0636c950eb0cf43a4fe5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03102deb-846e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700131852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131852, "uuid": "e9ae0967-8160-4fef-b2fd-8197b6330bc3", "comment": "Malware payload", "value": "db187547f8aa1a5a1f243d9cfbb219d3", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131852, "uuid": "4b15da6a-aac5-4f23-bda6-de4167d604bc", "comment": "Malware payload", "value": "a16e978ad95c5693cd1c901eb0ba671d68da722cbbe8fa1ca67a9494a2f2a6ef", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131852, "uuid": "f9dba82a-d46f-4612-8c33-2dc54b9b5f1e", "comment": "Malware payload", "value": "616feb9a65b378f2686ecc498f375a37bed920e5", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700131852, "uuid": "d482aa28-f890-428c-ad19-a69f1459d8b1", "comment": "Malware payload", "value": "168e908bb9df59334030d71bb0bc5aab708cea145ab2d127f5c447bb1b7f67b684aca67065055e5af80e5564918857ad", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131852, "uuid": "02bfe514-dbb5-47d3-8e14-f199b2b08afd", "value": "T15EB49E0172E6C0B2D2AA56700EB5E73676B5FE905F31CB8B73E4FD5D2932581A839321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131852, "uuid": "1b340a9d-d1dd-42e6-b524-8741bd4c79d7", "value": "0a726b87493ed3e84de155787907fb84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131852, "uuid": "ab2b9706-3772-4765-8282-4fd51da4eb49", "value": "6144:eexbOESfW/GCE/iHzQpda70As0W283kpTtQdGegSoxgUnW/zFFkn7O7hpUlLaEx:eeZeWSpda70ADIgSoxgUW/zFun7OjY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700131852, "uuid": "299b9032-4677-464d-b35b-389788e7f770", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700131852, "uuid": "9a208837-848d-4c48-b847-cb12ddc1684d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700131852, "uuid": "6f6ac84d-ef6c-45f8-9f6b-60c8a7cb0bed", "value": "securitydriver_debug.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd044d33-846a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700130500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130500, "uuid": "8147f5e7-c72d-417e-a5c1-254a66218668", "comment": "Malware payload", "value": "127a6cc954fbbb101a902b92785d406a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130500, "uuid": "e3960c7a-8984-4996-b1d6-42a9067b80b1", "comment": "Malware payload", "value": "a2a346beadd031170f0eec0a4b3d1e38ddf110a44e138fa855a419dd35362e00", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130500, "uuid": "51094c69-3675-4df7-ac3c-5ec02e9617bc", "comment": "Malware payload", "value": "1951dd8f380420ecd471cff7c764f208b36a8f03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130500, "uuid": "75598f15-e5d2-4583-ab28-e7b36cdea446", "comment": "Malware payload", "value": "341c7613e5590bc0702a5311395d8d387455a0f399231a37265d6873f83608272beb0c47a256da0143c2b7d6636bcff0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130500, "uuid": "6501a342-00b5-48d6-86ea-73f12b12275c", "value": "T14C24BF2276E1C073F22785748A72C6B55A37BCB25FA189CF27C627694F202D1DB78316", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130500, "uuid": "234b1ab1-442b-4205-b759-1b276a97b055", "value": "ac9b735a86914608dcd7bdd7ddcf7451", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130500, "uuid": "9a7d6c36-fc1b-4c78-9433-8b7f34cf8d9e", "value": "3072:dr00gyQM9HizRjUBgKVoZzD1GL4n+ZhiUFGFMKfcVK+VlB41c:FgfM9ClIjoZzoknEiUFiM6yKKB4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700130500, "uuid": "121178ae-d241-4a36-8c04-b06b19c7e1fe", "value": 213504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700130500, "uuid": "f6be7c60-9b7e-412d-ad71-cb5c890cc31f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130500, "uuid": "42843e61-6826-474c-90a8-8d06dfef9bad", "value": "127a6cc954fbbb101a902b92785d406a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3e4de7-8468-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700129695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700129695, "uuid": "00a73924-b230-42cf-b79e-bcae511263a6", "comment": "Malware payload", "value": "fc74471ff6620d3e79c342b3cf1eab21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700129695, "uuid": "2716164c-ea74-4853-a41f-cd6c5e4632ea", "comment": "Malware payload", "value": "a499710f67a78322f78a493b0a672095a7a636c87ff984c7754526f30d36459d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700129695, "uuid": "9d23e435-e1f2-45fc-a587-546fbd080c0a", "comment": "Malware payload", "value": "c3af197b6502fb60120dccee23e500930665bf5a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700129695, "uuid": "e0b71f75-9843-4562-8d7b-14ce8304abad", "comment": "Malware payload", "value": "870f72e4496c72db60110a31f198d585ceef88f65fe5ce22df02d4deb8f970e15efe85f6f001111092385140f9e5f441", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700129695, "uuid": "7257f6b6-e05e-42a0-9cd8-4a9371a2d208", "value": "T1AA443B03D2E17C50EA268B76DE2FE2E8771EF5508E9977662219BF2F04B11B2D163710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700129695, "uuid": "f6d5b240-0180-4894-9dca-6a0fce36fec6", "value": "3c071df9f91908eb18d041533a3c969c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700129695, "uuid": "b67836c2-47a2-42ff-aef4-162669955067", "value": "6144:ytdLurpc05Brq46FHa2GDUk9/o6KBBPNMq:yLKpc05+FHaJpKtMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700129695, "uuid": "096281c9-6f65-44cf-868f-e074de943985", "value": 267776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700129695, "uuid": "988617ec-50e1-4006-8fe7-0601158aaa51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700129695, "uuid": "514b339b-ca16-49f2-a5a0-ccb00b013ca0", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "167241b1-8466-11ee-8907-42010a9c0042", "comment": "Malware payload (Stealc)", "timestamp": 1700128449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128449, "uuid": "86648be1-9fd1-4bfc-86e5-96a6b7f093fe", "comment": "Malware payload (Stealc)", "value": "06d9f15a14bd5634c470549704a1d3a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128449, "uuid": "1a9a5a3a-bbc1-41f8-b92a-bf0be22e027f", "comment": "Malware payload (Stealc)", "value": "a56d61de6a7f641f555d4bcf3935f3cb1c22d58e21edc76ad03d32a1a8dd436e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128449, "uuid": "f86e2562-6c34-4cfa-8138-28f41332c855", "comment": "Malware payload (Stealc)", "value": "2210dc5468563e0095906c9f3765328f1f431882", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700128449, "uuid": "8050db6f-9344-41d0-9d90-24a935354854", "comment": "Malware payload (Stealc)", "value": "c3b651b5ddca81dfa691c6a8e87710dec2dc68f4857426ed70782c504bd0eae2552860ae0db6dc3a122f14b358d50693", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128449, "uuid": "9e218ce9-06b7-4f28-9592-6a6cc0e5984e", "value": "T1FE443903DAE4BC50E9168B768E2EC5F8721EF9509F1D7B6A2219BF1F54B1272D263310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128449, "uuid": "ee55c563-b4a3-4384-82c2-b7823493716a", "value": "3c071df9f91908eb18d041533a3c969c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128449, "uuid": "bed0eb3e-0d11-4c3a-84aa-41e8b6ad731b", "value": "3072:HT8pzHLerpgYGSbT0D2KxuHpoxTDSrwoRWOP2KsicH:z8tLerpgmT5KxWpotSrwOvc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700128449, "uuid": "4472145e-1dfc-4f4f-ac71-678e4708645b", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700128449, "uuid": "43987fc7-c035-4e65-95da-fe45c4c89da5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700128449, "uuid": "29f3b9a0-761b-47b3-be6c-ff898a906749", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "586da8d0-8475-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700135002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700135002, "uuid": "1366a4fe-a2bb-47ab-b162-c611ec893fc4", "comment": "Malware payload", "value": "9de9993c77412ba8fa3200714dcd58f6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700135002, "uuid": "3daa2646-051a-4209-9f82-98e6a03ddd04", "comment": "Malware payload", "value": "a584e6b5bb29c0449db3a8356b666b569a68555e1f4311c8de121b19ff57b550", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700135002, "uuid": "db9111bf-6cc5-4bf9-a4d9-e734da4ef129", "comment": "Malware payload", "value": "f6184c647e498d2ae3eb57869a5fe0bb71420cbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700135002, "uuid": "d2d73e9d-e720-46c1-b383-a9d87534676d", "comment": "Malware payload", "value": "0d392e81543b49363dfb636905d7296b0bf4d4f95f26966d45973f79955330d0b6d01d78d6ee04534fff23e782e0b987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700135002, "uuid": "684b2d40-a6fe-4aba-95a2-503b8305e20b", "value": "T1CF3833B2ED9CAC9ACF944FFD332C4ED02A263A61DDB1819E534851B51C2B7709271D8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700135002, "uuid": "a82fe2f6-e83e-41db-a44d-72db0b5e1ac3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700135002, "uuid": "675a341b-dfc9-411e-ae4d-cc4a4cf0b308", "value": "393216:7BnYWkzHpzdCVnycRBKFUNR0RcC/1yyyNrtfJ7ZKcw5UwUMPNQ4:7BqfCZycRAmC/wyCx7ZKc7DaB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700135002, "uuid": "75d3c84e-1882-4cb0-9f96-4ed57c33ecd0", "value": 104199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700135002, "uuid": "1830256e-b413-45ed-96f0-7cfb01aaa941", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700135002, "uuid": "1540279e-70bf-4572-b521-590adea930cb", "value": "wishlist.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "710df60e-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700117004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117004, "uuid": "f8741ec4-8f75-4a1c-a06e-f4a69e80f293", "comment": "Malware payload (Mirai)", "value": "7d61efa74d58f761f515d7b38ca0ce70", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117004, "uuid": "c4bbba44-e601-4873-a669-863118ca8d35", "comment": "Malware payload (Mirai)", "value": "a66187d7ea91ec73d6f3d8009aa12d6c59c49fe119740cdf7febcc39ddf13c63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117004, "uuid": "39a2d169-8df1-4553-b428-f42304bbed46", "comment": "Malware payload (Mirai)", "value": "90fbede315411be1976c1c23f796e0cd8958e859", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117004, "uuid": "1bc4a6b6-0b0b-40dc-8a35-2c063f5bd4f2", "comment": "Malware payload (Mirai)", "value": "110f7aea3a8e2ccabce631cc625bafb5187e556b245e1fbcc27822bbbafc21c474a352f15986c0f81f10a43c62d0d5d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117004, "uuid": "478965a6-d410-4732-b999-1eeb3e250f38", "value": "T1F483724A7F614FF7E89FDC3705A92B1224CD651B25A97F35BA30D818F20A24F19E3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117004, "uuid": "1b1a6d82-1343-46e5-b6b4-099c1939f117", "value": "1536:rodt3VzfKg4Sf1fPuw/uu9PLp98GfjHghP1q5Tpm:roz3Vz9f1fPZ9mhi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700117004, "uuid": "4b0fdd26-b8ad-4d97-9bd4-d90ff73e39ff", "value": 88736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700117004, "uuid": "0480c0d5-81bb-4e66-bc64-08623c0c8a6e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117004, "uuid": "c0c7804a-da30-42dd-a1d7-dc2019500e15", "value": "7d61efa74d58f761f515d7b38ca0ce70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e6fa32-84bb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700165148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165148, "uuid": "aac532a1-b0d8-44c9-b804-ce824538eb67", "comment": "Malware payload", "value": "48c897f52a3672b5cd20e9f48fc6714c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165148, "uuid": "5d1b79e4-6e44-4552-980b-e38cce67c783", "comment": "Malware payload", "value": "a740116acee69998af19e00b2866d6d479ab97620358b92b05d3449e05764e72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165148, "uuid": "c391fd20-d6f8-450a-93da-478c900dff69", "comment": "Malware payload", "value": "670eea2cc92adcb3ead868b9a4e349b11a3c9169", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165148, "uuid": "0a5957f8-89bf-4a99-afa0-570ecac6db75", "comment": "Malware payload", "value": "2aff280f41904d7ad6f36e0117c1c8223b4803f5fb5c5a901fb20b66f7d947cf770c2c6c0d9c8be7445e8e52ba355488", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165148, "uuid": "7d143a6f-37bb-48f2-bd7d-fbaf7ec77b42", "value": "T1E3C5E047A2F801E9D07BD078C597A217EAB53418033056FB17F08A652FB3BE16A7E761", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165148, "uuid": "862ad76e-74c7-4d52-8115-044d30625e4c", "value": "355515da5297885464d9d5aa23c0a856", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165148, "uuid": "4e8ae629-1e32-4776-af7d-f7fe884909e3", "value": "49152:u+QVQPqc7sOFCVnoFasajnWkwRR9G4ohFdMhFav4rrdvpVaHe:u+STuvM4odMPtrrdvpV5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700165148, "uuid": "9f552d30-70aa-4f91-a7ec-7fd947858fd6", "value": 2585089, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700165148, "uuid": "f1633f27-acdd-4a15-ac18-0b59e649b5bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165148, "uuid": "33f77471-aae7-45db-89b0-5d2dbc0a59aa", "value": "pwjmnzsexh.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1beec48c-843a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700109560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700109560, "uuid": "d3f2a5c7-2ae5-4d8d-860a-e36803358dc5", "comment": "Malware payload", "value": "6dfa982b5a0edb0bbd51ba16c46d9f3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700109560, "uuid": "3f096d34-bfd1-4c9a-b745-9d5ccaa44096", "comment": "Malware payload", "value": "a8eabecac5183dd92d96c18f8b08b41e60c301261e378238f88f260ec5943264", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700109560, "uuid": "261c0037-d36d-4cc2-a71d-99f28abf001f", "comment": "Malware payload", "value": "2c26d5907d186e2d9723d73d20785303a972d07b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700109560, "uuid": "fec43bcc-47ca-41f4-a866-26e9c1de571a", "comment": "Malware payload", "value": "e428e47686b5f532df176cfb8c78bc60c245d5970eeee928ebcf90d35b1c210284fdb23b1264ab54e7320e640ef1031a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700109560, "uuid": "2009600c-f7a0-4762-8ad9-9e2cc267d61b", "value": "T13C169D1AB2A800D8D46BC13CC5564627E7B2BC1617B09BCB16E496BA1F73AE15F3F710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700109560, "uuid": "95ce2c30-1c14-48d6-ac51-a4cf62502ea6", "value": "c8f621da1e95f4b181a292c370aaba77", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700109560, "uuid": "a107a1f2-8ccf-4e00-9f95-2d6bae3f3c6e", "value": "98304:Qs+dQDUqSOP5klcgyruZII0uxO3j2LHGhq:Fk0uxOT2LHMq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700109560, "uuid": "499e83c2-2fdc-4b47-9ca1-4f48509e7be2", "value": 4410880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700109560, "uuid": "cde14fbd-4118-4137-86eb-7048b29b469b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700109560, "uuid": "60e015df-304b-40eb-84c8-72d89ab1c76e", "value": "GCC-stealer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1702772b-8478-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700136181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700136181, "uuid": "ac83018a-0110-4a8c-a0a6-2a9624090a2a", "comment": "Malware payload (Mirai)", "value": "cb63211229ef763c0ebc01c66bc9e862", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700136181, "uuid": "3d4dda83-1ae5-4e1f-88cb-0a4aff03050b", "comment": "Malware payload (Mirai)", "value": "ab8b749287fbfad66e8208f4f31bd48a3b6d3e2278d224383173064a1cc85c37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700136181, "uuid": "521f150e-f221-442f-a761-fba1a79d5d64", "comment": "Malware payload (Mirai)", "value": "be2170316e0c40c5e0db5ab1f184a2c57ab48a11", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700136181, "uuid": "1928cd97-c34f-4b1d-b052-7e748e8c9f56", "comment": "Malware payload (Mirai)", "value": "d3300bcbb5a153478cd590b09e09a7b659a9e0626432b8f171dec316717513a2e499409b8f0faa0baae81f5f96ac7211", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700136181, "uuid": "1ea6b65c-2a25-48ad-b4ba-96a5b37a7d5a", "value": "T15D92E16CB1EFC473DC1B33BD66AE189C84253DC44BD4F7225590E092D2898A9C97BF29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700136181, "uuid": "ec471703-761a-4768-a3b7-b9d4c4d7fe75", "value": "384:MtzDQafmCIa9CVfTs+ue6hZCqPslEprt/GZ2Zhx2l9v1RC7:qEaCFfi3hZJUSpR/GZmhxOC7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700136181, "uuid": "47e3bd5f-a74e-414d-be5a-bd237cf00a88", "value": 21188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700136181, "uuid": "579d4a35-8e13-4c85-b7e2-9f4c2718b761", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700136181, "uuid": "dbb48939-b0aa-4d76-9256-8becf550a6e6", "value": "cb63211229ef763c0ebc01c66bc9e862", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "656751df-8444-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700113978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700113978, "uuid": "0962c077-4830-48d7-9dc9-8f5b87fcef49", "comment": "Malware payload", "value": "85ced175fc50113e11a118e44f83f57a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700113978, "uuid": "10b1b423-8216-42ce-9c57-976d45ad89eb", "comment": "Malware payload", "value": "ac5191f13cd12090eee4819aa75fe5795df43a9e3101753666734ab2ad5da168", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700113978, "uuid": "c0263438-db4a-439c-9417-f9f8f82f69c1", "comment": "Malware payload", "value": "0623207b6b2f59278569b1f431f9cbb97a56baf4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700113978, "uuid": "c94d10e5-1b69-4b3b-a9aa-f56cfdbac821", "comment": "Malware payload", "value": "5d0e87781228e969d1fc6a2b575faeb09576793282e5ced34603e8503cba203d0ade93caac7b4d911ccba9a41a85f2b6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700113978, "uuid": "d6d63b2c-c4b2-4c6b-8e3f-0718ef8c9b24", "value": "T1F984BE03D391BE54E9218B7ADE2FC2E8769EF9508E2977563219BF2F10B1172D263710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700113978, "uuid": "0fdc65e7-c170-401f-ac49-b354916f5eca", "value": "cb006aeb614c0887ced2ab5d10258afe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700113978, "uuid": "d573273c-701f-4a3d-a55d-4c07d6b66103", "value": "6144:DLiidECmWHgYTzjJZR2RPKlnQ1CC9QDE2D/4t1VDsVcXgQY:DWiTBHgYTzjw5KKJg1avsGwQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700113978, "uuid": "e8efd5c6-fd95-41aa-b8a9-06070fa77da7", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700113978, "uuid": "952a5573-7871-4460-bfb0-a2db7fb81e76", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700113978, "uuid": "7f8e5788-a4a9-4325-89d8-19c772bca848", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0251ba7-84d2-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700175146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700175146, "uuid": "e3e39cf7-0f0b-4d24-81b2-a307b672f2f0", "comment": "Malware payload", "value": "2e47c53f67093f0a5edb8e03bc48ab02", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700175146, "uuid": "e012f7f4-4d04-4fcd-a9f6-21248c943bff", "comment": "Malware payload", "value": "acc7e32e8f61afed7b9ce6feeec1cd281f280a2feeae33f08ba97ce3596078f1", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700175146, "uuid": "aefd898c-d146-4989-8bc8-e7210f50a3fb", "comment": "Malware payload", "value": "7af38ada5d0bafdd58784bbeba3d0c2907bb06da", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700175146, "uuid": "32057a37-69cb-4012-ad20-e6f7185acbe4", "comment": "Malware payload", "value": "46edf7d652e0c871db844657f0dbb241f1c4528e951a8fb258c058bd1e870139e711e0ad619e7364b74eef5d4a0402df", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700175146, "uuid": "f6693445-36e2-4033-a3db-3c34a09cc24e", "value": "T12DE5F151FF18E52FC9B394330661863252664E8D8A42E39369EC735C5ABBEC00ED5FC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700175146, "uuid": "f3c98bf0-5e37-46c7-b309-e6905efb218d", "value": "49152:ZHu9i5tnKjqi+PsKe5Z+ye07P4+i34XUlF1bmRCbXF7pIWeTdipIpL7SmD8H:ZOIfKj6e50yNT4+i3QKbXF7pIZxSmD8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700175146, "uuid": "9e5676c3-d165-4b48-b9bf-6634de679c74", "value": 3297818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700175146, "uuid": "04a6e244-0e1f-45fb-8562-a3e90d07cc89", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700175146, "uuid": "34ab8a89-e9d0-43a5-aa88-32ae871e1122", "value": "cartel1.5.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dfbf735-8489-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700143628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143628, "uuid": "04623e21-b86c-4ee3-a9fa-6580fe507b4e", "comment": "Malware payload", "value": "04754a7b9eb785450822ce826809b854", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143628, "uuid": "53cd2d3a-41b0-453a-8f0e-5957ac337460", "comment": "Malware payload", "value": "ad9c8996d6ef2ea7ebc6a2ac280fd534f54e0f637b56fe91298dd91b498181a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143628, "uuid": "7a3452f8-ffb6-464d-b8b2-3d803fac8c43", "comment": "Malware payload", "value": "98a9875a3ca926bdf5e11cfc55788fa4a890b1da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143628, "uuid": "d8f6a0cb-d267-4ebd-bfb0-007910667192", "comment": "Malware payload", "value": "d517d43301d91c342c757209438a414d88a62c291d7476b952a461e486693af0a9e83ec0b0dc4d8e4b1f2213b531236b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143628, "uuid": "dfde38ef-1729-4e21-b62f-efa66b097aef", "value": "T17BF56B47F29250E8D069D174961B6333F9327C4D47247AEB5BE08B312FA1BD06A3EB25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143628, "uuid": "4c0abb62-ea86-4717-a911-ed5792e9966b", "value": "faedbb015de3a31cdc62e0394e98eb33", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143628, "uuid": "2b66cf2b-3339-4db8-b679-474c6831d1a4", "value": "49152:rCBhtI6lXHavaCWzcjCP8KnFHwTvC6NZfJmSfSY7jwhs8xdDjtMSyfnX:OBhflKvIDPTnFPap7iNdDjtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700143628, "uuid": "4fd203e4-3dc3-4fda-9a63-946ceffff04c", "value": 3432960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700143628, "uuid": "969035e1-3a8a-4e6d-b810-74f1acbf408f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143628, "uuid": "47435de1-7fe6-45b0-802a-fc8b590c3cd4", "value": "controller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7048d62-8492-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700147643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147643, "uuid": "1a61b89f-5ace-4381-8540-5dcd49c894ea", "comment": "Malware payload", "value": "8db522805e565ad411c8b713dd5558a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147643, "uuid": "a37b30b1-5268-4200-a740-d1251373a9d7", "comment": "Malware payload", "value": "b04caf3e505f0d1a6ed6348f82d5ff27de4a8ff134154c13b20c0409912bb12c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147643, "uuid": "8b38d25f-e6dc-4987-a741-fbc0190ada86", "comment": "Malware payload", "value": "337adb956089c15f4c238291460d2b201214f63f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700147643, "uuid": "64c9d554-6490-4cc9-be4d-d18755c12b5b", "comment": "Malware payload", "value": "c17ed5d6daab8c0e78bc97b737f9b82d773d4b62b4606255591d59b25baa090c88af29c9d0e932b3afd0ab1461ad19b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147643, "uuid": "85b1b6b9-7a85-4b6b-982e-55020e91cb24", "value": "T197344A43D2E0BC51EA168B7A8E2FC2E8761EF5508E5D776D2219BF2F04B11B2D263351", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147643, "uuid": "1a3f0886-2185-4afc-9808-f99c1cd83a7a", "value": "1e4c03c8d316dc9d74593d2b0d247c9e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147643, "uuid": "132b5b19-2e27-41c2-8fd8-add17f964317", "value": "3072:cD8LMI/rMrVLIwaFqj2UAKDJ6xlnORuC5BHKsikfN:VLM2rMpLlaFq6UA7/S", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700147643, "uuid": "420e717e-1efe-4c88-bec8-634f2fa63189", "value": 247808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700147643, "uuid": "3d5d3f49-da19-49ab-b4fe-b54d72909f44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700147643, "uuid": "d172fa81-0795-4db2-a5c1-ff1a07b2f07b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "716e58d3-8495-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700148788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148788, "uuid": "f325251c-eadd-4a27-9edd-d0115a19e93c", "comment": "Malware payload", "value": "3394aa9dfb48e470547e7f8628375edc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148788, "uuid": "edcec283-f906-478e-94cc-7ac049c9bca9", "comment": "Malware payload", "value": "b2e09b439d7b6af1c30f4d626d29ad458476bb12739164f2650752445ce0e210", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148788, "uuid": "fbc2adbd-9007-42e7-8d6b-845981476b98", "comment": "Malware payload", "value": "61a0e1e57a660aebdb36db1a27af1455370d6510", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148788, "uuid": "d72ee371-c319-45d1-bbad-0fa1d6b0bc28", "comment": "Malware payload", "value": "60a37cc07d2c9c5398ad292ddeb3cecf06abea3ac34d927ee0099ef48c9645fa13cab0aa78cfbfdef7dab677ccc33135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148788, "uuid": "bb2ec373-c5c9-468f-89ea-79bff133b3b1", "value": "T177B59D80E2F4A64DE4DE8636DE2067F5A2B264577723E359EC40E659783C2D7CEC4223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148788, "uuid": "036600b5-26d6-4bca-85b6-30cd3e8646de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148788, "uuid": "ff04a7ec-25c0-468e-85d6-792c49aadd08", "value": "49152:ZqCY2nf4AUBeTNQqw/H2a2fidVEtMoo9SSwMKJrEmzuZWj7T:Exqf1pdw/bD8OkXcE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700148788, "uuid": "e254856e-b6d1-4cf3-9a1c-fc2013219d01", "value": 2341672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700148788, "uuid": "e18b45d6-1d94-4ae5-a53c-2b28040fe0ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148788, "uuid": "6bfb76aa-34f8-4502-9ca1-eac747e174a7", "value": "AVISODEPAGO3670022749.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "154f6852-84bb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700164954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700164954, "uuid": "661d57f9-7c57-44dc-96c5-ff4cd00d966c", "comment": "Malware payload", "value": "65d50eda24e47047f849316bf712c90d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700164954, "uuid": "743408c0-d550-4518-98aa-c476e58b485e", "comment": "Malware payload", "value": "b4591551e3ef6ddbd28789dca18363b860900a7a40372302b1ee7b0c78e681e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700164954, "uuid": "decb76f2-39ae-4745-b3f6-89882eca591d", "comment": "Malware payload", "value": "665255c0df590b9b495944c10ae4fc59137958ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700164954, "uuid": "f80d509b-9663-440c-b1d5-64f79bb38d8a", "comment": "Malware payload", "value": "3d5b41b0f4531e9302fff16e2c61948333062ecb3b754d730869e93824c22d619e36eb5bb972ad071bc981002a5b22bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700164954, "uuid": "7e57ae69-81f7-45fd-acaf-1949fe4ec4ae", "value": "T1EEA45B5560CC2846E1EF2FF65861EDF01CEA9B14839261CEA44EDFA9AF788F17D24443", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700164954, "uuid": "e4c2aaa2-2e70-4c93-8e71-295b3f8ee15a", "value": "051028f1d8b2fa5ae86007a10426ff26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700164954, "uuid": "2e3d9b8f-0e18-47ad-9e5b-45c92e383738", "value": "6144:NTqqmhIeJF6kk8jpzwzSKE9o7DibjBb6LDG/lqaDs4Y7QK1:hqqiNJF6tZ5gBbbHDs4YEK1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700164954, "uuid": "992656a7-5d11-4ebb-be11-a301ba044fad", "value": 453908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700164954, "uuid": "6b11c437-2652-47c7-89b5-fb0ebebfe766", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700164954, "uuid": "1c4ed943-42c8-4c92-9b76-c8dc946dcf19", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92344b5a-8464-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700127797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127797, "uuid": "308c02ff-cb7b-40af-914f-cc008cfa2063", "comment": "Malware payload", "value": "424a3f18c19834d29b7a56bbf34100a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127797, "uuid": "3debfcf0-0132-4966-a15e-2796f151a46b", "comment": "Malware payload", "value": "b565fe1734ee581763ff75a4e26f262d8268333f675d0a5bc2681950bc4ff6cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127797, "uuid": "aaf2d7dc-fb88-4dca-9fc3-297295eaa952", "comment": "Malware payload", "value": "30416ec4a80ff6565837f60eb5595221fec130fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127797, "uuid": "800565ce-9cd4-463f-8458-bba040dbf416", "comment": "Malware payload", "value": "0e4ea973eba1f112254e4549005cd98242027ba87d3e22c84a561f461f97ff347a03386a3f0911c93ce7431cb7f0015b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127797, "uuid": "05b8b442-1b49-419f-9a04-701faae3da89", "value": "T1EEC4C08392A17D54DA254B73DE2ECBF8B61EF8508E4A7B262128AF5F14711F2D363710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127797, "uuid": "488d8831-974d-498c-a4fa-b1442523f076", "value": "0a046e791e3122b7d021f9aaf3ba90b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127797, "uuid": "1f8888c5-0fdc-4033-8206-f571ea9a96b3", "value": "12288:nPdm6c7p6hUdAezJgYYTydDuYLUULPhCVF:DMmUdAGJgYKydrUUrhC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700127797, "uuid": "f3c385cb-234d-4811-aeda-b34aa3cad68b", "value": 564224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700127797, "uuid": "81df5dc8-e35a-4dfa-9557-b9a62df516cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127797, "uuid": "99dea0c8-69de-4e55-9286-82e7cf332482", "value": "424a3f18c19834d29b7a56bbf34100a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc90cf8-84ba-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700164589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700164589, "uuid": "e208e3aa-c626-454a-934b-f6081ec3289f", "comment": "Malware payload", "value": "f3f399969bd6249decb7be58ef3c352c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700164589, "uuid": "df3786bb-41ae-41c3-9f2a-a17858c38016", "comment": "Malware payload", "value": "b61e2f809951583a432ac8096b49b2a97506511109ec5c673831a28759cd44bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700164589, "uuid": "d294499c-d6d6-49ef-87eb-e99d91902071", "comment": "Malware payload", "value": "8c3067cb80dc278abafcc162199e346471ac1241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700164589, "uuid": "f418c61e-30e0-470a-8fdf-b05883cf7b22", "comment": "Malware payload", "value": "de4d90087c0bfe464a70fdb3d18b1bb94a1579dbe3cba3b17f11cf62ff15b24daec74fa7fb4890cdd7b8decb8541b277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700164589, "uuid": "b49135b3-8ab6-46b2-8731-f7b3c28a0b4c", "value": "T1CD34291392E13D52FA26CB729E3E86E9B72EF5908F49776D22189A7F04F0072C163751", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700164589, "uuid": "d082e409-1183-4833-8dc1-4238dbebca4f", "value": "492fe0937e3852812628feb9fc58ce9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700164589, "uuid": "767b2055-715f-4ffe-ab5d-947f0213b3fb", "value": "3072:zYJrL/0ofn7KTmmJ/fyMC86A1V3tATZ8OWGnKR+iFWeJN1Xf5:4L/0oOnTPj3tATmO/FiFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700164589, "uuid": "660fe629-c0ae-4d7d-98dd-4395616e1a81", "value": 251392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700164589, "uuid": "29371548-02ed-49a0-a4fe-43253693ebde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700164589, "uuid": "b20f134e-f1f5-43a3-a474-a7410fe094bc", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70f8a01e-8481-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700140197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140197, "uuid": "bbf25971-e0ed-4620-a52a-42643e56e155", "comment": "Malware payload (AgentTesla)", "value": "3484440a127b63bd6b10b24568157f2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140197, "uuid": "9a009126-8e63-492b-b721-0d0a3d6469fa", "comment": "Malware payload (AgentTesla)", "value": "b78ba2452dad088b1530134732a00370192386281eb368aba2aef6f9cc11ae97", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140197, "uuid": "2ffa2d9c-b0a8-424a-9d0f-a19a1145047a", "comment": "Malware payload (AgentTesla)", "value": "ee3e54b8925d0094d75a32cba486240776701d9b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140197, "uuid": "ea254255-0a01-47ed-a694-d32b8196c818", "comment": "Malware payload (AgentTesla)", "value": "d1f92a73c11ad466c0864490f99eb15bc548780e6e635dc965cda1c20e50e2a55a8ddabfe5fc89f1164c3e8e6dd6d187", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140197, "uuid": "4a53ff2e-f253-4e10-8b21-7059e9642b15", "value": "T14815282C51696F4DF7A482FCB2758CFF17A5782F90ABF9F7884CA0D706A97D04502622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140197, "uuid": "baf0c2d4-c190-45f3-ba38-1a38661ce02e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140197, "uuid": "71ccfb41-52c7-4f27-aa2b-b2ea5cd77715", "value": "12288:oOCaEuPUpEjbrhqH4kuLaR+yDKZVkB2clP8wwo07sVX0:o3aXUpEjb+DSCp7zed", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700140197, "uuid": "ac00f8f0-ec67-4702-a6ee-c999557deac3", "value": 914432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700140197, "uuid": "4288e3eb-e2c6-473b-bce3-9feb6aec0ee8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140197, "uuid": "8718c764-949d-44a2-8ca2-93f4c721b439", "value": "DECART.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "023cac72-847f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700139152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139152, "uuid": "3236b21f-3f35-49eb-8ddb-5ee71922fad4", "comment": "Malware payload", "value": "59447e7eb854c5883e64cd6cd2656e11", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139152, "uuid": "ab7dafdf-8177-4f4a-8b50-81441c238724", "comment": "Malware payload", "value": "b90922b5e35d6368d5ae449c45a111323f5d3b883416b0c13df5c1ecaa25d9bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139152, "uuid": "119cd753-aeb4-465d-a802-06588e54ac3a", "comment": "Malware payload", "value": "a02ef8dadde0596702f8792a6906320b30e2fa22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139152, "uuid": "3cb374a3-d5ae-44c6-88ec-2a11f9b76abb", "comment": "Malware payload", "value": "9c2833534513debe4e595917e33e0a632946f23f0f033a0fea559eae90133c9d5fe31cdcd4dd82160f11a81de4c29c15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139152, "uuid": "0c9d48bf-4b30-4c8a-b711-5bcfe37e4973", "value": "T14FA4F1A963A98625DFFF22BBF4A132021F74D4C96422FB57998C4AF61D127811F2431F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139152, "uuid": "bdff77bb-5287-4c5c-9fb4-3a071a49c38f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139152, "uuid": "5242463f-7489-4efa-880b-8639c4967204", "value": "12288:74JNW3TamlJANxO5Qa+VppbnoU0o3+c6oI:74JNWjVJA85IpbnoU33ry", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700139152, "uuid": "bb51fd65-298d-4e94-9a09-31a354cd5194", "value": 462336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700139152, "uuid": "432a8bac-a795-4c63-b7c6-d3f241f1f3b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139152, "uuid": "6f527925-30e2-4c27-a0f5-c439d072d7f1", "value": "SecuriteInfo.com.Win32.PWSX-gen.16149.12119", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f89c4b1d-84bd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700166194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166194, "uuid": "99f10386-9aaa-4e9f-bb18-e5c7212b3b32", "comment": "Malware payload", "value": "1b5a0fa9011641c56cc221bcfbb4a2ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166194, "uuid": "44f4d70a-f610-4406-bdd7-07f996841d1f", "comment": "Malware payload", "value": "bbd761200738143705543689c13919065c19468a060b7cc63366ec414fcad107", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166194, "uuid": "d6064a54-0a05-40c7-97a1-4612bf1fc8ad", "comment": "Malware payload", "value": "fee659c8ba5b437a487818f8fd7d2e7170c36774", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166194, "uuid": "311d75fb-b383-4460-8a4c-4d9a4620e168", "comment": "Malware payload", "value": "99807453d91532a67d16bd0ed8f3ff7ce8d8e9cfa41d6a5d1caa154a6a74dc0cadaa13875dbb3de21c20acf0eaa726ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166194, "uuid": "e38af1ab-b689-4e59-bf02-5121f190da31", "value": "T145343A5392E07D43E6268B738E2FC6E8761EF6508F49776922189B7F04F11B2C163B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166194, "uuid": "d48730a3-ac8d-479a-a793-730c69546c0c", "value": "d95f0de2d3200302100bf757ee3e513d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166194, "uuid": "bcfe63d8-ef40-40af-bdf6-75f681fa5769", "value": "3072:faRO7LTd01hfIZEpuIGwSVIfgKbVb7g5NafvlXRO7meJN1X:f7LTK/GJVIIK5b7UNsW7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700166194, "uuid": "cfe6a280-53c1-4e62-aa90-c5e80ca57650", "value": 231936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700166194, "uuid": "465ab949-6db8-4311-adc5-02a4d144e383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166194, "uuid": "b3ca0e71-b2b8-4124-8d14-3ef45ef60917", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d5401b9-844b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700117025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117025, "uuid": "6fe835d8-85b4-4158-87fe-c2ca022600a3", "comment": "Malware payload", "value": "33d9465d691b20e7cb62f2772eff42d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117025, "uuid": "0b7e8394-9f3d-4403-80b9-d9f915bb6d95", "comment": "Malware payload", "value": "befe61b9b1c1a12cf960a61cf5786fdb1a94a33a6229973a0a2cd45fc3bfd8d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117025, "uuid": "30a941c2-b07d-4e2f-bab0-50e5c0b6e536", "comment": "Malware payload", "value": "a71cd9ac86b7585ac8c8a61196ad70a230fd3589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117025, "uuid": "d33676ad-c711-45bd-a8d0-de62bf76e76e", "comment": "Malware payload", "value": "949308ed19e4202c05af0cb80b03f14b366b385fb244a1ff0712149d3519e8b7809f4127d9453f4036478a6d5170ef58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117025, "uuid": "3eb52ed8-fe7d-4367-a8e8-9a723683b659", "value": "T1BAC3F731E8044B1BC2D223F6E75A469E3F351E9793E733115A3879B06FF27992E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117025, "uuid": "4c3e0421-c797-481e-b474-133f24eb9c33", "value": "3072:6jVlyaL5JCrIpv04sFbttiEiTmP46aQyfPlfKsNb:yoCJCN4sFbHemP46aQyfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700117025, "uuid": "f71407d2-7166-4ff2-8f24-429f11d0953c", "value": 129898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700117025, "uuid": "a30492d4-7b7c-43a0-ab21-a1330d901a9e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117025, "uuid": "1fc5d370-a459-4b96-ab53-bd2289793cea", "value": "33d9465d691b20e7cb62f2772eff42d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61791f79-84b1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700160787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160787, "uuid": "6ba4ce48-5053-473f-bc4a-5b40d31936de", "comment": "Malware payload", "value": "9aa2d123be73070701cf5fd4219dd79e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160787, "uuid": "b76509ec-65cc-4802-8395-aca337c0923a", "comment": "Malware payload", "value": "bf21d7eb8c5b9f7930fbbd9d66e63715ab7d0f116db5091ef45188e1230ff7e6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160787, "uuid": "a5342cb1-eff0-47ef-b1d5-c3bfa90f750e", "comment": "Malware payload", "value": "2f5e11983a69374a03a6068837f77bf70f4d21e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160787, "uuid": "2aafa5a9-a07d-4e9c-93c1-c238ca2dd0b7", "comment": "Malware payload", "value": "2cb3e9909444dd7ae39d5e0caffd988bc56af864afeef7cab8d231cfb702fb4bfcf5ceb896cc4df7a51721fb6c0a249b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160787, "uuid": "aad72c19-1bde-4fa6-bf9e-1005324fdd38", "value": "T1CE4533DC7BE54429E1731CF012AB273C7A3BF5B36819CA59A570287E7C652DEC0523A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160787, "uuid": "c47953f4-97c4-4487-99b0-c5d538b7acd1", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160787, "uuid": "0237903b-5ec4-4cfd-8ca1-ba5aff1bf6e9", "value": "24576:ILwtLyRkHsb1Zti7LUJ90WxTAe89sC8XQTxD5:ftckHsb1vkLU3xEAC0QTf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700160787, "uuid": "4b94c421-739b-4e8e-9365-8d2059836e22", "value": 1201664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700160787, "uuid": "b0b88a5e-8d00-4353-8902-e186e058178a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160787, "uuid": "efe9e1da-f8b7-4aa1-af57-13a5df1e8290", "value": "BraveCrashHandler.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8371cdb2-8422-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700099426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099426, "uuid": "49c53cc5-4f93-4a9e-81e8-296daba41534", "comment": "Malware payload", "value": "986cdfa009a6a5ec0e4bdee91a164acd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099426, "uuid": "2a21f02d-9a55-4270-a93b-eab6f8e80c17", "comment": "Malware payload", "value": "c5c00a192d1427f8d60b64e3e769c7f16b2fee7133dee7c63c042faaea4919fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099426, "uuid": "64f84429-4984-4dd6-ad94-37a6c72c492c", "comment": "Malware payload", "value": "532d815080131d4976fef096d415d7cfd9ee05ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099426, "uuid": "aeeb70dd-216f-479e-a273-3d986c353a9b", "comment": "Malware payload", "value": "102abd8e09f8b03c0966d4e02d6e308003889e272ea5fe98db8fffdf8aff0f68241ae1e6cff332f3fcd014faabbd22cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099426, "uuid": "7f4ca956-db88-486b-b6f6-4d944f537a28", "value": "T13D442A6392E1BD54E926CB728E2EC2F8765EF9509E097766322CAF1F14B1172D273310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099426, "uuid": "7f2d233d-74c2-45f1-840e-ec3b1026aca8", "value": "2019e2f2e2ca0590589ed6b17ba008c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099426, "uuid": "75b3f4b1-11ba-441d-aad9-081e6a0bdd99", "value": "3072:SnZkL2pqOsKdki8jnSrmBJaleBBdohw+J70R2R8bckSHCAu:ZL28OsekJCmBJalqBdoK+JjR8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700099426, "uuid": "7d89ef0f-c702-49e4-b230-a2d3f338044a", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700099426, "uuid": "3a890bc6-dde2-4756-b75e-d5d96ef1875f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099426, "uuid": "0305d8e4-e903-4fc8-860c-780d09b0f089", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2c6b4e5-8496-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700149434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149434, "uuid": "7d9aa93f-a71c-48ec-9a47-5c9ec5a32857", "comment": "Malware payload", "value": "ea6fd6ca47514d9c632c119d73aef528", "object_relation": "md5", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149434, "uuid": "a3ab92bf-d156-4a8d-84a9-8bed232e2152", "comment": "Malware payload", "value": "c788100411c38388afc3438dccc05297ac7a77083f579e4a7e8d6e1479214fde", "object_relation": "sha256", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149434, "uuid": "ef5773db-9e98-45e8-9cc6-9979a6f00fa8", "comment": "Malware payload", "value": "0d47cbd6d19a17a57077cbc0d0aa659865458672", "object_relation": "sha1", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149434, "uuid": "de07620a-c1dd-419b-9ca0-1dfbf30ca03c", "comment": "Malware payload", "value": "1ab8693dd51c382a7c7b26f89ca78749399a744cb5c461fccf41eb7cd516836e2c68939c67ae38cf6a2b4a64aafd8f08", "object_relation": "sha3-384", "Tag": [ { "name": "DarkGate", "colour": "#BD9475", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149434, "uuid": "5329d237-f2b6-4dc7-97ef-faaf3a83b940", "value": "T15834D959799B21264F33B3769F6F6018FB6A413755029104BCAD43A82FF095402BEEFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149434, "uuid": "39062567-7785-4a6a-bc4e-d68eb6e918d3", "value": "6144:k7hgXeerjqlI2Iro+Qqn7hgXeerjqlI2Iro+JGxw:ehgSlI23W7hgSlI23Ct", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700149434, "uuid": "9d23c136-91d5-4a36-aacd-8c25f8e40330", "value": 242706, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700149434, "uuid": "4926e4ec-46c5-41f5-bdb9-35d47f44358e", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149434, "uuid": "0a86f765-48fd-44f7-a73e-5afebb3143b2", "value": "JNVEEN.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "883dbc4c-847d-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700138518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138518, "uuid": "3103bfec-631b-420b-9136-b52bb8cdfc4f", "comment": "Malware payload (Formbook)", "value": "ef8d477861854541592ffe50ce56d3da", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138518, "uuid": "159c7538-3da1-4132-ade1-8eae297cbfdb", "comment": "Malware payload (Formbook)", "value": "c7b9dfbcf65edd98aff82ea3e1ffe6b0f83eca9c3c892de4ac8681fc1a2bb6d1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138518, "uuid": "7d68f2de-0f66-4176-8627-68106edbc2f9", "comment": "Malware payload (Formbook)", "value": "039477a4c34bc104a4ff797288ef3d8a01900ff6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700138518, "uuid": "92d089d6-2e79-4556-b174-9e73e9ff350c", "comment": "Malware payload (Formbook)", "value": "48bddeeb093ee4938587e7acc58462df4f6cbb30d53dc417770f42cc7986f877b8ff715e18d6c151fbbbc3163e2062d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138518, "uuid": "1ee880d1-84aa-432c-9581-31ce7060b8c0", "value": "T1F1250141F459DE77CA7C88FF598504E103BA5C3A96C5D3E89CC1FAEA22E1BD1C61284B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138518, "uuid": "1a506107-b9ae-46c0-9be4-8e5ec07c385f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138518, "uuid": "afcbb736-65b2-43d2-8b49-476b2761c952", "value": "12288:qRP8sE9ARf1zb2iNkuPF337m+lLptOdn4RIdqBQ4U62yEUfrpHrAQU/RVXV0jXvE:U1l5Lm+hptOGRm62nUDpHra925VUS92", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700138518, "uuid": "2817e781-57c4-4ccb-ab3f-473672156e5a", "value": 1020416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700138518, "uuid": "63c7b4e2-09f5-4124-a9f8-fc984a1c5b0f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700138518, "uuid": "45d13300-5e97-43cc-a2f4-2a88dbe4b997", "value": "9008654324456.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6eef488-84bf-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700166943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166943, "uuid": "742bbb2d-c5d5-4645-af62-eb6ce741a365", "comment": "Malware payload", "value": "ba26b003f8f8b00da1bb1e4c12d109cc", "object_relation": "md5", "Tag": [ { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166943, "uuid": "59db6f63-3e73-4fa0-b092-89df187ca4ad", "comment": "Malware payload", "value": "c88467a4416518a52ce45a51f96c9c280e3ece539613e82b0d9fe6f2d4122a3a", "object_relation": "sha256", "Tag": [ { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166943, "uuid": "853039b0-50b0-413f-b7a2-364aae726273", "comment": "Malware payload", "value": "a88b3cc71121c9b96053049892abb98b4db3eedc", "object_relation": "sha1", "Tag": [ { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166943, "uuid": "4df0ad82-8846-48c7-a675-13cd8eb4e9a7", "comment": "Malware payload", "value": "ed8300e81a88b28645a522715bfe46f492bebe99ae84ecf1f672e9738200ad2133f74914cc2a020757df486ddbcff6a2", "object_relation": "sha3-384", "Tag": [ { "name": "APT34", "colour": "#3BE09E", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166943, "uuid": "dc76027f-eab6-45ec-ba99-4d9633a2eeaa", "value": "T121744A72FC826C65478EC73B275AD1DEDF5B8AC768494C79FA809DA060AC643A1C4DF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166943, "uuid": "873e7bfa-b49a-4388-8333-7190074dc491", "value": "6144:ydr8fmEOmqG2K13qPIWAiC/Q5FNTrmwMtGQqOh5PAW7LebJcDgym8/kU0:0QDOmqzHPZAilTiwMtfh5P1Lo4kB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700166943, "uuid": "77e7fd45-a4bb-4a81-abf9-462c9058a56c", "value": 354061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700166943, "uuid": "6b224708-3333-48d4-bb6e-101bb27d037f", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166943, "uuid": "51b358b2-be19-4fdf-8c81-136ef1cda115", "value": "October_department_summary.pdf.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa10d35-8423-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700099742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099742, "uuid": "64345a6a-ce45-41c2-ac76-6bff91f65d59", "comment": "Malware payload", "value": "4a00bfe737f5e4d59657139be86ce95f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099742, "uuid": "7301a00d-0588-4486-abf8-7f86752007f2", "comment": "Malware payload", "value": "c99f57b763d90598609eb0b585ca8399057531d171021d3052efdefe26289117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099742, "uuid": "4d70c5a3-4d13-4ba7-a24b-73aa8e19c361", "comment": "Malware payload", "value": "85b04a55e86df8a4404e34c8d3344c3982ca3988", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700099742, "uuid": "9be80b5c-2b96-4dbf-802e-4d78cbee1194", "comment": "Malware payload", "value": "3f99a6430fdac7fba73d659a49f51a80f8c06c218be5cc59d39177f60aafdf2668ed50f91e0f497523bf541790245f9f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099742, "uuid": "291aaa93-8384-4f11-ae07-61c297eb6d5f", "value": "T17C166C40E2F2A64CF4EA85319E70A7F85273B423A722D359CC58E519747EAD78FC0762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099742, "uuid": "afb99206-bbad-46ec-a1fc-337b0d552451", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099742, "uuid": "75660aed-1773-41e8-9514-f38f3c0df61d", "value": "49152:sOxAFStryyqCIldeSdVvogcnPBBGnGqGttviRshAU+vkcLHmGPkZn/CU2brTNdyg:s3ShqJXsPBBEGqklQrVHknkkETwU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700099742, "uuid": "cdb26e27-af34-4da1-9f53-4d2015b933a0", "value": 4180336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700099742, "uuid": "baf8fba4-8dfd-4c33-9b8e-013d67ed2cc8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700099742, "uuid": "521b28dc-d347-4afe-98bf-152e4690bcb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d39ef1-8496-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700149042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149042, "uuid": "265f5f3f-37fa-4ee7-a0d5-a1a3e5c5247f", "comment": "Malware payload", "value": "3e368055148cb6a46d2c37c22e7b6d7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149042, "uuid": "90893ff4-de94-4220-a2ee-94456da7e24f", "comment": "Malware payload", "value": "ca3cc0a015ed43a1441a993097ec2e774ad3823d372fe2a78ef2c42ecf7eb7fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149042, "uuid": "7ef592ee-8a96-47e9-9510-25f09d4b4e60", "comment": "Malware payload", "value": "5ff4a741c50a7ba749db056f6c8576e1c9f07a93", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149042, "uuid": "b51eb31f-ebd9-4d22-8792-5dae147de424", "comment": "Malware payload", "value": "6b30a950438ad25a97ccc8004c272901328f20f1a49954319521e8c2515c8acd55e342039ab93205783fe596aef440fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149042, "uuid": "f4538c93-b9f5-4e79-ac25-bd00a2d52a61", "value": "T10584AE43F2E17C44EA668B369E2FC6E8761EF6508E5977662219BF1F04B10B3D263311", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149042, "uuid": "8a74c44a-b883-4fe9-809f-e3cb652bf94a", "value": "213f519d1d60f9b08b3f96159240536b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149042, "uuid": "d75fee89-0065-4c71-8514-98280b4f22d7", "value": "6144:CoLwV/vaoA4iuDorUhN0cTV06WCKRkqGxT68JmFc56:Co0V/ziMLhNZ6kiFGE8JmFS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700149042, "uuid": "8fe170b2-481d-4de5-a2f9-8aa0ae71c517", "value": 395776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700149042, "uuid": "d397d890-f391-49b5-ac32-8081d91f3fb0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149042, "uuid": "95053510-ce8b-48de-8b40-a401e4d99d4f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f46f1b1-8494-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700148382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148382, "uuid": "00f3d84e-5e10-4117-9e9f-4db0a76bc477", "comment": "Malware payload", "value": "346653c519764715151ab112aa67b33b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148382, "uuid": "0d2d7186-41ae-4047-9ae2-4f18c48af0c2", "comment": "Malware payload", "value": "ca52eddefe7a16c9ffdda0b9f97829695bf0db06bf7b9dd05bb3585cd59dd1d0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148382, "uuid": "4261c214-9b0b-4ff2-ab84-dda0606b206b", "comment": "Malware payload", "value": "a292771ff7ce9ff5f497b5ebb3ac5565573a73a4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148382, "uuid": "226bf78f-dd97-4e8d-ae86-ed96c3a62487", "comment": "Malware payload", "value": "5f02371f6550525347d77b5a4caec97bbb9ef8040c50dbcc1afcaedb8f65d151302a5495432c3cededd32fff0e6a683c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148382, "uuid": "17d4c891-2b00-4992-9666-ed90a585de06", "value": "T17876332479E1CFB8E15285354CD10EAA36F4E7B11720C4B777CA482EBCBA9C552B439B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148382, "uuid": "7fb924b5-7e56-4ec8-b32f-40d7fc45888a", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148382, "uuid": "6d5c7a89-202d-4a4d-96b4-eceba1d2dcc4", "value": "196608:91O7wa81MHVjfW/O1GSQl6Z59Je+Gv8cLEmNaha05YxHR:3ONHAOfYwi+Gv5L5khYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700148382, "uuid": "a17bc6e7-6765-4126-8a2a-ca503be9e409", "value": 7506584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700148382, "uuid": "46a51ee3-05d7-43e2-a61f-49dc673889ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148382, "uuid": "1420e180-1aaa-46d5-9464-592dddb13650", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15789c52-8496-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700149063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149063, "uuid": "6473d5c0-7dc9-4d34-afb2-094ecaa5caa4", "comment": "Malware payload", "value": "8649a5248812491cf5d512194361caee", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149063, "uuid": "64766bce-eb3b-4d67-a21f-3a942d5f68de", "comment": "Malware payload", "value": "cafea0dfa8297f160ff26f290b64eb7d476c15472e52c4d13c324fc2c18281f9", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149063, "uuid": "0e6daf29-997a-4836-a85f-2dbd58cba5f1", "comment": "Malware payload", "value": "eff02e0b7cae6bef80cade0fa50ff8e830359d58", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149063, "uuid": "e6b9519d-60f7-4c14-8c3b-8c78ba43108b", "comment": "Malware payload", "value": "6db7de2a60ece90290616134cf77ed87eb5388f251ec85993be288ebe1a2465495e5d5fefa7c7f6d5dfd9eb8979b9c86", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149063, "uuid": "9d20e500-e740-4ad6-927f-e269a519c2d3", "value": "T12CE42344ECEED7FBA49C051B7A570EADC03B773A9E98581050B229D801F1A0FC9B176C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149063, "uuid": "a5f2469e-93a5-40cc-b98b-c20e0cb200c5", "value": "12288:0BKNzQ2YWQadMJmdDRJXFFmjnYQaFtWfA/lCVeJI3AbPTFJvBwQU9qLllbDK9s:bNQfWQeImhRJXFEjnYQaFt+yUV7QNpO6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700149063, "uuid": "ba55c9f2-4c6f-45e3-baa5-14956d05ee59", "value": 672960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700149063, "uuid": "e6200fc2-1521-4d00-a27a-fb0ee4a7ced5", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149063, "uuid": "633ec86d-8dd8-47ca-a973-99dd2b2782af", "value": "Bank slip rar.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c47086e-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700116970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116970, "uuid": "22fdf73d-a77d-4baa-9729-53460a87c60d", "comment": "Malware payload (Mirai)", "value": "996ea4b1a6c43d8c91f0d43b48214b56", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116970, "uuid": "25f8811a-6259-410b-b1fd-d3fa8b880426", "comment": "Malware payload (Mirai)", "value": "cb3b776f6ed71c9549dd9821dbd9055823538e854d4b27e94f623fdcbbc687dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116970, "uuid": "a5d27d1c-46e8-4af6-b580-aed2684d254e", "comment": "Malware payload (Mirai)", "value": "a36f2c6e47b1cb4b70f1e13b27ec82f08692b1ee", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116970, "uuid": "2f170868-e6c1-40ab-92f5-d0611579ed6d", "comment": "Malware payload (Mirai)", "value": "dbe6c86fe8b1d98a6a38d8fe1a2ea89babf8976b2f287d3bb7c33551f8c67ff2d62a71a9b861cca71b0a071b107d8011", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116970, "uuid": "b83068fe-a3db-493d-be0a-c08e29513efc", "value": "T1B6535C02B7684E0BFAE619F5243F1BD483AEED9021E4B585A90FC7464235F334999E8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116970, "uuid": "e0ab3a49-29c3-4d47-932b-a73e00fdbfdd", "value": "768:zzzpxA779ZnaLskvgeFAcs1pl1gb8vpH5aEgGsllk5MDGw0COClBHW2tdFsDMUQt:zJ8ZnaOl19Hszk5Z1UNbK1DVoug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116970, "uuid": "f8544821-aeec-4d2d-8809-1e33b48bf6ba", "value": 64188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116970, "uuid": "92b6da69-f755-4d1b-9bc3-2e78312d794f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116970, "uuid": "a9cc7c49-b367-46e7-a41b-0db430d54c24", "value": "996ea4b1a6c43d8c91f0d43b48214b56", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa37bb4-84a5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700155549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700155549, "uuid": "a0d86480-3097-46a2-a94c-430276fd4943", "comment": "Malware payload", "value": "1bdbd5c1ab6fe548bdeeb09d39a4f695", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700155549, "uuid": "7a74698d-682e-46b3-8253-9e6ba5dbfe41", "comment": "Malware payload", "value": "cbd9fe54df365905b812f5fe8a1305fd98bd98f7fe92e426ef3c1d4c72d49f72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700155549, "uuid": "e4eba7f5-4b8e-4b6c-af33-8b85a3fc8557", "comment": "Malware payload", "value": "4f571ab8ec12301d07cf716269f1e9c21cbb22f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700155549, "uuid": "1e8cc6aa-d879-4cc5-9c1e-3a01a728ecfd", "comment": "Malware payload", "value": "ad6b518edb6477b17239b8d3c32c8208dd81452304ff372888e281e76075e7dbec973dc0c51d08fd992f75a9f2abf04f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700155549, "uuid": "d1338720-89ff-41d9-a073-c6574cf3ae04", "value": "T11CD5BF50E2F4B64DFADE4636AD30A3E46173A8132727E369CD10E615746C7DB8AC8273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700155549, "uuid": "d2170993-9f85-4f03-9cef-e4c850a2b0f1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700155549, "uuid": "922d88f8-1889-4f0e-90de-dafadce28116", "value": "49152:z1A5scNs9oLw126HONYyf9Oloexrr7qw6FwhkA3UU79UxeO0:z1CVVcUvNJf9OlNxf7qoD3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700155549, "uuid": "c5634ba9-8b03-4ab4-b547-530440edaf2b", "value": 2924032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700155549, "uuid": "928073dd-923b-452e-b3ad-70ea24f6091b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700155549, "uuid": "ac3233a4-9467-4cdb-a7ee-35e173b3be0f", "value": "SecuriteInfo.com.Win32.PWSX-gen.8485.25115", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e67db5d3-8462-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700127080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127080, "uuid": "9b168236-93e2-410b-8645-b87c128ab1c3", "comment": "Malware payload (AgentTesla)", "value": "1818ceefe46f16d7efcb001312e0a616", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127080, "uuid": "27e2b347-c876-4f07-b9ae-43feea045464", "comment": "Malware payload (AgentTesla)", "value": "cd18ddaeba5adcbf68717543213bdff30e80f8615d691892dc0ca23fd8954174", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127080, "uuid": "eb23a608-6c8a-4695-a32a-a5db558161d9", "comment": "Malware payload (AgentTesla)", "value": "72a15b8bdd51801194386cb56801baf7a38d1bcf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127080, "uuid": "1c3d6b95-0f38-416e-b376-14b8052482d1", "comment": "Malware payload (AgentTesla)", "value": "f5ff7dbb57512c83ec1e444dfeb0395adbf0830e3ce6e8deba79e8df8b4409e2dfa56ce477539d0405b6a7f918c5844b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127080, "uuid": "b3f7de5a-0e45-4581-8661-b92d0deda727", "value": "T11BC5598A7E421C27CF6E71F2911E49081A90C5476B89D7BA36C381CF87CDAC7B98D587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127080, "uuid": "39fa1dc4-afdb-4067-9759-6fcca33671da", "value": "24576:ktPz7WDyN5V7+ONHrEUuSdYY6JUiaXs4qLTxhpO/3ncC61WYJQ0CCc8BGcVNN7fS:SXVAxhpU3cC61bJQ0CCc88EN7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700127080, "uuid": "461b6438-5cea-4bf6-935f-d89f31984974", "value": 2644992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700127080, "uuid": "fedea685-2f70-44f4-858a-68539e2f39fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127080, "uuid": "90165a46-8768-42eb-82e1-173378405ea4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0829867b-849f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700152906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152906, "uuid": "81f1bc04-d929-4205-93a0-98f70fecb222", "comment": "Malware payload", "value": "6c5f55ffd96dcc6e1987635dd4e85d15", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152906, "uuid": "92b2441e-f845-4c60-a72e-32e8d396fba4", "comment": "Malware payload", "value": "cfc0ae4a59999f69fdcfcf5fddeca000ce058b9aca76c8ab47365fffecd03bc6", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152906, "uuid": "e8e0ab2e-1e66-47bb-99ea-772e9799ceb0", "comment": "Malware payload", "value": "369d53da6022a7ded369ee0f99303e530702b870", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152906, "uuid": "9d8cdccf-dd17-4e56-9596-ac9784bce043", "comment": "Malware payload", "value": "f8edbf2f309e3659fcf253441df2b7ba3d201f2679e9c156ecd6694c7babc018dc940224b990483c21beee7dce0d1b67", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152906, "uuid": "4a4a7fc1-958c-4a4c-b0f0-5c73aff54468", "value": "T18853F188775F852ADC222A3836A832058B3C78737551513D7E1432968EC2E7633E6DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152906, "uuid": "7a89eb39-0bdd-4e85-88e9-dd72e14cd5c1", "value": "1536:+tsdoQoCgFI8+9F1hTKMqi0moxuBHUobrU65bzHQu:+tsdhCI8c19KMH0mgSUobAM/Qu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700152906, "uuid": "d3d5b91b-f676-4dfb-8430-422be07a6236", "value": 62384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700152906, "uuid": "40f539c2-89dd-43ce-be5c-3434beba4bcf", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152906, "uuid": "f407a6ec-05c8-4373-b373-185e6e72ec43", "value": "2.Invoice-4500000956-1018.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d197491f-847e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700139071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139071, "uuid": "a5bb6cd9-592e-4c56-9746-fb4da79a3192", "comment": "Malware payload (Mirai)", "value": "84d269eb42216345a670dfaed1665a61", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139071, "uuid": "a452bc90-5815-4885-b1a2-f8f1a703dd68", "comment": "Malware payload (Mirai)", "value": "d2e8677d881ebc77c36cb9caf9d468445dc1019a4ffe63d40caa8f384e0aafd7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139071, "uuid": "86ece7b0-e10e-466b-8709-2b9c507d3fbf", "comment": "Malware payload (Mirai)", "value": "32b197f9728f82000dff92b9b17a39318838596d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139071, "uuid": "301084eb-d945-4a71-aaa9-6e978fa1243e", "comment": "Malware payload (Mirai)", "value": "3b4ab2dc76a1a29550d4d7d4dcc41bc6f135138de6fc96ac62375b17e27f672ef1263919e3654e4bed705429bc49f9e5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139071, "uuid": "cef68c14-1b96-4eec-9bbb-8617e54fea6d", "value": "T1BAA2D171961DDD31D2F148338FACD853317B4720F3B53AB11094C9A4B89794691BE6A7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139071, "uuid": "272f8823-24e7-4532-af0d-2dcd9ce91dda", "value": "384:nzCdNIZVM7rBHJJrJS5LdooxkrPO9XipK4H2ZREJg7Oa/GOUhymdGUop5hNk:zCAs5JiPurOX7kg7Oa/GOUs3UozE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700139071, "uuid": "755775af-d580-40ea-a3c4-48835e03b6e7", "value": 21984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700139071, "uuid": "ba223c1a-7228-4fe8-9f49-fb477db4192d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139071, "uuid": "44b9ca46-0d3e-4780-9168-aa0732e56564", "value": "84d269eb42216345a670dfaed1665a61", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58728ad9-844b-11ee-8907-42010a9c0042", "comment": "Malware payload (Gafgyt)", "timestamp": 1700116963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116963, "uuid": "3a13c2af-4662-4a45-bca5-e23b37ea8469", "comment": "Malware payload (Gafgyt)", "value": "c2fdfda8a543960e92e1be2dc64e2ea2", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116963, "uuid": "a0a72082-e45c-48db-ab8e-631545f45a20", "comment": "Malware payload (Gafgyt)", "value": "d54ce3d8310322c20ca038fa5e7053af87ea63be3903989473683475987c77eb", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116963, "uuid": "1a97187a-5c44-4bb4-ae9c-3e06e13b9534", "comment": "Malware payload (Gafgyt)", "value": "4a71f776bdf54b8abb1e342012b7d868119df3a9", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116963, "uuid": "f4478205-04dd-44ad-9718-0f24c8035627", "comment": "Malware payload (Gafgyt)", "value": "ddeb056ba1f792d6a7fa79874658ec41afeb4a21aa387cf80f5cb1db4873786a3d37a9bca96b0e1eaf7d5fa14c25c6de", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116963, "uuid": "60eb9dfa-1ae6-4bd5-8f38-b5135336f46a", "value": "T1FDB33B376251C97AC08356F426EBC5729D13BCBB0B32219A33D47D60AF368DA1E99B05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116963, "uuid": "2a8a37f2-0dc5-46f2-b152-23de0f48c820", "value": "3072:kiry859a2ADJf9wHYqbgFFo8+HeAZ+TRCm7FnVqfJXFWbNb:T9a2aLqkrMksm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116963, "uuid": "9d562e36-0660-44ee-886b-751af8b6de77", "value": 116503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116963, "uuid": "d2d4dc81-a27a-4f86-8751-69e5c4629cd9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116963, "uuid": "86fc05d6-8e94-45c1-a106-d90d637742db", "value": "c2fdfda8a543960e92e1be2dc64e2ea2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c676574-8493-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700148001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148001, "uuid": "8070eace-b555-4cef-9d9f-8904a31af456", "comment": "Malware payload", "value": "d39ec227c7bd7e552236e85ef9affe1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148001, "uuid": "132f6108-4202-4e7b-88d8-9d600d4137d5", "comment": "Malware payload", "value": "d674db737db03ced531fb0e180ebfb256c0d142bedadd3dd06bf665aedc9a3c0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148001, "uuid": "28c9248b-aee9-4743-a3fe-3f596dce9a33", "comment": "Malware payload", "value": "dd9fb2666eb04c758acd511d6938ca57b1738ecd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148001, "uuid": "ef9e93dc-8610-4b62-9fb5-61072e7b1730", "comment": "Malware payload", "value": "f5af54a3da6b1a4f0b08649d19363e90085bce239a66819843d921490978885612d1055a3b93594e2646abb89045ca1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148001, "uuid": "5b3a63d5-1d6d-4064-b361-6803b770d726", "value": "T1D3344B47D2E17D50EA268B3A8F2EC2E8721EF5508F5D7B662219BF1F04B11B2D663710", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148001, "uuid": "c7bda1e0-6cbf-488c-80f1-84613c2f7f88", "value": "213f519d1d60f9b08b3f96159240536b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148001, "uuid": "44ba5714-578c-4672-aae9-3849b6db3a8b", "value": "3072:nl4mLVY01t2mguV4u8OnW+Xx366Pw+4Rm/lBKsikL3:PLVY037guVR8xe364/AA3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700148001, "uuid": "49f41ae0-2ba7-433e-a807-bdac0ca6c564", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700148001, "uuid": "73dedf4f-5202-4982-8524-f164f6e5e94b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148001, "uuid": "2e426863-ff36-484e-b6d0-b7fb80db20ae", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8df96b01-84bd-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700166016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166016, "uuid": "adf16f44-eaaa-457d-8bc8-a7f030f26fe7", "comment": "Malware payload", "value": "af8589ad7b9edf29559886b6c11320c5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166016, "uuid": "b716855c-c1a9-44e4-a41e-ef81c98cf91b", "comment": "Malware payload", "value": "d79d1c50863e99b5d93d3d5f7f6c68a0f7774cd53e329a9cd626123c2d8b4716", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166016, "uuid": "55cd9e9d-410b-4ede-b4b5-d0564d90f62f", "comment": "Malware payload", "value": "27c66de8bbaa255d5ed3e200119b8f5f443ddf52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166016, "uuid": "048b37de-80a0-474d-b095-a672d6546483", "comment": "Malware payload", "value": "5bcfd14cae2eb7b19c30ba313de986bf3ba09ab99414178c5d6c149c28d870135ba24e55065a5655b7f4f4d369a51d68", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166016, "uuid": "ecfc22e2-b601-47da-8cd6-33ac0740a5e3", "value": "T143046C113AD1C0B1D67302354AE9E6351ABDBD724B769A4FB7D80B0D0B74092B736BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166016, "uuid": "e5946429-d991-4bfb-9738-8c90738623f0", "value": "e5dbf4f8ccc1f4276248f5791017efa9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166016, "uuid": "6bb8a647-42cc-4af5-86c5-9a3de1338fae", "value": "3072:q9nhVueY9OpM+T3gE66YgiNP+WnM3FV+mMGwY18wa37GNM:KnbTp0N3+BVVX18warMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700166016, "uuid": "af6368e9-e67d-473e-94fa-73b527fc6665", "value": 183296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700166016, "uuid": "3315fea4-cac9-4482-955c-59223e6780cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166016, "uuid": "92801366-27cb-499b-aefe-4bffaaf0f4ff", "value": "SecuriteInfo.com.Win32.MalwareX-gen.27712.25794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa6c2a60-8450-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700119248, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700119248, "uuid": "72f582c8-2720-4892-bb41-22a864c83143", "comment": "Malware payload (Mirai)", "value": "bf72a99b0d4703f9cc28e5b885fd6aa0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700119248, "uuid": "af7bcd6b-9b98-4bcb-92de-2598f78fdbc0", "comment": "Malware payload (Mirai)", "value": "da536e3021841ddd612796966898aeab79e91f092ae1460586d0bfc128ee5e23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700119248, "uuid": "f0b058e8-815b-4672-acfa-11744a9753d5", "comment": "Malware payload (Mirai)", "value": "95b2d3d3121bcd7d20360cf4e18b84900e27c971", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700119248, "uuid": "954f60e5-8b68-46ad-a058-15976f5cc530", "comment": "Malware payload (Mirai)", "value": "7d619fb2873b8bb4cfc9804b87a8232b0535b2ae76f08ea90021a1f7e58e9ef5f0f21e65b4de61e15171991dd9120674", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700119248, "uuid": "06b78d4e-bc6a-4d33-80c3-b55d48cf824a", "value": "T1BA633A817C80AA25C7D01777FA9F108E33156BD8E1DAB3438C146F9176DA81F0D6BB9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700119248, "uuid": "1a5fa374-3cfb-4070-83e5-9ef83082cb9b", "value": "1536:oNvhbZUxGVU2O0170yoVzyMNKHwFKnJeZWovjHJkKKM:oNvhbYFKJwpvj3z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700119248, "uuid": "dd8cb04b-9f63-4074-ae1f-763cedee1967", "value": 70468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700119248, "uuid": "1cf6ff38-6735-490d-b0a1-7088ed2babb5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700119248, "uuid": "24a7c780-890b-4aa5-a82c-a73bcdabc6a6", "value": "bf72a99b0d4703f9cc28e5b885fd6aa0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d78f1aa-8481-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700140218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140218, "uuid": "ca8e6d36-973f-45d3-b4c8-1b14ca5c81da", "comment": "Malware payload", "value": "6eeea96c202cc6b3f327c718e75e5e54", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140218, "uuid": "305664df-41a5-4069-97c9-0a7491be9f19", "comment": "Malware payload", "value": "dc2846fc0c652194ae759a1a06119bc5e4f0102dd62b2eaab341464ec89944fe", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140218, "uuid": "0c535f8d-33ff-4f20-b776-69ec1eefafc6", "comment": "Malware payload", "value": "66961a7df23003392b3176b2019cb898e680f9bf", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140218, "uuid": "9cde1459-3403-453d-91aa-3612c57a0542", "comment": "Malware payload", "value": "f472d3a6f85c611df58f74984628c3b78aec4d8ae6c2e7ad44f1639c11f08702c030000aa2fe980a838760b31e672c78", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140218, "uuid": "ffcb0b58-3fc9-4020-8bbe-ce78841415d5", "value": "T1734401016620852BE4E202309A366FF9CAE79D556A91DF070F953E0F3D767B1902FB4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140218, "uuid": "7480e082-e78f-45c6-80e7-1b3571791a5f", "value": "6144:oT4Dth1R6LFzFktPQnmzpE7HBCKRx69ChHjZ9zh9Amq:oTi1btIIpELBCKRx6eHjZ93Am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700140218, "uuid": "60882ea0-9430-4548-8ad7-6c6dab2044c8", "value": 271872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700140218, "uuid": "e432aaad-6f19-4d16-9194-6f9b755cd3eb", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140218, "uuid": "10a999e7-6c15-45a0-9888-ffa92148bd38", "value": "Transferencia.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c31c1d-8472-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700133810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700133810, "uuid": "e83f5149-7bc4-4e6b-b951-740b4ef0394c", "comment": "Malware payload", "value": "1f185e5a0308a9c3619433091074d6c7", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700133810, "uuid": "81f831d3-bd5a-4648-a3fa-99bf84a008d7", "comment": "Malware payload", "value": "dc552fe5c0457613220b98774813a6646a994d087115e3ca59f8cebd1b303d4c", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700133810, "uuid": "cfb3ad1d-60c0-45a3-95f0-96ff5775303b", "comment": "Malware payload", "value": "a4f025821959c4df6c4018c8d9ca2c69a458a4e0", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700133810, "uuid": "6f83bf7d-b446-4e23-ac18-f7335b6296dd", "comment": "Malware payload", "value": "47d17061babe280918aa450186051985a9cbf5da4086ce872bf12389c9651e6d1ebe39a46e2f3edf5c18109ee781779b", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700133810, "uuid": "92cc863f-80bb-401a-8bd1-d07a63bea72b", "value": "T14EE3566C934F02A98FA2527B9B660E4441FDBA7EF34551B134AC433833EEC2DA12657D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700133810, "uuid": "8e48a9d2-830e-4543-b630-6b537e269353", "value": "768:AwAbZSibMX9gRWjie+uw6cS65kz9NYJe6wdqHISO/KiV9hj3Fhy9TiDCHg9d:AwAlR6+uwjSPFf/KNUD37", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700133810, "uuid": "f92ef6af-02fe-4f7d-aa91-fdbcf8fbb767", "value": 143559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700133810, "uuid": "20d864f1-c51a-4d03-939d-d20eba37b155", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700133810, "uuid": "fb915f7c-4fa0-471e-ad03-2c91d2cbbe0f", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.12982.22974", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d2d58da-8463-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700127279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127279, "uuid": "61656cc0-9514-4773-a191-7c6f81aeadca", "comment": "Malware payload", "value": "e859e1c18205f8436a4747c1e79083a2", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127279, "uuid": "1cef23f1-7f91-448d-9f8d-631848ebf836", "comment": "Malware payload", "value": "dc5a8c20ddad9edf5bad9885ccc751301b09ff0477a50fc90f1ce0a9f8283635", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127279, "uuid": "eaaa4e1d-7563-4a92-88f1-12dc08832c6b", "comment": "Malware payload", "value": "5a7daea8e1d1624abfcffe05dca71a7e3e3bea4c", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700127279, "uuid": "4cf27079-3523-4167-b718-90b8aedd1c25", "comment": "Malware payload", "value": "55bff04b831eb9ba4b212c36916ec0ef334b7f037f1c4fc4099224b8cd576361343efd00c0f70662f7eb81ccabe607ae", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127279, "uuid": "910d95c7-cc3a-4922-bf51-30f8acd4e0a2", "value": "T1E50413F9898483A7D03FCAF19075B4AFB46124C8D4ED2C7F29729F1AF299F534152416", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127279, "uuid": "85b93db1-9ec2-4c4c-87fd-71f3fe511a05", "value": "3072:VCuhS2c/aW6EQVhZ/aPO97dvWKF67Btk1NiultyPBwK:142c/2EsX/sSvWKF6o+PSK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700127279, "uuid": "c0d8031f-5e7a-40f0-ba66-2da3bda9bdf5", "value": 183394, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700127279, "uuid": "35f1ee1e-359c-4c35-9879-a4a3012933da", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700127279, "uuid": "ee9b08aa-8f2b-47b2-a5b0-70083939c0a3", "value": "deobfed_-_methods.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ad8f35b-8428-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700101935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700101935, "uuid": "941eb1f6-9780-4b61-9d00-d8c4549efaf9", "comment": "Malware payload", "value": "1406ce7fc40cf4858fadef468980c626", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700101935, "uuid": "3fefbe68-5275-4f1d-a335-ee01ec958228", "comment": "Malware payload", "value": "dda58e02acca78a978c8ae8a82b34e3dee6db965b3c101731cbec2850cf5477f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700101935, "uuid": "34a99f26-30d1-46f9-8292-61b81cf08007", "comment": "Malware payload", "value": "b82eaf0845cf133104fd7fc8405f506c3914e0a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700101935, "uuid": "fcafaf83-ad31-41a1-9fd0-103664dcfcd0", "comment": "Malware payload", "value": "c853c605761168b7ec5f2951d8e49eb3f73e5ebddb538916e2bda20d5453dd335c58c54e20713026089569554be160d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700101935, "uuid": "f774de22-c839-45d2-b488-a8cea4210d31", "value": "T133352303A6E88477DDB82B715DFB03D30E3A7C116961523F36E1A81E1873684A5B93B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700101935, "uuid": "f97ad25c-ff54-4701-8b12-805740c5e4d3", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700101935, "uuid": "2bb97d82-3b3b-4f33-8c75-3db0909a6a55", "value": "24576:5yoKYwVqJH5a0yh6UOjqknVL5W7s4qevL3e7P1FUl3ME1y:soKPVq7MhHC5nWwjej3ecZ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700101935, "uuid": "39284c61-26c4-4e08-85fa-08b156fcbe02", "value": 1117184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700101935, "uuid": "7c792186-1acb-438e-bb56-41adbb4d0857", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700101935, "uuid": "9edb56c8-a2d4-4d5e-bd86-f73e4d32502f", "value": "1406ce7fc40cf4858fadef468980c626", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0462ffd1-849f-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700152900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152900, "uuid": "7b5a6db4-84e8-420c-a3a2-c66da9ffdf92", "comment": "Malware payload", "value": "fe15cb067e33b80947dfca61b44190ab", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152900, "uuid": "c7674b4f-5cfa-4324-96a2-c5249203f508", "comment": "Malware payload", "value": "de5768937384b3b9fa9d7e874c19dc363830041868a97ee5c7bb9f038ac5479b", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152900, "uuid": "97b9a962-183c-413f-acf3-137c10e02ae4", "comment": "Malware payload", "value": "196f440ad3d00ab9258f591b06f81aa9bdecbf5f", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700152900, "uuid": "13e94434-7633-413e-a218-4bdc5f62bd1a", "comment": "Malware payload", "value": "d2fc455d27ec66f0375b41e8d3f30a22ff836906a384ef9d191d208761e7b89c0e5930fd5932d11cae13853ec2086219", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152900, "uuid": "0300ac28-abc1-4a89-91e6-ec85b05b344d", "value": "T1645312F25D895736C316C6FC5BCF5BBFC85D27AC198849456247CAC92C304E858A3EB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152900, "uuid": "3d6980aa-ed98-4e68-9b16-53847fb26624", "value": "1536:Um3aLK7b90pOGy7Og/eojQKwaSHsrCFmDxN9e4Q:Ufu7b90ptyygmojCaSHfFU9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700152900, "uuid": "47e400dc-a73f-4fb5-b4ce-64facbc30e2d", "value": 60940, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700152900, "uuid": "9c4497c9-a798-4e54-85a7-b838fe2be33b", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700152900, "uuid": "63112617-c74e-4701-98d3-b3c350b5b612", "value": "2.Invoice-4500000956-1018.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac92f687-843b-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700110232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110232, "uuid": "265b3c9a-34d9-4b65-8d72-e5a898839b20", "comment": "Malware payload (Mirai)", "value": "77c77ad2e328577f15c148b84a8feed3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110232, "uuid": "e3a6cbcb-5178-4ce4-a2bf-bafd5edd91d4", "comment": "Malware payload (Mirai)", "value": "dec3b2ba794d3d1336f771ec774d25aad70d1f5af234ac9467d09b3e494a16e6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110232, "uuid": "870b6794-6a1d-4960-919f-bef32dd811e0", "comment": "Malware payload (Mirai)", "value": "788c865268f544558469790428a29fa96d494eaf", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700110232, "uuid": "f8bded47-11b7-4804-b059-fd9ddb7d6901", "comment": "Malware payload (Mirai)", "value": "991daa6de8c900b83ab3ed5aa793e1597f1dc857c707bc46525386e80e31e16e0cde7a26bba1f19be55f04da21b705d7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110232, "uuid": "d39af7bd-68c9-4f57-94ef-607343883211", "value": "T18613E1563B81494FE86E5039FB2340967A626C9C457873F7A701CFF2085A267CE328D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110232, "uuid": "2dd31054-0eaf-4fdb-94ea-ec35273c08a7", "value": "768:AFt896k/cesdwcBx8sLXVA7ETVKwKYt0V1UDFWuLXdRLL4VuRP7t+:An89JYdlflAgTVKq0ADpT/E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700110232, "uuid": "74cb185f-8389-4725-bb77-33808037aab1", "value": 42400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700110232, "uuid": "b528eb55-5efe-460b-b8ec-f8b1cf11c5f0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700110232, "uuid": "652b7d3d-36af-44a1-b6b8-9cce90c3034d", "value": "arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "002999a3-846a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700130129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130129, "uuid": "c037c51b-3593-47d7-9f1a-49c6caa55eb8", "comment": "Malware payload", "value": "a57fb0b7ee129dd30e59bb82f3f0e65a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130129, "uuid": "bc728508-4f72-4bc5-96b9-e5a4c232ef97", "comment": "Malware payload", "value": "dfd8fb0be12293b8b5541290bf9475c50586eb730edb7dc13e9b583dd0f9cd2b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130129, "uuid": "ec7b5c57-4d26-469b-9f98-055966458e8c", "comment": "Malware payload", "value": "ec6bdfd70c74b6c26dd587e223ce12af25aef154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130129, "uuid": "c973d48b-a129-441b-a316-4cb94ce51172", "comment": "Malware payload", "value": "2f7cee09f8dc09ec25e73bd64485daab70964e5bf67f7639570892f1c4300ea3e415ce49e8990fb789053faa394fc7cd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130129, "uuid": "8f74c084-9790-46af-bebf-2962ffe46959", "value": "T146C57C50E2F5A20DE9DE85338E7063E462B3A8227763F359DC80E525B42C7D78EC5663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130129, "uuid": "54b6f3b1-5d91-48b9-8902-479dce004e07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130129, "uuid": "61380ce5-a15d-411f-a602-25690db7fbb5", "value": "49152:Qf5dnjMcaiihqPMUCLzXaBxmJji1pS3CXdOB:6n4bg/CnXNWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700130129, "uuid": "674ed0da-e8d7-444a-ba4a-9a406242dd04", "value": 2742168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700130129, "uuid": "955de110-def2-493e-9319-be655aaae93c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130129, "uuid": "2e2a74c7-0266-4949-9803-f93936358ce5", "value": "SecuriteInfo.com.Win32.PWSX-gen.24905.1526", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d53f93c7-847e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700139077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139077, "uuid": "8e5d8791-33c7-4653-a72a-95a6c81364c9", "comment": "Malware payload (Mirai)", "value": "ac786bdee94ea1392508d1093f218546", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139077, "uuid": "e9dfc63a-e1fb-44d9-b446-3f51b7c7f17e", "comment": "Malware payload (Mirai)", "value": "e0b7af44cac45f098a7dd1b0141d0a3d099f88d0c79fc0a88dc1fba64d8630e1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139077, "uuid": "f2d35fc8-fc2c-4e14-9e55-4e83d4c23f92", "comment": "Malware payload (Mirai)", "value": "bf3cbe06d408dd6aed114680eee08e581b39fae5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139077, "uuid": "7350d4e0-78ea-4622-9db0-c34f1775f90f", "comment": "Malware payload (Mirai)", "value": "465c5143686297a3b558fc286936f4ec9932d7b7a9c148590b6c6c6d615d66099115e6d870fc10371cac8e13ed2ac573", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139077, "uuid": "54e593de-434a-45ca-ba63-ef1f8e8ecd10", "value": "T12EA2C050B28D28E5FEEA5AB56EE1CBC137F10A0AFB838D81F5159F17451742E6B086C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139077, "uuid": "4e61a43e-f14e-40e1-a38a-82141f93f5ce", "value": "384:caIQ7RLG1+FiCTkMkVpth1e3yJYwvEhF7cf4PS5M4uVcqgw05VxJV:NlG1+0VvMyWwvEhFwf4aW4uVcqgw09X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700139077, "uuid": "4c9d39cc-9061-44f9-a647-36982c16733c", "value": 21456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700139077, "uuid": "16dd6ee9-14fb-43e9-9a93-310d9cd56ee4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139077, "uuid": "a94e9549-5d60-4f88-afe6-1780ee061275", "value": "ac786bdee94ea1392508d1093f218546", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "261a24a5-84b5-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700162405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700162405, "uuid": "e5263c23-b8cc-4fac-9fc4-0b575d49abc0", "comment": "Malware payload", "value": "5df11a71753ca3fe47dac2220a81b1b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700162405, "uuid": "617784b8-17cf-4352-9a85-102feb9e5f91", "comment": "Malware payload", "value": "e12d6a7452dd56cfb058ac5a364f0d008870b900b0da53b12c0c58f782488924", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700162405, "uuid": "2638b4f9-c12d-47ce-8ace-e4b572487cfa", "comment": "Malware payload", "value": "4fe8dfa38858bc049af97f9b4a1bcf005a6f0ad8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700162405, "uuid": "3d367e20-edf0-4f29-8d34-12c327a26261", "comment": "Malware payload", "value": "a1c865c38391c39719b2fa4c7e152956995c813e94aec4065b64810d53c43e94cf05207bb9b77cc86aefea7e576d494f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700162405, "uuid": "6318fa41-2e03-47fe-8cdd-bb69f70401ee", "value": "T1FCD49F1063B1E1AAE9D38D7AD13FD0F4A65A5E92FD43852B50C57D5B3B32220DE053B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700162405, "uuid": "95407aa5-e9b1-4b9e-afab-a08ff4404687", "value": "5f74a5c747508e2822fdb9b687deaf42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700162405, "uuid": "0082a71c-52c9-4d77-baba-627e3cf4525d", "value": "12288:FoCCj88888888888S2222222222222222222DRQr888888888888RTTTTTTTTTTE:C0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700162405, "uuid": "456fc6c9-28f6-4158-89f5-5df3c9dc7eeb", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700162405, "uuid": "9d621f1b-fa8a-49d7-b37c-e9740ae7c9b0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700162405, "uuid": "a31961a3-9979-4327-8d9b-26e60df00568", "value": "Backpack Hero.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5f7e531-84b0-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700160580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160580, "uuid": "f2486bb2-e088-48b5-946e-fe2212d8d4bc", "comment": "Malware payload", "value": "d922699a521b19f557b6b238a5bf38e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160580, "uuid": "cfe2d9c8-6244-4adf-aeef-873bbfb16360", "comment": "Malware payload", "value": "e2b5025f5cedef2a50b9fdd3f696c0a464b46e5cf465974f5960705e8631a938", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160580, "uuid": "f6f717e9-3646-4986-a8f4-e11aebc178fb", "comment": "Malware payload", "value": "7f50f0752fd802c06e209aee29683fc75e9e2021", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160580, "uuid": "78035d99-7975-429d-922b-9bb9ad6bb133", "comment": "Malware payload", "value": "5c4b38dd314d095ad6a6ecb28dac9839de954601b88b555924c1003b508d7e287142384b2762e46f0ce7af9efbc56960", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160580, "uuid": "e2aec4b8-1936-4c9d-9631-242fb660db45", "value": "T16AD7337A42D65543FE7382B1BAE09A976F042D90746FB8F19BF5C8B804F8D76C884D90", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160580, "uuid": "2ea728cd-5519-466e-af27-757d44765042", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160580, "uuid": "d619675f-2428-487b-814d-2f45d71ed515", "value": "786432:la8s2VynL9YpaydaOMgATyLRt7opv8n3fSdANSa6G1e5p+PX0vnX4BRttOvJRcoX:Q3269LcMgiybkd0RNUGKfvX43mBRN/v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700160580, "uuid": "c6cd5ab3-0bff-4249-a8a3-61d9aa99d577", "value": 59188224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700160580, "uuid": "b1c21657-eeab-4dc7-8074-e161261f62d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160580, "uuid": "5d2c7d6b-6c90-4ca6-aeb7-224af3b5434b", "value": "GoogleCrashHandler64.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f4a4e10-845c-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700124196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124196, "uuid": "18e76769-b0a0-469d-ad59-95b7faa9ef4c", "comment": "Malware payload", "value": "357d521672b45d44bcc584f2fe4f0592", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124196, "uuid": "5eb8e59c-d740-4687-aefe-3914520cd25c", "comment": "Malware payload", "value": "e388ae91a8cdc3ae144f1b861aa4dd3168a4a091e74871874221fa69424f10e9", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124196, "uuid": "4af8dfab-71be-4f48-956b-53f599cd9dfe", "comment": "Malware payload", "value": "c8d47e89f1317615b6135d5ce2cb2e784528d437", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124196, "uuid": "70ba6182-a4ed-47ab-af60-88e7b8971fbf", "comment": "Malware payload", "value": "0dbbcb70524694af659b9307d404edcb959185abdc6cf8c9f77d35ef465a07751cf1d05eed954a8f828729b6a9269638", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124196, "uuid": "721a91ca-c5c8-4caa-bc64-387e09f878b9", "value": "T101D0220C8A4EC1A1D0521C1B80D8BE9CAC0DB05429E2C88C1280DA8B9C8A0E4DC8BEFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124196, "uuid": "5e54d415-b216-4386-a49e-329d150e0887", "value": "3:HRAbABGQEb/5sQaOUlL5WGxEIS5z/KbycAI9RyJ25YdimVVG/VClAWHn:HRYFJb/5sZOC7xyIyc1yc54vVG/4xHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700124196, "uuid": "5f4665ac-78ab-4d79-b733-8797c5168a38", "value": 204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700124196, "uuid": "9575b0f7-b7c1-4d4f-a67e-1b5a765a1c38", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124196, "uuid": "6947e2b3-34ed-4385-977e-941bc19dec5d", "value": "wizard url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2723480b-8497-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700149522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149522, "uuid": "e7863f47-7ce1-4a69-ac33-1ac8e6cf3053", "comment": "Malware payload", "value": "2c1424a8a85dae75de98268298d024db", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149522, "uuid": "8a3aa128-5595-4298-893d-5910d0e88bb3", "comment": "Malware payload", "value": "e38f859f13e982d332dada2cc71f6ebfeb87793959bd37642dc8f9a1d9b655da", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149522, "uuid": "e4d76d91-9158-441b-ace5-8690bccb68a2", "comment": "Malware payload", "value": "a240ea7349128a4a6fdcc2f93de690eb0bd60e2d", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700149522, "uuid": "082a05ee-9050-4d1a-acec-2685398d3196", "comment": "Malware payload", "value": "c861613decc35c4b8005f092867451f3422c87a1f552aff83e9dd0a23754d21f32d44e8af8e3828bf20f8509bef04f19", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149522, "uuid": "b4f9253b-1cc0-4606-b7ab-0e000e36859c", "value": "T165D4230D4F83767A0B9851AE1E158CB3642C46D043C7B644CA63E652A3A97EDEB0FDD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149522, "uuid": "a6dd5220-a115-48c4-9fc5-21d0e4022d99", "value": "12288:VZSOiF0Y7gWz8zyUZsN972eBz3/+EX91x134CiuSLkkFPXOB7ySr2:3wF0YUyiQ9zZ3RnoCA+h9r2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700149522, "uuid": "6d33b514-e14c-4e1e-91a8-d5ae7ddede98", "value": 645896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700149522, "uuid": "a8bc7702-a072-474b-817e-a276b68b5174", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700149522, "uuid": "bfcd9314-71e2-46c9-986b-db2b78c0b38c", "value": "overdue payment pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a19f504d-8486-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700142426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700142426, "uuid": "2afa2bba-87db-49c5-9358-5c22f78c5036", "comment": "Malware payload", "value": "34f1e354dd94b173d75477ae06952730", "object_relation": "md5", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700142426, "uuid": "54ee790b-2d4e-4a86-8809-bf00438226fb", "comment": "Malware payload", "value": "e554fc2f619967efeb9ba08f93a21c46dc910652420aec8499a3059937fecbab", "object_relation": "sha256", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700142426, "uuid": "4a2b749b-d289-45ac-bfa8-dd2623544bd2", "comment": "Malware payload", "value": "a7970025f10104de2a6b6fecbe7e983253fb35b4", "object_relation": "sha1", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700142426, "uuid": "4471a86f-b082-48b8-8e63-320e5e0cf11f", "comment": "Malware payload", "value": "ceeccff619840cc5c88025f00c332f80d615229bc495a11fbc859360589ef3e26646ea9bcf4fda85830e1a964fe2e60d", "object_relation": "sha3-384", "Tag": [ { "name": "Downloader", "colour": "#25284B", "exportable": true, "hide_tag": false }, { "name": "lua", "colour": "#685EA2", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Tasker", "colour": "#BB9C71", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700142426, "uuid": "ecde6a81-9b69-40d6-a6a0-aa471cdcc9aa", "value": "T17AD5BE2A35CAC637EB7E82316669D77A61BE7EE00BB100DB63C42A5E1E305C14275F17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700142426, "uuid": "76b7e1aa-d927-41ac-afe2-6c9e33b3b56d", "value": "49152:LlDUdqW8zBQSc0ZnSKQZKumZrzq4Fb6HXr1iWnYs4ntHurpllQ6akuxtZ2OOsLRT:S30ZnqKzFnWntuxisLRT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700142426, "uuid": "1d34e53a-f45e-48b8-b1f7-231b4f0ab844", "value": 2949120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700142426, "uuid": "5b55b113-c800-4ff8-8d8f-0bc336aee545", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700142426, "uuid": "786889a8-9988-432c-8f9b-78ced679fbe1", "value": "Cheat Lab 2.7.2.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03a8faef-849c-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700151610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151610, "uuid": "ebebaa8d-7120-4d12-87b4-2d33ad936376", "comment": "Malware payload (RemcosRAT)", "value": "849d076884b4e4575592ae3eaea13a8b", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151610, "uuid": "019597a4-67f5-4bd2-a398-690467a53776", "comment": "Malware payload (RemcosRAT)", "value": "e6da7d4b675fdc9853add6602c89dbe327fbb91d022652489713b98e884b1391", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151610, "uuid": "ddae3198-f8ba-499d-901f-8f2677c9c546", "comment": "Malware payload (RemcosRAT)", "value": "cb7bdd33962ab443309fe56cc381ccb4dd0792a0", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151610, "uuid": "f7ca98ae-725b-4445-98ac-9f05f3c2bc6e", "comment": "Malware payload (RemcosRAT)", "value": "90b0ba9d2152d193f8bad8e01393a137f31c1f2c43fc4d8e9f83cdfdffe2f895182a324db636573771d152609f3d17d9", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "r12", "colour": "#41F559", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151610, "uuid": "b354f2f0-6c9d-4be3-ac78-27b54b5cfca3", "value": "T12B742296F38F1161E13142797AB893136989A0D94D8F41A91CEC59DF28BF06CE0BF67C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151610, "uuid": "4615063d-138e-48d5-a422-911054abfe81", "value": "6144:GrtaR5Gx5ftM/bQy2TXeyVIfjdwKLWRm7pvUXFyXl/G+12lyOIPk:GJ0GtcbQyKeyVIb7yk186le+1lOUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700151610, "uuid": "147faf08-bf6b-4246-a208-d1217a68195e", "value": 355074, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700151610, "uuid": "8f60fdc4-5832-4782-82cb-169fb839983a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151610, "uuid": "4bd32093-58c5-4a80-a1c5-15af2146ee3a", "value": "ORDERI0987654-0098800000-pdf.r12", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14f38327-84b7-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700163236, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700163236, "uuid": "b05c2d36-138d-4825-90ea-54cde64c969e", "comment": "Malware payload", "value": "41ada0797867082ed9b08811a639f287", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700163236, "uuid": "45726c57-1c43-426d-b629-4cbfd4ce6924", "comment": "Malware payload", "value": "e83b3fcdc3294e5417307d1591de5eb420d9afb8ca98859161efa7011aff5be6", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700163236, "uuid": "a9ee7426-6a0c-471a-afa3-533333655d40", "comment": "Malware payload", "value": "60d01af5487b7e7d4a7ec793a557d046576d6dd0", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700163236, "uuid": "4acf6e11-8e76-49d5-b591-8b1f9c5c914c", "comment": "Malware payload", "value": "2d32c371a0b74e29674f39245a548ab5df1571459601ebe4af45232893f78c555f17595d49a76e638d78713ae9a1e02e", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxScreenStealer", "colour": "#A62721", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700163236, "uuid": "62c082fc-af51-41f8-be2c-6b65411248a1", "value": "T14C4176F2F727C0C44572A67BACB7D089AE78406D012115097ADCC9DAEBB1D605272F87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700163236, "uuid": "a208de67-e274-453e-8774-8ddb7c022249", "value": "24:VJYcgZZi4qNr1Vje1N7GFuNKOfvIPyIHWb3zlb19EZOVxD1cWyPsc3/FFO+gfj5s:8c/r1Vje11Z9IYb19Z/cPFFpgfqpg4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700163236, "uuid": "f1699000-fa49-43ad-91d3-8bd84e9144a5", "value": 1904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700163236, "uuid": "35f80850-f0ee-4101-a7de-35e3b39b14e4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700163236, "uuid": "ca8df9f6-3867-47cb-952b-b8c3ceb728b0", "value": "gvDkwsts.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a034e549-8477-11ee-8907-42010a9c0042", "comment": "Malware payload (RemcosRAT)", "timestamp": 1700135981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700135981, "uuid": "7e1c8051-3b80-42e7-886f-18cbfa5a304b", "comment": "Malware payload (RemcosRAT)", "value": "2d2cc97d93b974d940d759f42132b96c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700135981, "uuid": "ce7ac7ff-dacb-4794-a708-b67d91197a17", "comment": "Malware payload (RemcosRAT)", "value": "e8a357b793e4a0577c451067faaecca2c5ea1746d91ef3a7120020aabc5ec7bf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700135981, "uuid": "a7b28033-e100-421a-999d-e99002d64ec6", "comment": "Malware payload (RemcosRAT)", "value": "4edecf08bb03e056ce40dd312b4b789a53b17595", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700135981, "uuid": "8198e09c-a0b6-4b75-8ed7-a52217907ede", "comment": "Malware payload (RemcosRAT)", "value": "4e9608b5382847de88217f9b78d72fb10b9a43f8d88862046d945ae1018274f50c403e14b384599975ed9ad72e5028bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700135981, "uuid": "694ec6c9-7b8d-454a-9a93-d09ee0eeb468", "value": "T1BC84237761E393E7EEFB03B2527A4B14C6B288A340366E5BAF386D9F3D585C94149043", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700135981, "uuid": "fc13cb2d-34f4-4fd8-8ad7-20f75105afc2", "value": "b76363e9cb88bf9390860da8e50999d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700135981, "uuid": "7e4925b2-8d72-4b5a-ae24-2efb751598a5", "value": "12288:CJy1eXIFHwW8hhWS8Gv225QsGCNlUKHREIeV0k5gLg:2ywxWYEGe2PtfEIeALg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700135981, "uuid": "109a9fb6-bc47-4e98-9e3f-16767e77fac3", "value": 397730, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700135981, "uuid": "84e5b63b-4c7c-4aaa-9389-ca4e2fdcf483", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700135981, "uuid": "ac0ada77-a7db-42cf-9e89-81436a9fec67", "value": "AS0987654000090000.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea5c7ba-843f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700112034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700112034, "uuid": "02615857-320a-45e6-aeee-8ec6a6cd8361", "comment": "Malware payload (AgentTesla)", "value": "8aee5f252e42120cfc8fe7e67d341500", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700112034, "uuid": "bfd7ac68-24b8-4e90-9351-edf1ba9afa24", "comment": "Malware payload (AgentTesla)", "value": "e91cf26515765666426d2e5080294002b848bcf377328b39f636a08de5b6018c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700112034, "uuid": "1d2035ea-6987-47d0-8bbe-e524e52c4833", "comment": "Malware payload (AgentTesla)", "value": "08270a8aa2ab0429713cb7631415cef6789d31df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700112034, "uuid": "439b187a-7580-4987-b8e5-b9aca013820d", "comment": "Malware payload (AgentTesla)", "value": "13e45af7a18cbf54dc0e51d2ee6cbdb6222d9681114653d720332f6124a872f833ed8aa7632adbf235a9f688e078ca0d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700112034, "uuid": "2dee93b3-b4d8-4b24-911f-32963da42302", "value": "T1BCD422A533BEBB50D17F6BF068B3211107F1B8679A7AE3059ED620DE68A9F44070531B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700112034, "uuid": "e081a254-afc9-4355-b009-6133c1906bad", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700112034, "uuid": "5ab9decc-7f67-4951-8500-3a324cb0366b", "value": "12288:5uPZeDwjd5jKf+9uFxeka3HfGdrL/3+ojIsGr3+lKCwZM5Ox8aCX4jcKa9:cZsiPKf8uF9kg/3xMd3S/w7maF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700112034, "uuid": "d263d6e1-6a82-4828-be4a-2b769062c009", "value": 635392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700112034, "uuid": "2b2d77dd-730c-4d6c-9c7d-eb1354b87c01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700112034, "uuid": "c2e815b1-e9a9-430e-8d49-7c66a30a052a", "value": "SecuriteInfo.com.Win32.MalwareX-gen.13918.1662", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "818cc148-84bb-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700165136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165136, "uuid": "c5a9042a-34bc-4a8d-b185-866a6efaeac5", "comment": "Malware payload", "value": "607c6d8db5ef07ff6dc6e21ebbe07ab5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165136, "uuid": "918a1064-c595-4e95-84eb-633390e91efa", "comment": "Malware payload", "value": "eac27ea606e7f61b9c1a0467212b1adcfe01041dc8885a5d3220509b9b812824", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165136, "uuid": "bec1bdad-535c-4885-8a08-f5ecbf4558dd", "comment": "Malware payload", "value": "85f251daceae9c6ad22603adf933f7aa168b11e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700165136, "uuid": "1a17bbce-f353-401b-ad75-5239d3955884", "comment": "Malware payload", "value": "9508cf8befb440b6285765c70473b4941d6c5ae0f9dc6a8df29632dae27d5aa5233ad1b5dfae5505856ad906118a5feb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "Meterpreter", "colour": "#17CA6F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165136, "uuid": "69f0c8d8-6edc-442c-9bcb-68825d1549fe", "value": "T1DBE48B43B6E410B0D431D631F862B621277A7CE12A33F56E3E96F56A8D33AC3063575A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165136, "uuid": "a0364186-0153-4c85-8d64-7f188fc9c4b0", "value": "75e9596d74d063246ba6f3ac7c5369a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165136, "uuid": "7ea7cf10-f701-402a-acef-915ef2a8e2a2", "value": "12288:3BdlwHRn+WlYV+N0XNiGihLxD2GrNfXbm:3BkVdlYACiGiCWNfbm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700165136, "uuid": "8836629a-a325-4b41-b984-96fbffa680cc", "value": 665120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700165136, "uuid": "187e751e-9cd7-4f88-9b28-44655152e3dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700165136, "uuid": "9eb29d5a-c56b-43bf-a74e-94529bd5c5d3", "value": "Pay Increase contract.docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74ec7eeb-849c-11ee-8907-42010a9c0042", "comment": "Malware payload (Formbook)", "timestamp": 1700151800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151800, "uuid": "f5b521d9-ca80-4f82-b8c5-f228767f9b6d", "comment": "Malware payload (Formbook)", "value": "bcf863eaa53ffbe804fc5e6bcfe2b424", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151800, "uuid": "8d757316-4fad-4158-8b15-5ccbb6957c4c", "comment": "Malware payload (Formbook)", "value": "eaf0b886df577c2c4a4e658b77693ed6bf0afdad4fd05a1fbcfdb88d81d10de3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151800, "uuid": "9f404e90-cfdd-4b91-9471-407804cb2e79", "comment": "Malware payload (Formbook)", "value": "e269c72b732a9ba59730e21dfa774bd64be4567d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700151800, "uuid": "db3949b2-5532-4aa4-8596-72f9a27ff953", "comment": "Malware payload (Formbook)", "value": "ec3b5869902947361fc80befd61d19cff2f7cdb173f441631096093a14ea8d728a4dcf70afd91b01bc187e88be7f8118", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151800, "uuid": "8d58fbbf-cf1d-4caa-827b-52fdcbca4237", "value": "T15DF4C0AD3650B9DFC817CD728A681C64EA11647B831BD253A0271AEC9E0DAD7CF142F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151800, "uuid": "6ffcaa14-2b85-4dc3-86d6-4243b2481919", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151800, "uuid": "2253bb17-55fd-455c-92b7-9e7343255d9d", "value": "12288:TtelauPWgC8b4+VYlPTIGll7vXWPtNWYNqNcy+fI0V8xY9tZv0u/TrWo8vMSPQhI:OWV8b4e0IGlFG2LNcyF0V8Ec", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700151800, "uuid": "a42623d4-31ad-41ef-94bc-6a657bf0b6fc", "value": 751104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700151800, "uuid": "c6844d56-6aee-4507-8a25-f356d5c83215", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700151800, "uuid": "114f2373-127d-4c77-b5e6-8cb56a26cf1e", "value": "Shipping documentsInvoice and Packing List, Certificate of Origin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd3c1b6-8481-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700140195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140195, "uuid": "c54e281b-5dab-4940-8afe-a647dfe19a2c", "comment": "Malware payload", "value": "6d6662eb3099736a67fdaa5740f16657", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140195, "uuid": "fda6e3d6-5e79-419d-9879-c43142cccd00", "comment": "Malware payload", "value": "ebdc12a94c386bd8307c063261323cd98646c5bd378a15366451936f29540f44", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140195, "uuid": "5cbc3a77-ffce-42ce-99c6-71cb11f87cbe", "comment": "Malware payload", "value": "9adac5a2eb3a5fe3a0155bde10e412e346992563", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140195, "uuid": "2410b890-b820-4c77-8083-3eddf4f9a9c5", "comment": "Malware payload", "value": "3fd803cfdb3182584da3066ee3538ea68071df24889815f5568fe79825d75835347b0f7f4654bc344b1359ab9aba310e", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140195, "uuid": "ec645de3-1597-4996-a394-abf67a621410", "value": "T156152381851F71D0CF3E88318E4A5CF5BC79E53CBAD622F0C6E99829E4A54DDD72C884", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140195, "uuid": "4722070f-ea85-4cd9-9781-f80f69fb71dc", "value": "12288:U9qJ3GbAA5561tDXO1nm/IdM9I4OCqyYi7HHB+Qy3VVXNq1Xv5vMpNxt/3HMDT:YqJNo0PDXO0/UCqVeHHBGZQ5vmt/4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700140195, "uuid": "61bd9609-a422-4434-b099-910a6dbe13f5", "value": 897436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700140195, "uuid": "78c31f35-5f3a-47e3-8717-a6f893013395", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140195, "uuid": "7df7c89a-05f5-40da-943f-2ee35e06f19e", "value": "9008654324456.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6abd20f3-8495-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700148777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148777, "uuid": "e325b08f-cac4-4c11-81fb-4a1ebbdec2e6", "comment": "Malware payload", "value": "e76145b7d7125b40538bcbde164ff593", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148777, "uuid": "70f644e8-9f67-4b27-8b5e-e60ce8d2dd66", "comment": "Malware payload", "value": "ecf42aa2ab84ab54fa7e68a2e1e6eee0f9950c2cf6e469863536570372b99054", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148777, "uuid": "53cfe165-5d17-47b2-bd47-5d1aaefc6def", "comment": "Malware payload", "value": "c6832c6c05dd9d301514b8208b15cfdd19ae2146", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148777, "uuid": "6899d88d-bc3d-4ac3-ac77-87024eb4cc8b", "comment": "Malware payload", "value": "1ac3517c509951118c61b28bdf2c4b201fdebc1a1beb84ef653bb2305be6ebb98995c20b664830a57ee3cd8bb983bfe7", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148777, "uuid": "2207e8f7-2077-4283-b06d-96cf46988d73", "value": "T1DFD59D80E2F4A64DE4DE8636DE2067F5A2B264577723E359EC40E659783C2D7CEC4223", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148777, "uuid": "1f0a32bd-d1c5-4aa4-9f06-616b88a2556d", "value": "49152:+qCY2nf4AUBeTNQqw/H2a2fidVEtMoo9SSwMKJrEmzuZWj7:lxqf1pdw/bD8OkXc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700148777, "uuid": "77c74632-b387-49ab-b01b-5ede4f88c697", "value": 2949120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700148777, "uuid": "2e51e016-d544-4ab5-b525-3f91669cf200", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148777, "uuid": "ce827961-683c-4821-8655-80ed7c1c8f42", "value": "1-Detalle de movimientos (2023-11-14) 23.23.53,231.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14fbc42-846e-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700132171, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132171, "uuid": "d0ff9416-cc1a-4bf7-9bed-37a1c0f71072", "comment": "Malware payload", "value": "fd268c4afc62286486b50f7a6d10d62c", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132171, "uuid": "93fb5fe3-d858-4a1f-aaad-6d8da06f708b", "comment": "Malware payload", "value": "ef329bc3d3a0ba7951ff75538ebd0de9f4368a45408f32d8ff4c391414bdd931", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132171, "uuid": "2dda5a03-e91a-4197-b4a3-a35cf7ea83a2", "comment": "Malware payload", "value": "125cf4174d9a8f5bd4cd127c2fe872dc5a9e5b30", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700132171, "uuid": "75e2025a-2879-48fa-b9d3-9d943140edce", "comment": "Malware payload", "value": "51424ffd81922778d86f0b161e58bc1fabcc33c56963844b95e906ed1bb896efbc43d4b72648c554473783f9fe1accc7", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132171, "uuid": "41eaa111-9857-4461-ad2d-6c4f806d4f5d", "value": "T1B904AF11759181BBDB9E223454FE6F3AABBDA0860B158FC3A30DEE554D215C0B73339A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132171, "uuid": "10539671-76c4-4798-92ac-12639538c761", "value": "98db086366d9a4f32c883015bef35a81", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132171, "uuid": "995208d6-0f80-4dbf-be76-45caeaebfd90", "value": "3072:I74+blpt+wsxMl1NqAc5iSttkClpelrlLebVaKoXAxOPYe:I74elpowsxizqyStZlpel5iyAxOPF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700132171, "uuid": "98441b8a-7a07-4fcf-989b-6bc95511f459", "value": 184320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700132171, "uuid": "5a628cf1-feff-4550-b773-92b40678e60b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700132171, "uuid": "4a807f23-0289-4012-b1f4-69b87d1cfd98", "value": "WCUtil.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71b56066-84be-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700166398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166398, "uuid": "c7c8d2b2-3ce4-4ac5-84b2-ae581ea312f8", "comment": "Malware payload", "value": "2bf3b73809810d239e1d8964a10ed1b5", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166398, "uuid": "cfa17d3f-9ee2-4a73-a78b-26540b95dec6", "comment": "Malware payload", "value": "f0d272df42ea2eff2f3a4c7bbfa69bb737c7965465155401fbf2fd508ff5eb17", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166398, "uuid": "24010a08-e21b-4929-8bc8-779549b9beeb", "comment": "Malware payload", "value": "5a8b6b666d7d9bd3e94fca5b07284aec067bfbcc", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700166398, "uuid": "ea08cc95-3c88-41b7-8deb-fc211c01d062", "comment": "Malware payload", "value": "9355cdb5d3fd85b2c24110f9dd6aeac736d459d505980f1e8f36d01b92355b93e4117b692b2ecdb4deb3fbaed4208098", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropboxStealer", "colour": "#D66F21", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166398, "uuid": "c1f1de4d-b390-40ab-8dfb-ab4079fa651f", "value": "T10741956F4392313BA3F3105997827407A69990CE6C1B69047BDCA15BE7C13AA43A7B22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166398, "uuid": "a1b177b9-e25b-4948-80ca-fd29fa340f2b", "value": "48:rujcLX1gxjSvb29XY2CQpScoQ+JwpAikSE09TZOU:rPgYT29XfScx+mpAhL05ZOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700166398, "uuid": "7ba0a5b4-5af5-4894-8efc-791afc0a0b22", "value": 2056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700166398, "uuid": "667d50e9-70bd-44cc-bc81-4ff73a07a7ca", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700166398, "uuid": "432a049b-98ab-4957-a81f-e8a1d540b61c", "value": "mvpaF9P3.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85603963-844b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700117039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117039, "uuid": "763ceda7-447e-4c6b-89b2-058ad3979f4f", "comment": "Malware payload", "value": "4a8995fc464ec0129d66e3853e4bd5b4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117039, "uuid": "218f1d1d-3a1c-4e47-acd4-2ae8c3158029", "comment": "Malware payload", "value": "f1532da89cd03625f5408406df4f476b330969a985239ec1c862ea62f1cee3ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117039, "uuid": "1e89f113-7908-43ec-badb-c3d4500cba38", "comment": "Malware payload", "value": "0a361e0bdf192081830c0cd4c8c6dbc8128a6648", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700117039, "uuid": "1366faeb-00e0-47dc-9d23-0d53f817aa4b", "comment": "Malware payload", "value": "666f0a846d80f898750b70f33389cda91e863ee5ab1ad9b1c5688fcbe333de9736687c6a3f04cad9e82c0ec682f3f635", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117039, "uuid": "b2426d81-f586-489f-87fa-3d4c0da4001f", "value": "T146B3F872B804DF66F00A96B504D38B367E30BFA70E6316A2731B39669D331D528A7F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117039, "uuid": "ccd4f8af-1e1a-48ed-b616-3f19cb118264", "value": "3072:Ydg8GXIDvGIk1MG8+mjypvZioamm/QcuLB1niDNb:YuFX0GIk1MHyphXamm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700117039, "uuid": "be2f8dca-e41f-44ef-8d41-8f2397bcbc35", "value": 118090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700117039, "uuid": "fe3ff24c-0292-4795-850b-5352aa925239", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700117039, "uuid": "5b26b04b-3d1d-4029-81a5-8c54bc88f66c", "value": "4a8995fc464ec0129d66e3853e4bd5b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "765d75cb-849f-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700153091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153091, "uuid": "782e00ae-74c1-4d33-a23c-2f6251ff0b6b", "comment": "Malware payload (AgentTesla)", "value": "b26d82412e98b0ba5493bba71c97e871", "object_relation": "md5", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153091, "uuid": "4b646633-cb4f-4c3d-b2ad-80731038a838", "comment": "Malware payload (AgentTesla)", "value": "f213a569cf0a8b823f8116f03f2e49ec48a0ffc2bd7bb202b638517fa8eb975b", "object_relation": "sha256", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153091, "uuid": "e71cbe2e-5156-40fb-b6b3-dd1bd01157d4", "comment": "Malware payload (AgentTesla)", "value": "8799e15432fb1b4002f20092598b48208abe62c4", "object_relation": "sha1", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700153091, "uuid": "8dcf90bb-2ee4-4b27-81a6-648587435278", "comment": "Malware payload (AgentTesla)", "value": "7d88299e179acb6e3bee5e3dbfb112bc591b19ae0422367a3edf7ffb1c710b4785621debaaca26a94ab920468581bcfb", "object_relation": "sha3-384", "Tag": [ { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153091, "uuid": "dc678562-0d5f-457c-b90e-c24cf4247270", "value": "T128E4231A5EC8A859BD537193E861BE869B0962E69F704CEB1012D3FFFB70B0D0C56126", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153091, "uuid": "b4ed979d-d56b-4499-ab61-b15123c053f0", "value": "12288:2F5DsVjQ9OXl5MCpcqLtkvp3GGCvtWLMPoJTd:MpeQ9+PMCp+GGCvmTd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700153091, "uuid": "5ffb0e03-e075-44c0-814c-fb0d1c4a6c0e", "value": 674760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700153091, "uuid": "9eaa0092-acda-4fa6-b0c3-cf4aeb3a7d19", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700153091, "uuid": "8b36847e-8213-4024-99e6-1fa01bb9fa78", "value": "INV and PAK.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54a4d802-844b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700116957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116957, "uuid": "9b0f2be8-74d6-417a-9cf8-893559409eea", "comment": "Malware payload", "value": "efc9d4805c525173f17f59484bbebca8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116957, "uuid": "108f8e6f-00a7-434c-a50b-968c2fda6e73", "comment": "Malware payload", "value": "f3a1e42c16c9528cb68a1d35bb5a393e0e6bacb192f11e4a9951a2ed8ca491b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116957, "uuid": "66bcd1a5-ffad-4747-bfe9-d0810b2818c3", "comment": "Malware payload", "value": "b1757eb4d22fe79bca4b5b78bb6f941e5eb345e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116957, "uuid": "bb1f1618-dbff-40ba-a6c0-9115fa9c7e65", "comment": "Malware payload", "value": "d3d409392640b2f3ed30755b2ebf2d6032332874a0c8871e3b40ccd31aa30aa9eddb4cec6da250ed219fc0825bd09387", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116957, "uuid": "8476d6b3-f680-4d22-a94e-a7969a7584ea", "value": "T122E3A53E7A11AFBEE168827107F29F70CF9529D326A19381E26CF6185E7118D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116957, "uuid": "e4247c75-52ed-4992-aa97-f4cd64e3a8ff", "value": "3072:JW6dm9tS1aRGQdK76t/zCuI5mrThPaLEnvPrNb:c6IG+LC/mrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116957, "uuid": "c537bba8-d9fe-4673-974a-7f784e4a50b6", "value": 155428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116957, "uuid": "065f063a-fee8-4b36-887f-531e1d5c8db3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116957, "uuid": "8fbc5efe-85be-4d6a-af74-87ef8f4f803e", "value": "efc9d4805c525173f17f59484bbebca8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a45e8a-844b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700116928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116928, "uuid": "3cde9cb7-0f28-4812-b033-506c3ad4b3d9", "comment": "Malware payload", "value": "20fd537160a2b2219a7cb82417507f50", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116928, "uuid": "f109cda4-93a6-43c2-ba90-275c5a4d3817", "comment": "Malware payload", "value": "f40f787bf1aa17f16d6c844ea8894da18173a61f07b4ab9e1810ea071ed75c76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116928, "uuid": "abc61aba-f0fd-4cd8-8465-012e804614de", "comment": "Malware payload", "value": "eddec768cc1e311b2c142569beed9b8f8dafa0a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700116928, "uuid": "6da2a12a-a326-4f1f-b786-98d021f5daa4", "comment": "Malware payload", "value": "17494f66df3248865d5f32dedbb1e316f79840620e8bc8d63ad633ca8a8e13d657a9ba1db153f3b6e4e3a2e30a7eb027", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116928, "uuid": "27a0107b-61ab-4d16-8a86-b6bb12f44138", "value": "T1DDB32A37A61C0B43C09B55F02DB77BF24F69AEA313A611C46609FEC04B73AB22551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116928, "uuid": "32c4d352-0910-4e64-9ce9-cb7a82da12dc", "value": "3072:pC/4rdZHsXsZwwR9XNk5mm/QcuLmHniPNb:pCwrvHwsZwY9XOmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700116928, "uuid": "73235d22-26f1-45ee-ae70-c9ca493754ac", "value": 116786, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700116928, "uuid": "8eb6b5fb-79de-4b3e-92b9-6747752fc124", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700116928, "uuid": "24a2596f-03f5-477a-8372-84743c8231bd", "value": "20fd537160a2b2219a7cb82417507f50", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d96b5810-847e-11ee-8907-42010a9c0042", "comment": "Malware payload (Mirai)", "timestamp": 1700139084, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139084, "uuid": "458578be-5725-4d9b-aff0-ee24d086211c", "comment": "Malware payload (Mirai)", "value": "e1722589e2c111b9d4453af04de74402", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139084, "uuid": "a6627cf3-1d5b-4203-b507-e96ec52dd660", "comment": "Malware payload (Mirai)", "value": "f5587fba904bebc361079bd1510207bc17db132b7dd928794244e0631cdd119e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139084, "uuid": "7af41a14-1b9a-4539-acd2-97c3bb13a9cb", "comment": "Malware payload (Mirai)", "value": "d9078cba5237848bf3877eecfbff178e42f746ef", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700139084, "uuid": "e1f926f5-58dd-45ce-b3ff-7bbfb96c67c3", "comment": "Malware payload (Mirai)", "value": "8d323cfe25227d39e116bf2c5220a79cd583f3b0dc15f2d3d7bbe931260c5a3434b0b5e6bc8548ace717e9d231ae6d27", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139084, "uuid": "3f6d6272-c531-45e7-aade-c69e30420ea7", "value": "T10E82D03596C6B573F67001319E164B47E64257EDA0ECB7B3610403A4DADEF8A73ACE42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139084, "uuid": "58628a8f-48a8-4955-b03e-fa20357bbb7b", "value": "384:iVBz+AxyZtZYm5qPzIBAl24JVTtMxqcbEaWhymdGUop5htUd:iVBKAxEZYyhAcuiV4rs3UozLUd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700139084, "uuid": "df85d1f1-ad74-4e49-b531-54c544a5ad9a", "value": 19148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700139084, "uuid": "256d96fc-ce4b-49db-8a5b-db40edca098e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700139084, "uuid": "9b474ac1-4176-4884-ad8a-8a4755fae027", "value": "e1722589e2c111b9d4453af04de74402", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b178090e-84b1-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700160921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160921, "uuid": "4728f51a-fd35-43be-ac38-9ca2a476f191", "comment": "Malware payload", "value": "d479995d29e10f65b48eaa36a70dc5b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160921, "uuid": "107f6256-4c99-40bf-a202-a74c989aab8d", "comment": "Malware payload", "value": "f6f01ade7874638c8ae81ce72145b74651b4b189eabd46f025164ece54823356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160921, "uuid": "fc11fdcd-fe07-4950-9766-1f5750fa4adc", "comment": "Malware payload", "value": "0c43fb6f6960fff9ba6649ee3c4ca949f5858826", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700160921, "uuid": "551b1ee9-6acc-4db5-9b5a-b3cac238870f", "comment": "Malware payload", "value": "48750f939c38a5928e25524b9d7f54bb32672c950bd02f3679f2affd3045a9af569541af396aacd7b1d2bc5634a36dc2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160921, "uuid": "dbb0346a-95a4-4039-bee3-c9018ed3431a", "value": "T199A733ADB2F32DDBEDAB463B8581B04AEA1E1712FDA14CD79027201052D468DD7FE4D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160921, "uuid": "130c8342-d631-441d-a4a7-5695e68b0e63", "value": "5e5ac8ab7be27ac2d1c548e5589378b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160921, "uuid": "881c734b-6365-4e2d-87f7-3262d111a95e", "value": "786432:vPoExQhG262AfQTCD1Rbn5wjRldtClP8FwGVTQ0e8YqPjQYJ7W1:vPoExQh76UU/5wNldtKEF5M0e/87u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700160921, "uuid": "03b821b2-69a8-4d23-8755-4906fba7cb9d", "value": 45127168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700160921, "uuid": "2f97ad5d-4628-473e-b0ad-c19abb3b73db", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700160921, "uuid": "58f8fd09-d249-4346-952a-834863ec07f8", "value": "Embedit.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb550f1-8489-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700143624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143624, "uuid": "188ea090-0f35-465d-b81e-7668b5a00b2e", "comment": "Malware payload", "value": "d4faa81cf5bd5ae8dc2a53c9bb763964", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143624, "uuid": "a3c6673c-1941-4bbe-9324-18978f723a3c", "comment": "Malware payload", "value": "f84e5e9ee5aab87880518da8f0ad9046656468b0f39c36ddcea561b9facd16c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143624, "uuid": "95559c45-c06b-4a08-a323-6dd28824cc45", "comment": "Malware payload", "value": "37693a3cff1e2a7609112f5eb72a61f522ff6939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700143624, "uuid": "ff0b4d92-a002-4215-a1b0-a083b2141c8d", "comment": "Malware payload", "value": "ca2100b10de113339591e9f1240cb57ba00eec052fa17a698078113a35de0201bfafa0f7deec2697f8a87a5e8ae7d65b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143624, "uuid": "9a67a44e-e976-4cb1-bd65-be6f2ad38635", "value": "T1AA058C88EA944266ED4E9B30B57AC9304376FEAEA435E21D1DCE3CA73FB73420411567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143624, "uuid": "38b7a9e2-3715-43d2-b943-ff7e73e0216c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143624, "uuid": "91c53ae7-5b1d-41e9-bf83-c3c653123415", "value": "24576:mYX19xNC9kOjHA6bslLgCQ/QYQCQieYXh0jz:5a9kOwYef", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700143624, "uuid": "28c433f5-66a1-4201-85a8-3f502218d15a", "value": 857672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700143624, "uuid": "a66040aa-153e-40eb-9ae4-07dd43bfdcd5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700143624, "uuid": "ee321974-37a8-4dc2-afc6-d14f9fdee3af", "value": "2.Invoice-4500000956-1018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1938386-8494-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700148546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148546, "uuid": "b9fcde6e-e89a-4e5c-9ce0-d8bb83a666e9", "comment": "Malware payload (AgentTesla)", "value": "f657bc6b25f27859a5f69be87ff4b85e", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148546, "uuid": "b08fd05e-ae82-44b7-98e4-f46c5df37f44", "comment": "Malware payload (AgentTesla)", "value": "f8728c3c4d603adb62e2d7eb9e622839abdd033f7c0404d5a21cd02a9a7cde76", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148546, "uuid": "5897f796-aa07-4d21-95aa-c787f55b2c24", "comment": "Malware payload (AgentTesla)", "value": "2863ad6c45c6773e22598aba264b37934c721115", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700148546, "uuid": "f9f9dbe4-c466-4f73-9624-c96a484c6908", "comment": "Malware payload (AgentTesla)", "value": "c88a44c34842dfc6892eb7ba3d738f69c05b0364cf443299f572ca972bd4ee339953d0b79b64e40a0bced3a8a195be67", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148546, "uuid": "adae6c19-13af-4886-9ab8-f0aaae2900af", "value": "T1EED423504CD3CD5A088FE0541182CF743287D4506F9E496B77B885739AA7CBBAB70CAB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148546, "uuid": "418714d2-93df-4e36-9c6f-a8f97a34c40c", "value": "12288:f9kgIwACxYdMs2fY7nXzNsp9ioBHdQQaQRyqByv0IKhGIaT/zFxIFMt:eMACxY2fY7nXzNsx9QORuvQGb/zFxMK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700148546, "uuid": "79faf7ba-24a3-4bca-8f9d-794f4b093d66", "value": 616876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700148546, "uuid": "23d43284-ff25-4a9d-8edd-40c490be6afe", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700148546, "uuid": "ef829c79-1c25-4ab2-a6f4-9d0022f46cf8", "value": "Factuur beheerskosten.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e95e751a-845b-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700124078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124078, "uuid": "0fb74d29-c6e1-409d-bb76-dada3b6dc99d", "comment": "Malware payload", "value": "e718f6d076309ffcbfa8515db1df0b6f", "object_relation": "md5", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124078, "uuid": "97f8d9c5-05d8-4ff0-89de-528401b07169", "comment": "Malware payload", "value": "fb8fc294dfeda915ae10f066eb3b85abdf47ca7f91cd94c60429b43177887cbd", "object_relation": "sha256", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124078, "uuid": "86ee41fb-2414-4774-91b2-1fdb199ad985", "comment": "Malware payload", "value": "98c15c2ed94cdab0915f56daa334f35b6aeb5a45", "object_relation": "sha1", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700124078, "uuid": "eb6528a8-319d-41b4-a2f9-701f31a8fb92", "comment": "Malware payload", "value": "a410d186532b8f91d59ac6826a0b8ec2044f43c2d3f87f8ceec4ec6227dbbbd0e566ce311787324e57b2f5e147755627", "object_relation": "sha3-384", "Tag": [ { "name": "agenziaentrate", "colour": "#B3FDD4", "exportable": true, "hide_tag": false }, { "name": "url", "colour": "#4660F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124078, "uuid": "01049a0f-3a7e-432f-9d49-26b2660fcfbf", "value": "T139D0220C8A4EC1A1D0421C1B80D8BE9CAC0DB0182AE2C84C1280DA8B9C8A0D5DC8BEFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124078, "uuid": "ea2abb5a-541c-480e-a0ba-35f40345af57", "value": "3:HRAbABGQEb/5sQaOUlJ7z1EIS5z/KbycAI9RyJ25YdimVVG/VClAWHn:HRYFJb/5sZOA7xyIyc1yc54vVG/4xHn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700124078, "uuid": "007fa381-8dc3-4068-8f57-81eeec189db3", "value": 204, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700124078, "uuid": "2f235fd9-440d-4c80-9ccf-7cd53e251ff0", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700124078, "uuid": "7947d81e-d811-4e2a-b36f-468537c968de", "value": "wizard url", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b95558d-8481-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700140215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140215, "uuid": "0246bf48-594e-4c0b-ba48-8bdba8921c51", "comment": "Malware payload (AgentTesla)", "value": "dd7982876bbf22b96050a3ccb0e7919d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140215, "uuid": "63d7894e-d4d5-4da1-93d8-9b580a47b367", "comment": "Malware payload (AgentTesla)", "value": "fc72fd6a4fdc1440d122d98d90279ff898193f68a63180da90eb5ec2495062d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140215, "uuid": "efa9d0f3-19ce-472e-917d-0464f748375e", "comment": "Malware payload (AgentTesla)", "value": "91dba78fa835285907b50a688d284d989518f0d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700140215, "uuid": "ceb5609c-7b17-4aa0-b810-f2338ce3c75d", "comment": "Malware payload (AgentTesla)", "value": "e4e0606bc03bb4fb50cce4c462251c235135308a0fa82e099c3148a93e7058d9d3d44a35554d4aca89fc29ae9cc9e877", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140215, "uuid": "08fe81e2-fef1-44c0-bc37-07158e0b34ee", "value": "T109D412A571FFDF71E9BA6BF02A72600607F1A5632D33F2095DC2A4DA191BB40A710B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140215, "uuid": "f2323373-5578-44b9-a5cd-649396111828", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140215, "uuid": "f2ad284a-9aae-4df6-a67a-c75d062345ff", "value": "12288:9uPhIeN158vJQFX7Q1OCfU5LjtRK2EMXCWhbW/kLZ8mx0M1qU8:IhFGyFMixFXFWYinU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700140215, "uuid": "d36b7b5d-936e-4e5e-be04-936e92a63be6", "value": 638464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700140215, "uuid": "5bf78ff8-988c-47e3-9e55-06c2c3c790cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700140215, "uuid": "41d65716-7d52-4f5d-8e6d-947597c63f23", "value": "REF 21654 P.O 2023-830715527XXXXXXXX0023.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d400e76-84ae-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700159518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159518, "uuid": "4cf05e6d-ddfe-4a2f-aa3d-cb974e89e4e1", "comment": "Malware payload (AgentTesla)", "value": "6c6127c01a0afa8ad696bcbaf8db42eb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159518, "uuid": "61182435-78e5-4d26-a2e0-4abf3ab09bdf", "comment": "Malware payload (AgentTesla)", "value": "fe3e332e92b8a7b5cdb04b878d350ae200d3310267ab8e9ea5cef6651f94dbe8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159518, "uuid": "98923482-5984-441c-9f65-796e7bf2940d", "comment": "Malware payload (AgentTesla)", "value": "c7603d24f4bac9bf1396421a6dbdda6cda4372cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700159518, "uuid": "7d60bc91-d385-4011-bb9a-99a9c769de7d", "comment": "Malware payload (AgentTesla)", "value": "ccea2efa0fe7b07f8ede1167d8ae370885e795cd1d124fd02209f08dd3ebe0fbd09170b9734ceada6ddc28b906417afa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159518, "uuid": "bd576ded-1f19-453a-9f7d-7cbb289d67fe", "value": "T18AD42302B2A75B78E1B633F01DB1A62117B9E47AEE3BE3094FC624DE1915F105711BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159518, "uuid": "8b790711-e17b-451d-917f-20361576eda3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159518, "uuid": "8bafd110-d0a1-4bdf-a981-75e14aa4abc6", "value": "12288:ruP8Bnj4oSW3et/2hrxMca8HOnY8PXW6LyB89okf+xm2sBXm:+8NJetqhanXPXW6Q+oxxTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700159518, "uuid": "dec4fd18-e4fe-46c0-a9f1-d28297c09fb0", "value": 643584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700159518, "uuid": "82ad5060-f60c-455d-a23e-ddf7d392bace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700159518, "uuid": "5ac97e53-60bc-414e-ba7a-0a60d2ae2356", "value": "SHIPPING DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e780055-846a-11ee-8907-42010a9c0042", "comment": "Malware payload", "timestamp": 1700130395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130395, "uuid": "6a1a9b4a-3dfa-4464-a2df-08570dbc4f48", "comment": "Malware payload", "value": "207d1b36a76fc7eb165ca07baa359b12", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130395, "uuid": "28f65ac7-1472-4675-b321-075d69378829", "comment": "Malware payload", "value": "ff7953362998267e8554ee7880b215d42d460f12ff1cab773c9feb5c6225148b", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130395, "uuid": "94a34034-03a3-49a0-8c07-4a205fb5bb2e", "comment": "Malware payload", "value": "6c667b657a4c2daab0667b696f307a5daf1822b4", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700130395, "uuid": "8e8c6430-ca8e-4850-a907-306423fda3ca", "comment": "Malware payload", "value": "220a439daa74ef381467c4e472c013e02cf4bfaf3d54a2f441affbcb1a54a8c2ffe8ab25bb38c75b00dedd79c04a988b", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130395, "uuid": "045bcf15-f002-4fd3-b790-987b27cb356d", "value": "T156B12E7175CD842E96B28053A2313EC292EFD97103615E257BF739BFE5C28B01A635AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130395, "uuid": "a7eadbb0-4fbd-43de-96a1-5c31fede8b8a", "value": "96:h6TdXb+xiTb5NLTbpvNsvvR3B5v+mbBx5KJL6wZHq99q++t6BVARWMDqxMtQ296N:YRL+xiBNLxCxXt75KJLZHqPqztaVARWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700130395, "uuid": "df903837-b3db-4591-a5ec-2b1be7879a2d", "value": 5246, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700130395, "uuid": "f2fe323c-8749-447f-8562-9f2da0db1524", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700130395, "uuid": "d5ae92ca-6fbd-4912-860f-9d82df75086c", "value": "207d1b36a76fc7eb165ca07baa359b12.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c566cd97-8458-11ee-8907-42010a9c0042", "comment": "Malware payload (AgentTesla)", "timestamp": 1700122729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1700122729, "uuid": "ad74210e-10fa-4f36-bfcc-ad3af07b520d", "comment": "Malware payload (AgentTesla)", "value": "7c12f7022dda864329276adeb2d3e1c6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1700122729, "uuid": "4e4d411b-2133-4ece-950f-dcfda4ec7c8d", "comment": "Malware payload (AgentTesla)", "value": "ff804c59e3c5f8870dccbbbbcc63f1680156c5f336edd727dbd3f878d99447e9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1700122729, "uuid": "a3f1ca6e-98de-4b5b-a0ac-bd61273c169d", "comment": "Malware payload (AgentTesla)", "value": "6a5095806b9fdf648aa0dde66e2cf679df8701d1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1700122729, "uuid": "a0095f32-b08a-4fd6-aa81-9baa55a7d441", "comment": "Malware payload (AgentTesla)", "value": "eab50ccb22b7b706227db20cb1a4719f6e554a2137a5040a231c743423faf95c6938b49e9ff7a8fca17ecb7b7fea20bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1700122729, "uuid": "4b5dcafa-1ee2-4a1c-b001-93d01a32023f", "value": "T1C5D4120133FA8F22D5B437F53D7261060BFAD96B2436E38A9DC934CA552BB454B11BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1700122729, "uuid": "1c42fb2b-b51a-49b5-a5fd-96040e7fe091", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1700122729, "uuid": "efc6889e-20cf-4292-8af6-a989af70fbef", "value": "12288:TuPMNGo168CN29ddzW5GgIU2hqfPGX5dKDgnRuc+XMYEZzz:mMNGo10NSdhEGNU2h6GmDYDvjxz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1700122729, "uuid": "31d55c30-0c5f-4603-a362-8c9cc3fcf186", "value": 641536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1700122729, "uuid": "360d320b-8414-41d5-8cfb-fc199610cb64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1700122729, "uuid": "5d3016e3-9296-446a-8b0d-438473fe61e2", "value": "SecuriteInfo.com.Win32.MalwareX-gen.20367.24585", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }