{ "Event": { "published": true, "date": "2024-03-24", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-03-24", "timestamp": 1711324981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "1f44496f-175f-4a28-a2c8-819b93804b3e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7682bff-e97a-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711242430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242430, "uuid": "cbb655b9-e93e-441e-bdce-b5e28d58c5c2", "comment": "Malware payload (Formbook)", "value": "146d7d828c849a90c8264e3d68922396", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242430, "uuid": "99a9bf72-d744-408f-a831-7038bc03c9b5", "comment": "Malware payload (Formbook)", "value": "0076a9e68f3fab895dccd38df7595134d7929d13d44fd5cd0809d3fc84b6eb78", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242430, "uuid": "3b011e62-7f04-4a6c-9f60-c3e4dca65fe6", "comment": "Malware payload (Formbook)", "value": "44e609af0d410f62a240a2190eb009df0c883930", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242430, "uuid": "7af1e0bc-3b3e-4135-927f-a0c8b938cd22", "comment": "Malware payload (Formbook)", "value": "682142157112394a2319a17a70eb5d416fc8bb1476dc43f56fa734503d26aa1cffdd0dcdeb3f92516b75e66acf3228eb", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242430, "uuid": "5f7c818b-3d57-4cbe-ac1f-8e433a02e215", "value": "T13304D5698FEBA642C45A45747C3363828A3D5F7994CF75168EE33FED1BB3C9411220A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242430, "uuid": "057b9e3d-db36-40ba-8649-2f5e19de56b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242430, "uuid": "763a6e26-5e05-4d48-bd7e-3d524b759a50", "value": "3072:WvPHMvihlryWUyKUvcem1bLyM9NOkXr4NpVq8BxFRzaqF+o2GQJ7/JzqVfGvc:WnHM6hlW1O7Qbd3rgVqwlL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711242430, "uuid": "f44eade2-3532-41c4-b22b-681b8bc27796", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711242430, "uuid": "e164131d-4670-4022-9136-ea5d24941f60", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242430, "uuid": "6b6cd46d-432f-4812-82a5-b64a1dea8f7d", "value": "chrome.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62b4400b-e9a2-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711259414, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259414, "uuid": "6bf92a03-ec48-4161-923c-941e841ecc90", "comment": "Malware payload (RedLineStealer)", "value": "ea26fcaf8903da1bfe21acecc33c2603", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259414, "uuid": "39c52b7f-7db9-40f9-9850-911f98781fe0", "comment": "Malware payload (RedLineStealer)", "value": "00971cb6265f2b6ec80830e5bd41ed8f6df0102fd99fdc23f7dfef3d2a28ac46", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259414, "uuid": "4565b074-c062-405b-a35e-1adb4dc59ec4", "comment": "Malware payload (RedLineStealer)", "value": "951fd85f29b0182dc4b7358d1f7f6e604b63a1c8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259414, "uuid": "eb637f73-abca-489a-9770-580d021b6419", "comment": "Malware payload (RedLineStealer)", "value": "b70d5b82dc500a0b775cf2d57c11a956e88c78d5691b10fcf0d58dbf9b4bbae952fc44ff962362797e68eeb824d596e7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259414, "uuid": "0dfa0303-cd22-4cf0-92a2-b06d8c331d9a", "value": "T19AC4EFCA355A8BF2E51A0CB10131D5E1F7B19D1877A6D1B9B9B4339AF4EFB8931C0212", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259414, "uuid": "7b12423f-4ae5-4181-be71-ea61bb68fe67", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259414, "uuid": "7afb698c-e5f6-4903-82b6-14c49110e64d", "value": "12288:nglfloOJRYWq9DcElgYP4krKTIG/YZRIIhqsDGK30oQup4AHz:etoOJbWcIgYgkWZYL9tkqnz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711259414, "uuid": "e34a1738-2150-4500-b892-c437b800a7fb", "value": 569856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711259414, "uuid": "1467d334-455c-4883-845e-4123337e2a74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259414, "uuid": "7181a4d6-46d8-4ee1-afcf-bea948f84f9c", "value": "EA26FCAF8903DA1BFE21ACECC33C2603.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f2e4e27-ea30-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711320477, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711320477, "uuid": "f138fb82-fd11-4b67-a4a7-df578ab151ee", "comment": "Malware payload", "value": "82e79aae93a86fcfdf207ed0f5e32815", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta_EKhZFa", "colour": "#180EBD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711320477, "uuid": "b105a20b-154f-4e45-8b25-b3a6e9690656", "comment": "Malware payload", "value": "034e4852cb2bcc006a87d63afe7d7f72211a6065ab7c8793b6fe7942829df5e0", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta_EKhZFa", "colour": "#180EBD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711320477, "uuid": "5545951b-7f93-492f-ae36-3096c39e3ba8", "comment": "Malware payload", "value": "25c1db541b9c1f79f2e8c53e1a46afaf4a3152af", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta_EKhZFa", "colour": "#180EBD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711320477, "uuid": "a0387524-e2f0-4f33-9b20-2b5058fa28cf", "comment": "Malware payload", "value": "b1f45475e5ce5844a11d6c284ed7493e9076990907e05321041a49319938167c6a07213d0df5442ab9e1edcd570364f8", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta_EKhZFa", "colour": "#180EBD", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711320477, "uuid": "daa5bec9-4200-43a7-a8f9-160876cf126d", "value": "T1241833FFAF0849BB6279EC8A1135D29D3EA3B7108FB5C0A05E45C67F500DB265ED211A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711320477, "uuid": "570c92e8-ff7f-4b23-9a3b-fd4898c39c9b", "value": "1572864:qSFipIE+OHSkefEhwhReEmri+olhCwzU9iSAX0bv3+Wg9rvaQo8ah:7IdyEhwhRelri+orCuUNbvXg9LaQobh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711320477, "uuid": "56809811-4152-44d2-b778-d4390dd48c5f", "value": 85526264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711320477, "uuid": "431b51de-7f5e-4835-981e-9df44227faac", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711320477, "uuid": "c1ddb9d5-41eb-4367-b283-4205edda8f8d", "value": "Mauqes_beta.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb565d93-e9ec-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711291345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291345, "uuid": "92004347-ae8c-483e-814d-d27100bd7bbe", "comment": "Malware payload", "value": "609ac9d463fcba7d58f1ac824abff8bc", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291345, "uuid": "f7a04987-273b-45cf-9678-39f9f2438d51", "comment": "Malware payload", "value": "0425e528d31b71e84341dc0087e4c49245bfc6be253ca9829ce77c8d9ab587b0", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291345, "uuid": "16334bb3-10b5-4d7e-aeec-6b16589bb6e2", "comment": "Malware payload", "value": "f9c624e7169ea2c060cd50adb95e2c057d7222da", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291345, "uuid": "36167175-2f2d-41f3-8dcf-c96549d79dfb", "comment": "Malware payload", "value": "ba2fdd7ab8db8ecc85eea2dfabe24e0ef7ab2d68c52edc7fe29fb32135def30ad91c420a45a446cbb6bbe727da383082", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291345, "uuid": "6cb447ef-8e99-425f-928c-d3d4b54c48b0", "value": "T1F6E4338BDADB0BA60BBEF930214D27D049C5DF16540DF08A6D53AEC31DDE60AB8B1536", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291345, "uuid": "a7160422-f22b-4cbb-9851-90f9e4f997d7", "value": "12288:jbNEHl4WOOivRyFakYuIKZAAIRyYh+3Fp/xET50P4n/vgC9bXgoPGZz15Hjxa/Ll:jbNLWevO5YEN0AytF/vV9TgKQJdxazl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291345, "uuid": "4564091e-de53-4e3a-833c-95023caaa95e", "value": 675228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291345, "uuid": "113cdb99-0eb7-427c-87c5-c8bc167d1138", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291345, "uuid": "6e5d5997-4700-42d1-bb7d-386946fecca7", "value": "nOrder#inquiry21march.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5be4a1e0-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265416, "uuid": "3cd2b5c7-3b57-481d-af56-f66995b056e4", "comment": "Malware payload (Gafgyt)", "value": "afa66c3c8751f268dce635711f5895be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265416, "uuid": "1485b5f6-22b6-44b4-8978-2268aea87378", "comment": "Malware payload (Gafgyt)", "value": "0571c16d0f2d0267b354f81fdbfb49738f3cb867371b9ef0d3ffe1020fb9f9cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265416, "uuid": "9e2aea2b-6e92-4b54-ad6c-b3e9876da8fb", "comment": "Malware payload (Gafgyt)", "value": "259e21ff16beef255c751bc64c0fdbbfdd67f0ff", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265416, "uuid": "50426713-b7ae-46aa-b6b6-65fbb8806199", "comment": "Malware payload (Gafgyt)", "value": "5e9d5c37face25a42e6f562d17d7bb6ff870d42aa5cbfacd28bd71d4e72bbafad7d5bd0b7270ddd04a9305a6c56a8049", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265416, "uuid": "45c94c95-4548-463e-8cdc-1f88c5af37eb", "value": "T1E2A36B4789B19EB3C042AEB925FB99740713AC214B0B1F65612E9BF4074BDCDF88E764", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265416, "uuid": "842d04d7-57dc-4bd5-9eba-c18e4b237a5c", "value": "1536:aG/69+cXbrM6aG6X9DXxhdq56odd6f+NE6fy/mhH/cm1u2X+:aG/XcXbjaG6Nxq55dMCEGWmh/cCu2X+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265416, "uuid": "1aedfb7f-e7b9-4720-b99d-0490cdcda63d", "value": 106484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265416, "uuid": "bb732c03-402a-486b-8d3f-aaaa6fd901b5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265416, "uuid": "9015a4ac-ced9-485c-87b2-bf3b72e7eff3", "value": "afa66c3c8751f268dce635711f5895be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "919a1817-e9a3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711259922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259922, "uuid": "bc9feeaa-80d9-4d2d-93ac-89823bd5e757", "comment": "Malware payload", "value": "d5dcadcc2b0408958b2d1b8a6372b5f0", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259922, "uuid": "bfde74fa-176e-47b1-9ce9-58974a10f5ef", "comment": "Malware payload", "value": "06908123aef50606a47146b1abe41c5eab8cb5cac9e157bd52fff1f5d1a16d23", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259922, "uuid": "b9e6533a-c6ef-4171-9ea1-9cb0152dc8cf", "comment": "Malware payload", "value": "f69b07162ec36649df8ff87a21960e8eddcd87ee", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259922, "uuid": "02102a5a-a74e-43e6-993f-5340c799caa4", "comment": "Malware payload", "value": "41ad5ea2c96a30786b93515fafb53b723da4964501ea94494e4a6bae062fbb3c73c88fa0dfb5b6f986c50feb269cabbe", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259922, "uuid": "3ab0a823-aa1b-4b60-83d5-66c501abdbe7", "value": "T136572393F378E849D8F392339A790B62109B1E649B4797A36A18B23D19F3DC06D05FC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259922, "uuid": "c96ff59e-5d5d-4a64-bc5d-5d786a7c4376", "value": "393216:VmJ0DRRgrGt8enEczX89iwLGTfy9HXJ57DxduxErgdA0EVIbRS1pPJjL0CLsq:goRg+8enEcw9iPfy9TGEkIPPhL00T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711259922, "uuid": "094f5e5a-12c7-4e85-826b-b626cb05b97f", "value": 29600646, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711259922, "uuid": "4d2bf160-4a15-4dd9-946a-45bdefd1a19a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259922, "uuid": "fec93257-9f98-481e-8fe7-c4ba0afefbcb", "value": "Fun Piano_1.8.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5317a02b-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265401, "uuid": "2b166713-f9f8-4a80-a29e-93af91123839", "comment": "Malware payload (Gafgyt)", "value": "47ba70b30895d949cd78ee34a97b779c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265401, "uuid": "fa2ac4b3-dff4-473b-8bb8-393862737b6b", "comment": "Malware payload (Gafgyt)", "value": "08166a0d2fe65a3ad8b289cb2714c3a150635e29664bff24e5befc6b48526899", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265401, "uuid": "44fcae93-8e19-4341-9e8d-5281d7e31b0b", "comment": "Malware payload (Gafgyt)", "value": "25820a7de1a1052a9ea4779679e4050d96979a55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265401, "uuid": "5916e206-d6c8-4f69-9e3d-92c780e1d996", "comment": "Malware payload (Gafgyt)", "value": "b4df97f591a39d9dd1625a86ca8af4de543596d9ee100a27ebf17b181e82a6e035093a01c2e250d3151c081348af944a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265401, "uuid": "92c64163-4117-4a31-bbaf-d2942b9039c2", "value": "T16BF34A05D6408B57C1D2277AFBCF824A33239B64A7EB33155938ABF43FC27A94E26115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265401, "uuid": "aa12adb5-5037-4eaa-9706-f04325502286", "value": "3072:J2Y+/6kCgziZQ8a3eJfpaJowkggE8ayi/YhV7rPXWmLwSguWrpW:06vgziZQ8QeBpa+wkg9hyi/YhV7rOmL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265401, "uuid": "83f2dec9-f706-4e68-9390-d1a8387e31e5", "value": 163069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265401, "uuid": "c394792a-7738-4f2a-844c-65d3d67822f6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265401, "uuid": "9f558d0b-7c8b-4f13-9af0-688f91b07bb0", "value": "47ba70b30895d949cd78ee34a97b779c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c3bc55-e9b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Stealc)", "timestamp": 1711265706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265706, "uuid": "debcb985-bfbf-4b69-a21d-f4380d521683", "comment": "Malware payload (Stealc)", "value": "9d3969ddd709850988387475ef01380f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265706, "uuid": "b6110b8b-9083-4461-bbd9-4e9bccc91892", "comment": "Malware payload (Stealc)", "value": "0918a0e9939f235924a5fb65284c97efff83f871bc1851c7e61b1b9800512885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265706, "uuid": "52569e52-a5a8-4b35-a70b-cd00e39a7f75", "comment": "Malware payload (Stealc)", "value": "5ca25fc3c1f5d943735c5930c3a3a16ca329ea11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265706, "uuid": "30505301-7a71-49d3-a767-e4a080604baf", "comment": "Malware payload (Stealc)", "value": "63bc6212d6e90ff65b59c80c92ebdc76189e4972b12de2172fb6721a0557119aad8f5a40c0c01ce1a3203f12e62b257b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265706, "uuid": "3b359646-55ec-4818-812c-60af70284c0f", "value": "T1E1A4C00376D2EC60F5624B325D3DC6E8253EFC218EA9676732487B2F14B11A1E663762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265706, "uuid": "2267cdd0-46dd-4c1f-98d8-a3d12a4a9000", "value": "0be152bdfc9ef291ebc79442873fbb26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265706, "uuid": "3c72605e-8926-4f74-864c-809de5a79206", "value": "6144:sXBWxKpCZyNctndAGyuZTZhH/5zzdzDl2/sh+zojqfmDEyFfmKciPyFGhb:irpCZyNctiFuZTZhfQN0qsxFZ7PUmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265706, "uuid": "b0602303-057c-419c-bca7-0ea9304d0bd8", "value": 458241, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265706, "uuid": "6daf6f91-a02a-4271-ac70-68e5ea1cdcf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265706, "uuid": "36dfa8ed-2d28-42a1-b620-d3f028bb54c4", "value": "9d3969ddd709850988387475ef01380f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "917435f0-e978-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1711241454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241454, "uuid": "ee282322-e0d3-42f0-abb3-1e6238184edc", "comment": "Malware payload (AsyncRAT)", "value": "7c66bdd58347b8176ec473f10fd836e6", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241454, "uuid": "28c368a7-34b9-4e52-8fc4-38db91f6123e", "comment": "Malware payload (AsyncRAT)", "value": "0a512b81dde0ab50e6bda9738413acc10fb55c16d798ab21fe49603178a5f86b", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241454, "uuid": "1f482fb5-a216-4391-a3b0-ab461ee85962", "comment": "Malware payload (AsyncRAT)", "value": "9393eb297eb8504cf8b0c0dbcdbd78e04736da47", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241454, "uuid": "7ca72379-1cd4-4ed5-89eb-815069b69b5e", "comment": "Malware payload (AsyncRAT)", "value": "a7b03fb02a584d73eb3be8353c3758c59384be8b9bb5bcacfd061606379e41bc8ba356b907459af441526de4dace191b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241454, "uuid": "83fe4c5d-0d01-40a2-abe3-79ccfb3cd135", "value": "T13E83F131ABECC013D2160B315D6AEAE00A635777AD53EB2FACCA5F82D7673790761121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241454, "uuid": "b5d7ed27-39d2-4a74-a972-b21d372cdcab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241454, "uuid": "ead2611d-1f30-4f14-859a-c40a944ad47b", "value": "1536:AOSzBCrc5Iv4jBsYEJNbcYszAwh4lc68h2f+IuI05bhGJLd5UIq08RzWwxika:FOBCI5Iv4jBYPSAwMHHfBAVsO90Aqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711241454, "uuid": "9e9cacd7-40ea-47fb-ba71-085c1d61ba04", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711241454, "uuid": "180d7fb3-5eaa-4d31-8e12-af2ef0922304", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241454, "uuid": "f150e9cb-5f2a-48c7-8379-e20676dd2b36", "value": "7C66BDD58347B8176EC473F10FD836E6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4547442d-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268814, "uuid": "379fe189-dd8d-403a-b521-7ed182d4f50a", "comment": "Malware payload", "value": "6da0f33f479b843fb743b6fcd7f6f827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268814, "uuid": "2d93b2df-ee4a-40d0-bde9-ad48d3c4feda", "comment": "Malware payload", "value": "0be0d1c35399fa85d3f133465620eabdc899e367179b7b385aec75e66865389f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268814, "uuid": "11f15b29-4708-4c8b-a296-be1e6afbca11", "comment": "Malware payload", "value": "e2acb86d9a2a2a37ea62b3eee059ae3365ee9922", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268814, "uuid": "fe2483a2-9af6-4d6f-8d58-e45d0648378f", "comment": "Malware payload", "value": "4943ba791dc543fbf718bc95c1cf746fe34ee5c51d7f616b493a07bbbded5a225c54181c9b079a62449df746dbc27b81", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268814, "uuid": "52f71d2a-fbc3-4f9e-9f98-7ca794d21cd9", "value": "T14635E011BB91D072C26231764EA7E335A6BDAD619B2142C7B7C42F2D6E302E19D3934F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268814, "uuid": "e7cbc660-67ed-4e28-adc9-b37b6de64fe1", "value": "656e4782cc18931342281e8311ff00f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268814, "uuid": "c715e273-395c-4173-a306-898a18a1354a", "value": "24576:JSSfYNhFW/Y+eePv/QnrW6hoHi4cP1d1BrOfO:DfYbFWkePXQnrnii4urOfO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268814, "uuid": "058fb998-0b62-478c-9397-632a01a51d1e", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268814, "uuid": "f74d7c45-a51c-4884-af40-6c4a2e69557e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268814, "uuid": "6cb3fdcb-2ac9-4240-899d-c2158214a731", "value": "SecuriteInfo.com.FileRepMalware.26320.29620", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed209ebc-e9ec-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711291429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291429, "uuid": "8836bf17-19fc-4521-8084-839d8a7a8265", "comment": "Malware payload (AgentTesla)", "value": "2068e2330bf8526ee7af793d915c5adb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291429, "uuid": "3a6e5460-2503-4c50-84e3-4239995c5063", "comment": "Malware payload (AgentTesla)", "value": "0cd0926bd998e8e1c8dc74c2edd3f48a73d7d30a7c5794790d104c1149c02e2e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291429, "uuid": "460ac5cd-62c5-4082-b93b-314829fe260c", "comment": "Malware payload (AgentTesla)", "value": "f0ed37fa38d8531e079597ef79a62bb5306863ce", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291429, "uuid": "e64f0b79-fe5b-4b63-ad5f-16853c476134", "comment": "Malware payload (AgentTesla)", "value": "22aca111f1789c4d5879fe3a504875889c95ade7caef390497e20acbb3725d3e59162a6d84604c94b4a9db927ab70366", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291429, "uuid": "1d3ff86b-e17a-4244-b4f0-31f523b5992b", "value": "T163E4CE9239CA766FDC2F4679431FEAB22A755CD0739109AD4F80720D4C36A4A80EEDD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291429, "uuid": "25d52ad3-4cee-4685-bde9-6a570a9aa05e", "value": "fc6683d30d9f25244a50fd5357825e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291429, "uuid": "c4e1ab6e-ba57-4e24-8604-4f38642f3c78", "value": "12288:0YV6MorX7qzuC3QHO9FQVHPF51jgc++he0u2Y/ygAkcCMBM:zBXu9HGaVHRhe9ygjZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291429, "uuid": "7650d812-a6b3-4e85-be2f-fc0669435c17", "value": 706560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291429, "uuid": "e1427588-e78c-4a30-bf35-005655a28dc3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291429, "uuid": "984a9572-abb3-4ff6-9253-e232fb8a566f", "value": "rOrdendeCompraN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469d709e-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268816, "uuid": "9a7c6e04-385d-41ec-a5f8-80eb42da0052", "comment": "Malware payload", "value": "105291cc8a4f8c915c88b7a4817b2a61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268816, "uuid": "dc732c63-f487-41fe-ae44-a9caa449d492", "comment": "Malware payload", "value": "13943b7d498aa1d3f2b7f57819dd0a4d55549fd6bf22d184de01e1c0112305f0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268816, "uuid": "b70f6f41-d580-4669-9075-d295797df94d", "comment": "Malware payload", "value": "cf3f60f1d6d2b2469056a399673383acfc83c29a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268816, "uuid": "cbfa5375-7c27-40ad-873c-f7218ec5d440", "comment": "Malware payload", "value": "08433ae1c3753282b89c0aec5ca747d6bf0832695cbe00a62c7d5387504a608246a1e95bdb012a3497e30efe0c75299b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268816, "uuid": "f818a85c-8a2d-4790-9b91-29f726e5e293", "value": "T14A64D0157AC1C8F2C84A947104E2DB26597AE6305FA4CBD7BF584A7F1F602E11A3D2CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268816, "uuid": "61ad464f-2c30-413e-b417-5b9d4cb06507", "value": "b4b50f01529bb76779ed95a70fbeb1eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268816, "uuid": "d4272dd5-2974-44c0-b357-0bab41638de8", "value": "6144:Z3Y4lLCo4K5lVeukmKiuwv11rf1Ar3QNvO3BT:ZtGo4KDyiuwNV1A+W3t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268816, "uuid": "ad97ec1a-5879-46d9-9da8-70d831825d99", "value": 313400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268816, "uuid": "2dfa326f-9be1-4503-af57-eec808ca610c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268816, "uuid": "8961198a-dd72-4121-a99a-ec2999d8989d", "value": "SecuriteInfo.com.Unwanted-Program.00587b831.16449.5356", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d346abd-e9c4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711273900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273900, "uuid": "d48dbed5-0c42-4dd6-9825-de8cee88950e", "comment": "Malware payload (Mirai)", "value": "14330ff98d839d4bc58a99196492c199", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273900, "uuid": "ac1fd938-87f6-4bad-bb51-5c63a20abae2", "comment": "Malware payload (Mirai)", "value": "1591920bdc5da520833c47cf59c5de63b51a9d191d4cfddcf14749428bc3a458", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273900, "uuid": "2b0bf08b-562f-4409-9bf8-6cd5e02c3d20", "comment": "Malware payload (Mirai)", "value": "8488e70e57c484aa55a32630f7d3b1d3ab8cf764", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273900, "uuid": "63367305-d4a7-4e10-a1ab-6de69e14e359", "comment": "Malware payload (Mirai)", "value": "feae0afa892e6968cdc917fd1c1af806522d47a188fde91ab6e3413f3c6dea579aba881dbcddbcec11928719b34c2d22", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273900, "uuid": "edcb3d49-fff2-490e-8732-4ec44be9c898", "value": "T107A34B72B7391B23C0E1A47580EB8B36B3FA5BC91A60820B7E615E9C7F166D035437B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273900, "uuid": "73540b04-de67-46bb-850e-efd4eaafac8b", "value": "1536:B/IUZtJZUuZAF4toClB+ANwzN/ZsCNfKi91DsqmjdGG:hiiYA+FZFKi91od", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711273900, "uuid": "1fc95a06-a790-429b-b4db-6b6fd214105e", "value": 102727, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711273900, "uuid": "dc7a1099-b579-478c-ba31-67afd9aca08e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273900, "uuid": "2346bdb7-908d-4724-b3fa-f34079941a82", "value": "14330ff98d839d4bc58a99196492c199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "906e74c2-e9db-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711283972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283972, "uuid": "09b2ef5a-81c8-46f6-b2e7-a705cde35126", "comment": "Malware payload", "value": "c03dad575cc8aa6d7f6c1d1be9d7f989", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283972, "uuid": "b2bef2c7-cf49-4aee-8a60-f28b48731c09", "comment": "Malware payload", "value": "15bbdbb82e9083984f30ec6b4fa6c7f4659dbb3e86c47e75d8c3b892fdc7b046", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283972, "uuid": "3bc07057-ccb0-46b4-b6f6-7aa9bbd4703c", "comment": "Malware payload", "value": "fd57bf316d44ced3e6eeb9f377929c5f3fd9efdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283972, "uuid": "695056ce-5d69-4146-aa00-cbbbda89727b", "comment": "Malware payload", "value": "5c228c01adfc4f0756dc4cec9f830ccac9139fc6384d6d7be439d67b01e7e2a653de300b2aaffc326dbd0b072108375b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283972, "uuid": "18d20e62-2476-4a6a-b15d-a901443f4ac0", "value": "T1EB85D024B2919E79DE175AFCA04E88EB6A5F9DE313C5003327F196D1CA642D4842FE2D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283972, "uuid": "4d75631f-9803-481a-af08-f75f193b0a75", "value": "2cbb7a38a254150a220c55bcdea5f341", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283972, "uuid": "157331ec-c0d1-4c2d-b253-a17d6e3460e5", "value": "24576:QheWyrNEuwzYjiaPihdN2NHL8m8K56r0u2UB4pRfbhh8eOvmci68eB:QheWYwz0ONsGK5q0iWdbhhSvm7eB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711283972, "uuid": "d03d04d8-9aed-4ce2-ac72-790ae0f4f65a", "value": 1730360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711283972, "uuid": "58b793bb-4dff-4376-a377-b58cfdc4b5ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283972, "uuid": "5094c252-a6b8-4026-9477-9b8f3ce92a1b", "value": "SecuriteInfo.com.Trojan.Siggen16.24785.7440.28053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48a4f9f1-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268819, "uuid": "acc3595a-85fd-4a0f-95b8-99be60784280", "comment": "Malware payload", "value": "85bd2b6098086b7c6526566a443f29c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268819, "uuid": "748efcdf-8578-4c37-b754-d94120fdaf81", "comment": "Malware payload", "value": "16a5912504e91eae440542e61bae55583ca256810f0b0c76e639ee1da32a3f29", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268819, "uuid": "43dc8981-6066-4f45-baae-09766a78608f", "comment": "Malware payload", "value": "04852bf7cafc0add3ff19d5553d7c3c5dba3660c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268819, "uuid": "86e68fd8-7152-49a6-9ad5-2646b18470e3", "comment": "Malware payload", "value": "de45d214531ed47c49f6b7ec650068069266a317bfbdca990410dd74ad0e77d5209b82b80beb4384ec779591ad82e226", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268819, "uuid": "ea50cc10-5ff6-4d1b-99da-829047a8a72f", "value": "T147450292FB868475D6CF2674256BD71DC266AA815BE0C1C3EB087E9FDF322C21C3514A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268819, "uuid": "71f7305d-eebc-40e9-bb5d-d5651ab39fe2", "value": "c36083bf87fbac009393e9e37affa898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268819, "uuid": "d2a67aa5-fedb-4adc-9f28-ead513daf6af", "value": "24576:KOQjYiVjAyQ8hfDvdorJm8qbzXLSIuWyEEgohKHl2kA2w1pV3NGE:lsjAyH9vdD/bzLSv/EEgokHH21pV3IE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268819, "uuid": "d5072f94-de6b-4851-a3e6-9299751bfe58", "value": 1194552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268819, "uuid": "2be677ed-1808-4bb2-a64b-f60b92b6c72d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268819, "uuid": "f4768efd-1be5-474c-b65a-fa5ea7f2b7d7", "value": "SecuriteInfo.com.W32.Wews.A.gen.Eldorado.19224.939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8323c89b-e9a7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711261616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711261616, "uuid": "319672f4-1cc7-4e99-8bd8-f074aaaaeb50", "comment": "Malware payload", "value": "890a8dd646964f4820667ad5ce2c1edf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711261616, "uuid": "d6d1382c-b4cb-4d2c-807f-08cde0b97744", "comment": "Malware payload", "value": "16d7931ccbd08f3905916c5446451dcd3d293f9fa981db8528714e75ae5231c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711261616, "uuid": "ccb25894-461e-4dee-9516-72bd22e15336", "comment": "Malware payload", "value": "50383d4ddf8f376d51021667fdc3dd19eb508f4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711261616, "uuid": "9871d921-0110-4af0-b4ae-610916d920c2", "comment": "Malware payload", "value": "d78c953017cd96f13063b1fd1368ed71542122340a850e051c6afc3656fc60cb4f7eeafc844c0379aff374e740e7fac7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711261616, "uuid": "3833b00c-4375-47db-b363-e180eac1ba5f", "value": "T15FF53331D1C38466D3AB35B13E9FF8444314AC162BEE8EE76171468FF92831E8CE9665", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711261616, "uuid": "4c598ef0-e981-41d9-a66e-d657a9fdd3c9", "value": "7fd0fe17c4094b99fb826b71a77637a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711261616, "uuid": "1083df59-6e5d-433b-a8aa-d2b37a494bf7", "value": "98304:akZ/0e1DNstR9XUokx0AJ87k/QljWCXb:h6f/9XUjxNJ8FjW2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711261616, "uuid": "6abaaef4-6e9c-405b-8323-c042e7794190", "value": 3648512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711261616, "uuid": "e09bffff-6fa6-4fa1-b6b3-2c8ed4f994f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711261616, "uuid": "732f2cd9-3303-40cc-9ea6-bf5e7090e31e", "value": "SecuriteInfo.com.W32.PossibleThreat.4351.62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6203a3cc-ea2d-11ee-a120-42010a9c002e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1711319113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319113, "uuid": "2d0f9768-1de5-4789-ad39-775229f75288", "comment": "Malware payload (OrcusRAT)", "value": "2cfcbae378ab69f0a78671a560571700", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319113, "uuid": "b3af5877-d721-47d3-8cc7-8cf3a674b129", "comment": "Malware payload (OrcusRAT)", "value": "17bcbc74ec8166ff11ef983aece5446115a54eddb47138cd6ff7e5a509634962", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319113, "uuid": "654c744a-2790-4d11-bf16-9a5c47e5368d", "comment": "Malware payload (OrcusRAT)", "value": "97a6e23d367fb58e5076780b9d6358bd7d0ee592", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319113, "uuid": "fac9ada9-f97a-4560-a492-66971f217176", "comment": "Malware payload (OrcusRAT)", "value": "6f74db0f3705b4bc2dcc7b65c9ac7570048e4d8d6e38be841f74154ff38032a6c0f2218430b00f6cc7160af9e7623a51", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711319113, "uuid": "9fcc7147-fb74-4e55-84c6-44bc763a04f3", "value": "T197C51454B643AD65E242883D59AFC5E84D9B7CA1AE3941E77ABBB37F8C3CF017104142", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711319113, "uuid": "0df9cea0-beff-4002-a950-aa13bb53cf27", "value": "24576:ke3veFbXAD9zWi4MxO6m6b/fYLGACf9Dtc2PyX8+:ke/etqzXOu1Ff9DtTyf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711319113, "uuid": "1210d6a2-1faf-4d67-8020-5c6bbc55bb07", "value": 2690128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711319113, "uuid": "c08dddd0-95ab-40e8-9895-844092f8e923", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711319113, "uuid": "0e3f5750-f034-4495-b6cc-ae38217895c9", "value": "2cfcbae378ab69f0a78671a560571700.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f93f3179-e9ab-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711263532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711263532, "uuid": "2c181da0-8a2d-4e19-882a-754c458d0051", "comment": "Malware payload", "value": "d8d456ed069c9f921c3ae5f575f8db56", "object_relation": "md5", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711263532, "uuid": "dd96b52d-a5ae-4e82-b5cb-02461c66ef3a", "comment": "Malware payload", "value": "18edb4e2d78a9edcb60825fbde699086cb712416c00ea828425e154c0560b13f", "object_relation": "sha256", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711263532, "uuid": "ac4c3a54-039f-4c6c-a27c-447a3752ba00", "comment": "Malware payload", "value": "96e306047d872a821be72fd124b5fe63ecaf2b8a", "object_relation": "sha1", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711263532, "uuid": "5c14b8aa-36c7-4d89-9d9d-226ef685ea00", "comment": "Malware payload", "value": "64b4ea5072ad52a20b685d2e50db80e3b33b5d2245fe606cce8f7b1c6e7bc95f8ae31143299ebdf47484b28113373b78", "object_relation": "sha3-384", "Tag": [ { "name": ".dll", "colour": "#70849B", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711263532, "uuid": "58b0fced-b603-49ad-8095-437cebf5a9bd", "value": "T1AB162953E36101B9D44EC875CF2E56219A657C9E4BF193EF29D836E11A32AC83B39F10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711263532, "uuid": "bde36327-20ec-4cdb-ad6a-8c98d573fd36", "value": "e5e4f3f5367c0c82df24a4723fbd8a3c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711263532, "uuid": "b945b700-e28b-47e7-999a-5410443a3803", "value": "49152:VB3FRoUiZNneKuALVmm6f7qOlTVhX9TbvIPULS9j3vZ90tXq+iarIQKf8klUYAX8:zizZL69xO9j/itKUkh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711263532, "uuid": "0d063c1f-c0a8-483a-8ec9-e6ccd9ec18e0", "value": 4114488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711263532, "uuid": "02ff556b-2260-4155-a60c-fab57e4940ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711263532, "uuid": "b0ed2867-5425-4a3f-badd-2a3bc8e804f8", "value": "msedge_elf.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e790c8-e9c4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711273891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273891, "uuid": "b389eaa3-acc1-4964-a692-152ff122172a", "comment": "Malware payload (Mirai)", "value": "fa0a8133657732c521f4971b10d713a9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273891, "uuid": "b5897470-afdc-46d3-b0e0-5937e4cc786a", "comment": "Malware payload (Mirai)", "value": "1a9fd5bf5738493cf08b81dd7c81a51b510615e1f4491360fce114eeeb377303", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273891, "uuid": "9a6f7e40-c749-410c-a114-31fdb3ad8a85", "comment": "Malware payload (Mirai)", "value": "fdf744eefc61a15bfc702a6d0677f4c8221f23b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273891, "uuid": "df8fbd05-519e-40df-86ad-ff3d9969d1ad", "comment": "Malware payload (Mirai)", "value": "4a0e380fdf09237dbc49aa58791eb3e41f85e8d69d3815707a10f663842e275bd544199a4461b67d27896904a18519f7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273891, "uuid": "ff2c82e1-1170-494d-8640-bb49829a28ae", "value": "T1826308C6F401CE7DF84BD73708574E086571B2D14AD30B2657A7BAABBD32159783AC82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273891, "uuid": "6618a496-b055-4439-932e-f0a84b180e53", "value": "1536:x2jweG1N84ran3x8PIzbQeuacWjcW0JcWcBlnNg2ri5vfyAA2BNz:xAD4raLbQeuacWjcW0JcWcBVNg2yyANv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711273891, "uuid": "62a0cf6e-108c-483e-9203-575f301eaad5", "value": 73060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711273891, "uuid": "f4d8e6e8-f264-48ee-b67a-ce2183089d08", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273891, "uuid": "156cd536-7a96-4250-8c78-c25376c23b48", "value": "fa0a8133657732c521f4971b10d713a9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614199de-ea14-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711308374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711308374, "uuid": "dbd9c645-23c5-457e-923c-ebc7bf03ba17", "comment": "Malware payload", "value": "c9ca90d22eb6cc4e51652ae2d9cefc08", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711308374, "uuid": "a48f0b4b-8188-499d-b64f-2f8b01321aab", "comment": "Malware payload", "value": "1abfdf2c8f719ed98c7054aecc6ab4f40195c425538b9638324d958057743530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711308374, "uuid": "2047f433-c733-431f-a567-1a16a008e42f", "comment": "Malware payload", "value": "df04ed1048908e133a5e41b1aef7d9bb5eeaa2ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711308374, "uuid": "4ee864ad-ac42-45f4-8107-80fe0c552b41", "comment": "Malware payload", "value": "199505df0fbeb7b08d6452b4b6e0b0d50f67af94e45042a39b1b6f095c9ed418ce17dc69c9c9a1a98b464539f685e751", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711308374, "uuid": "e3a45416-98c8-4707-84c4-e19b104f5936", "value": "T19F241221F33F86B6D3994BBDF4D89A8003BAC30CE023E69EBC8E53191A52765C797545", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711308374, "uuid": "7ee1d379-e3f3-422b-9411-e786dac7457a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711308374, "uuid": "99b5d912-eed3-48cc-9a59-15c8abb582be", "value": "3072:iTpZlk+914GUZ3lHN5qOsjXttDvon47nAUtZUQp1ATSbTdT+YDUYoljdUpF:upIdLZ3lvrsjXtmng1kQRTdaYsljQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711308374, "uuid": "d81a2d2a-dba6-4d04-aeed-ca044b0363ad", "value": 229376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711308374, "uuid": "b55b1e67-65bf-4017-aa0f-39ffc286d2e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711308374, "uuid": "2ea565d5-7ba0-402c-a41c-bf3dba74d009", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb9a1fa-e9db-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711283971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283971, "uuid": "724b7e58-9d6d-4073-aff8-0c0c4ec68cdd", "comment": "Malware payload", "value": "f8cad25e19965dc3e550857dc8f69f3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283971, "uuid": "2472b9b3-f6b5-4f78-8638-d9e91d833e14", "comment": "Malware payload", "value": "1c82457d6cc05d33ad8c11dfe7046ea1e51eaa6276138c7fc3e4ca63ce3b7ec3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283971, "uuid": "3d08fd5a-f87d-44ff-b992-2f28347f5c43", "comment": "Malware payload", "value": "eeaa1fc341a4a8b187db768ef75220441f3da675", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283971, "uuid": "4ae8c21f-3b52-4ae7-804f-fc7cb4e76782", "comment": "Malware payload", "value": "cf16fbfd3f1f0017c6e3b7df9ecb2d1b169dd39dfc1e7a721127f24135d122e9cb7a949f644277f36eb0840079c4c91a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283971, "uuid": "05d91149-a0db-41cf-8125-e6b56fa5ceb6", "value": "T15995CE82949E483BFBF46634FA8C80D54B12DC1E1939A31C5F89FD193678CBD59E84AC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283971, "uuid": "0e625eb5-9713-4ce4-939f-96875b556116", "value": "fe5fb373dbec3ba73ffb51335d1fc086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283971, "uuid": "30dfe7ef-a6d4-44f1-a93a-1f272c9cc5f2", "value": "49152:J1OOKgkBsWP5UXpv4k6rKRDTvhkIkpV9SIvkV8vhUm8Hlb1/a19gjmj:J1ZNKe54k6avvhkIAV9S3qvhUrHm19gA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711283971, "uuid": "6ae9336d-e603-4663-9299-0e20097c732f", "value": 1965328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711283971, "uuid": "fe2ba715-4065-43dd-b428-bbfdc7815e64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283971, "uuid": "b896f690-56c9-4d3a-9f79-07d35ec89e7e", "value": "SecuriteInfo.com.Trojan.GenericKD.72085450.6282.4577", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60503096-e974-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711239653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239653, "uuid": "d32c13ec-3918-48e8-a71c-c48d1eaab792", "comment": "Malware payload (Mirai)", "value": "48e9b98307f920e16b9bf3b6027ec797", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239653, "uuid": "86965aa4-67b5-4903-b114-2e6fbe3a0897", "comment": "Malware payload (Mirai)", "value": "1cff10813dd78e9fe51c7644c842a8c971fba6744df63a72ee53aa6b58bd0b2e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239653, "uuid": "be4f98a0-3f4e-4fb4-bd1a-de325c7fc885", "comment": "Malware payload (Mirai)", "value": "5d002fc9eed5a341fe7fa44f0aeff3e4c3a288e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239653, "uuid": "e2575c75-21fc-4a28-9ca3-5e234af51b03", "comment": "Malware payload (Mirai)", "value": "4d76fdbf38b2907bcfb2e7a0d5c7e501476ecaead62f62ad81e14a4501e01af717d186435136dfb5c836e4a22a9fd0e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239653, "uuid": "b552da29-76fa-4aba-948b-6ed23d81101f", "value": "T1AF833B02B31A4967C14B1DF02EEB67F187A6BCD016B26104A62DFFD867737B15482F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239653, "uuid": "8682d219-22f1-473d-b83a-0a732954a4d1", "value": "1536:uUiUzx/nYSCwhjmrmUKaBabj1HemDE2ir/z/FsSSmBpbpxzSQt:FiM/n19hjs1g+mYrzemPbp9pt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711239653, "uuid": "b807e4d7-0fea-42bb-8ac4-925262c4b879", "value": 81580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711239653, "uuid": "b592b517-d1b3-4451-b9be-a1ee830d4863", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239653, "uuid": "8861d873-b065-453d-b7b5-51be82b53419", "value": "48e9b98307f920e16b9bf3b6027ec797", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06aaae9e-e9b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1711265702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265702, "uuid": "6c34f58f-b371-47cc-886f-0236ca877900", "comment": "Malware payload (Smoke Loader)", "value": "ceaa361db12c482e95a8b83e2de2af2f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265702, "uuid": "785090f0-9413-40fa-ac29-da5f56a03562", "comment": "Malware payload (Smoke Loader)", "value": "1efbc80ffd55c78287134a11add66b10bf7b2cd724913721a7f305d483050593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265702, "uuid": "9b9d1ecf-f519-401e-8389-7394da1cd989", "comment": "Malware payload (Smoke Loader)", "value": "7288d4cfcea6a4e478354bb15f06d3af82ec9cfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265702, "uuid": "9c9f1381-9428-48ad-9722-424afeb4d1cf", "comment": "Malware payload (Smoke Loader)", "value": "2b1f255e35c6066584e9579fed92d8b45d37443d0abe131b04d3a72c5fa6ef2bd157bfb1ce843f010d7a81108dc53b5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265702, "uuid": "94796ff3-0a19-4849-a5a1-eca481405f8d", "value": "T113648D03B2E1EC60F56647324D2DC6E4223EFD724E696B5733587B2F18701A2C563B6A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265702, "uuid": "aba7694e-082e-4614-b0a6-707a56c64949", "value": "0be152bdfc9ef291ebc79442873fbb26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265702, "uuid": "e4ba2244-07bc-4a6e-8b70-7d8939b6535a", "value": "3072:ZQzJkBHCgU0lpcWt+sNX2VYXSjNr6gYatNEnZnKZI6DOZWCwbUcP1KS:EkBPmWtt2rZYzyI6DOUCwb1Pw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265702, "uuid": "285111d3-66cc-44a3-964e-ae78dde84e9e", "value": 310784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265702, "uuid": "43a73234-8364-4365-9683-46e74339e5cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265702, "uuid": "ff252cd5-13bd-4ae7-b7f6-e9c480d4a07d", "value": "ceaa361db12c482e95a8b83e2de2af2f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c61d11ee-ea0e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711305966, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305966, "uuid": "12571700-2300-461e-85c9-c571a2ebb687", "comment": "Malware payload (Mirai)", "value": "a75f5e48b7b51b4167db90dabdfb5056", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305966, "uuid": "94a7a6f4-6a0c-4c10-8cea-e3b47adc1ee4", "comment": "Malware payload (Mirai)", "value": "217e269596b960561cfe173f0123fdafbc5812233525145239e1208ca89ba45a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305966, "uuid": "dc1cb641-9077-460e-84f3-c5c5f7250e24", "comment": "Malware payload (Mirai)", "value": "e04a111ef1af2481650cb6c139ba30508b6bdb9a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305966, "uuid": "7e132873-a7cb-43a5-8871-1dc0aaabf22c", "comment": "Malware payload (Mirai)", "value": "d26b81a4a0d697a042e6c7db477c437f6fd2871ca36772bd95718bfa0dc316a231a9734a999138f491a03ddb75412a58", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305966, "uuid": "5b6831f4-b28e-4479-8d52-af1256e40551", "value": "T18B13F895F881472BC2E0137AB66E5A8C3721B7E8C2CF7217DD656B207AC550F1D26F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305966, "uuid": "aa4a9d5d-8d47-47ee-b29f-d280d5133951", "value": "768:aVpTGNxXvnkG5rvpLh+JdtIymOxIUG8AFgu91pLMGyGrKgZS+M0Yp+o6c/NxwW5x:aVNAXvkG5rn6dtPx+F1wxGr9bY9MW5gC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711305966, "uuid": "9bd458ea-67a8-4617-aaa0-e533dbf5d86d", "value": 42460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711305966, "uuid": "7786b913-d774-4ea1-9e8c-4008d5611f2d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305966, "uuid": "1c21d3e9-b2a2-4a3e-a6a8-1c7f2305fdd3", "value": "bot.arm5-20240324-1846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1eff0438-e9f9-11ee-a120-42010a9c002e", "comment": "Malware payload (Glupteba)", "timestamp": 1711296667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711296667, "uuid": "59f2804c-4f8d-409e-b9ef-e7aa27a812a9", "comment": "Malware payload (Glupteba)", "value": "3c47cbe580bf6ba719bcff1aeaa56ea0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711296667, "uuid": "cf6fd8b9-319e-4465-90b4-e6dcf39564f4", "comment": "Malware payload (Glupteba)", "value": "245baaa35e80f5112045326002260255ea9900f20e7220c7c01b4b03691900d1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711296667, "uuid": "1943d701-f983-4030-b94b-24718721edb7", "comment": "Malware payload (Glupteba)", "value": "2d04deb267611cf6dc1f645baa5a5d95aa7a305e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711296667, "uuid": "33a23564-d01c-48fb-8563-a1ac26e7ae16", "comment": "Malware payload (Glupteba)", "value": "934a9b5759f0f3a8227ca34bf520b1463c83f7777144d750c9c6f18a78bb2561ceafb4b5b75c10bba17afda870ed9e81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711296667, "uuid": "8b7ae767-4bab-4a71-8b9b-c5f9cc3e6349", "value": "T1C616330173F1BCB4F79A4B332B2EC595212EF9608F68572B372C966A15B62F0D032765", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711296667, "uuid": "57484e29-a653-491b-a7a1-59aca5a0305f", "value": "db1079e388771b4efc3e54111e236b79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711296667, "uuid": "0fcc7a78-ac1e-4508-9186-464459c0748a", "value": "98304:saY0cmxjcqWMsnlrzLKfBHQh8exR3zxU9Do5oJUT0Dic:9cgjcqWMglzLo5T79vJwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711296667, "uuid": "1c473483-ca5b-43df-a4b0-8fa9173af40d", "value": 4380552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711296667, "uuid": "4aabaae7-1ac6-421e-a4f8-8914764d24e8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711296667, "uuid": "a42dbd1d-91af-49d6-ad62-467ee35091b1", "value": "3c47cbe580bf6ba719bcff1aeaa56ea0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93534895-e986-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711247470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247470, "uuid": "8db7e155-c65a-4104-aff6-14e6839ed859", "comment": "Malware payload", "value": "043698a7e93908f54427f2a2893f7166", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247470, "uuid": "b042292d-6152-423c-877c-3e92ddfea190", "comment": "Malware payload", "value": "2468b93c37f68548143120c8c095e2f3bbb634f823478662d351711560f13c0e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247470, "uuid": "e18a6ced-2d46-46fd-a37b-319d81711d43", "comment": "Malware payload", "value": "699db30bd536919691623ed4b5d7ae7da640e0f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247470, "uuid": "d5bd597f-b308-4408-ad68-e990591e738b", "comment": "Malware payload", "value": "b1e22651b3d1136fe5bc92018c33993c45f582604c4fdcc8f3ad62f0bc6823860691b1dafe7256852a1e5fe13b10e1ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247470, "uuid": "65b10432-4cb2-4496-80fc-e7db57f83f16", "value": "T1D4A5E146F2856D86C11B4230E4A3A344763BDF82A5C28F0624E9359479F329B7877DEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247470, "uuid": "ffb44439-cee6-476a-aaf1-3693a6555d96", "value": "fe5fb373dbec3ba73ffb51335d1fc086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247470, "uuid": "f3f6f01c-f85f-4110-8779-4ea58a563800", "value": "49152:9BfcrX/RsJz14hEyFgXp3GeWhN72XZWYPP4:9BfcrXpY14hENG/hoEYH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711247470, "uuid": "828d9012-b888-4883-a5c7-4139684d65af", "value": 2117896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711247470, "uuid": "c627d9e4-b69b-4313-a016-d863c7b3523a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247470, "uuid": "7451d7a3-8c90-4ccc-bbaa-4cf5389eb045", "value": "SecuriteInfo.com.Trojan.GenericKD.72085525.18519.19311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823ea36a-e9ec-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711291250, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291250, "uuid": "95febad1-66a0-4599-a36e-2041ba846e0e", "comment": "Malware payload", "value": "7e63079e0b4854f06e995dec4a2bd6f5", "object_relation": "md5", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291250, "uuid": "9d114e83-7338-4fec-b346-02960e10be11", "comment": "Malware payload", "value": "25528eb8e9d0c6179daf8520ead60210525458a509dc643159b4621ebee82628", "object_relation": "sha256", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291250, "uuid": "528bffd4-246d-47ad-9d11-37b477234aa9", "comment": "Malware payload", "value": "fccc487f3d8f78cd417a94166a56ed374d51716f", "object_relation": "sha1", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291250, "uuid": "c03e066d-0930-44f9-9604-cd2a4ebb6e2d", "comment": "Malware payload", "value": "1c953a27a598d12a875f1b9f7ab7d11834b092aae40207994e16b7057a0ba7fcd244c02377ba902933ff576110e8a6fe", "object_relation": "sha3-384", "Tag": [ { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291250, "uuid": "311d14e8-fb5f-4259-9aec-362b12523ce1", "value": "T1FA517CC341E37A0B13189B53A6179FA48B45A04714FC6C03303CABF9586E2E2C209CCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291250, "uuid": "3bef3bd4-e49c-432c-9a19-2076832502ac", "value": "48:Na+9GvXhPg6FvoHTfnjul8pc/UQgmRsXIrqqMDW8PiRH0IfxvEmFerCD:J9Ch46FUc8pKUfmgoqWIiRH0O7Fes", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291250, "uuid": "6dcba639-5802-4d84-8e13-fdbc22147511", "value": 2612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291250, "uuid": "2fd46966-9353-4da2-813e-2b804e9d750b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291250, "uuid": "27c6fba3-b344-4029-85ff-f2f15730a387", "value": "nComprobante_de.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b8fbb3a-e9aa-11ee-a120-42010a9c002e", "comment": "Malware payload (GootLoader)", "timestamp": 1711262784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711262784, "uuid": "bb4f09c6-e212-4eb0-a4fb-f29dccd3cbb2", "comment": "Malware payload (GootLoader)", "value": "12a998e2db6376b5e2734b9c95d765be", "object_relation": "md5", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711262784, "uuid": "975729b2-820a-4913-94aa-a6744c08d3eb", "comment": "Malware payload (GootLoader)", "value": "29ac4c5b8a848e6545891539db188cbfba8ac3dd25c04fe9ab1c1f6ffb7c2a02", "object_relation": "sha256", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711262784, "uuid": "384acc15-c726-4ceb-955b-e62573b93a05", "comment": "Malware payload (GootLoader)", "value": "b13a9c7e213b88848c7971f1b3c975c7d9507682", "object_relation": "sha1", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711262784, "uuid": "e587fa8d-eda6-45be-8d70-dbd3f7a1856c", "comment": "Malware payload (GootLoader)", "value": "419e939fe929264f41c48213b8f09ce6740768b82f95becf0a9e2f28588434304827b987bb0b176c1160556cc3e861c1", "object_relation": "sha3-384", "Tag": [ { "name": "GootLoader", "colour": "#9156D9", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711262784, "uuid": "2ee3ab46-e7f4-4349-8885-c01da7671c5c", "value": "T1C437B20DAEF71091A923317C8FAF640AB6748017190ADD143D8DA3945FA953867FEFE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711262784, "uuid": "fe136c46-8de7-4c92-a0df-24eb85cf7541", "value": "49152:j7sbzjCxbTqHlp43s8N0IThB415zlYzYBuO++8yMY3Q5/CWNGgEx3quAQ8gKcEBH:d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711262784, "uuid": "edea25e1-8b03-4688-ab54-53673440d362", "value": 23601919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711262784, "uuid": "bebe7e72-4b26-4d15-83b7-afc673612192", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711262784, "uuid": "b1896c96-89d9-419d-9c16-9571558c95b5", "value": "file.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71a7ff1f-e9e2-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711286927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711286927, "uuid": "da682df7-0b1f-4bdc-860c-ea99bd0093f2", "comment": "Malware payload", "value": "53b24021951970401453b13371f4dd8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711286927, "uuid": "5cb80426-8d48-4600-9109-660d15d71bce", "comment": "Malware payload", "value": "2c8b8292b49d6c10930824d9695863b9c624805cae7cdd20d87d8e58d29169bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711286927, "uuid": "d9b36749-3f04-4c38-84a3-26e0d96e5ba9", "comment": "Malware payload", "value": "2695bdf101e77c35d9ebe03b33d183ee2950e2f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711286927, "uuid": "45c9a98e-9012-40cc-b6b9-8fd801beb2f8", "comment": "Malware payload", "value": "79d0dd880e06fc24e1930f91a75d2f74f7c3db13951a7202e7ed801aea96b97674c02e7a860280bf8fbac9e887712ead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711286927, "uuid": "d746a5ad-b9c8-4a17-a868-a33010591134", "value": "T13EE538C2B291C8FDF10960B0E4D6DE66D6F379FC13F440D366D85A1A5A222D17A3928F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711286927, "uuid": "e580de3b-7761-420e-9476-4335aa0b448e", "value": "2858cc327ee0ec46ccd7e4a18399aeb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711286927, "uuid": "1045ed7d-cade-4923-a34e-dc7be956602e", "value": "49152:0QibjaK8r+z4kAtw2QpsuHSp4ul/yow7zWYNc:0QibjaK8r+ck2KseNu0+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711286927, "uuid": "cf739c7c-8bc0-4d5f-b6f6-7cb0264d07d3", "value": 3141632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711286927, "uuid": "ffe1b17e-3dfc-41b5-823a-11dad09da21a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711286927, "uuid": "321e4299-abe9-4d3a-a329-a6524bf36021", "value": "SecuriteInfo.com.Heur.22714.21324", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4002be88-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268805, "uuid": "01885e41-fd62-4717-946c-6cf2cfba2a08", "comment": "Malware payload", "value": "6980227efbe5d9d6274624eb10e930b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268805, "uuid": "36d0aae9-d11d-4a99-9eea-25e6470f7dc2", "comment": "Malware payload", "value": "2d351c3921e17f2fd345c4888d93e0a44e80cb27f23ec1597f8fbbc57c21e923", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268805, "uuid": "7d2096f3-dda2-4fe7-a76c-b7153fcb1d3d", "comment": "Malware payload", "value": "a25b1c0dc32e34f997ba7d6c031e1a8b1fc06e09", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268805, "uuid": "43d4a99d-8d61-4cc4-a8f0-1cdacebee14c", "comment": "Malware payload", "value": "adfbb2766a2b1016045572e3c7e2e5e70ef74fc94994e97fe07d954e06f3e72139b5fd6f6e647b53b591599d12574834", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268805, "uuid": "a5685e0f-53e7-408d-87e5-85a37f6f2db2", "value": "T11FE29F47EB1C9C42FA026D3017A1D6462F7D1B633B4181D3AA36FDC37B607892DA54B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268805, "uuid": "c9f088d9-539b-4b34-b49d-40adc4b3612c", "value": "2ce3a028f67b8cd50455db6ac7115c66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268805, "uuid": "72f27886-0c88-45c6-8d0e-1fbb68dc8a04", "value": "384:xhQG0iyzFVsM8KKEQAN+a/hQRwxtX8P7k+zyQQgGnQN65duah9nXQXUXVPr/paq5:IG0JzNGa/hQAX8zBQgGgYduiVZ7paqI2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268805, "uuid": "d6813863-3ac2-4196-9d50-f670a0473e0f", "value": 33848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268805, "uuid": "174fd449-1b19-4aec-9679-364095747824", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268805, "uuid": "c3a8baed-cfc6-49a2-8ec1-c3ab6d756109", "value": "SecuriteInfo.com.Unwanted-Program.00587b831.15231.29948", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50722db-e974-11ee-a120-42010a9c002e", "comment": "Malware payload (Anubis)", "timestamp": 1711239849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239849, "uuid": "dd9c5572-138f-4e08-aff5-3eef1f9e29f4", "comment": "Malware payload (Anubis)", "value": "12bd9dce0c25eef1cfb47a35d998a179", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239849, "uuid": "89728476-f32a-495f-ae5f-280c39df8c78", "comment": "Malware payload (Anubis)", "value": "30b0b3b0d4733f3b94517ab4e407214e82abf6aad3adf918717ff842e28d672f", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239849, "uuid": "41a2bf6c-625e-430b-abdc-f7d9314dabb6", "comment": "Malware payload (Anubis)", "value": "3067221875ac9093d0b2efbff4c2fd6e1616cd8c", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239849, "uuid": "4488f1aa-bb18-431f-b2e7-82f3ef091d23", "comment": "Malware payload (Anubis)", "value": "5623dcc04821ded292ab870f091249be4c4a0dabbb61d585264b8e2d3cc40e9d86ec5af149e8d9dc81be1777a6066c0f", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239849, "uuid": "0a5225ba-375f-427e-80df-089796d1359e", "value": "T1FEF50292F7C9E86FFCF7C7368B75865E46468C168B47E2834954323D09B79C04A86EC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239849, "uuid": "9622b4d9-d1b7-46bc-8cac-2c9e9beb0e5f", "value": "49152:RPY4HEHIyICHVBwr+ItQlZ+0VxSUe8cQiF/C1TCbKopU7VoJhR4B4IXOIquUDPt5:VDHKIy9oIggzAC1+Qi/+OIqRDrkjnK3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711239849, "uuid": "0880b215-520b-490f-aba0-16974e0ecdb1", "value": 3437887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711239849, "uuid": "863d584a-3aeb-4eb1-94b5-9a6fd601e0ac", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239849, "uuid": "9ec3fad8-1229-4aae-b5d0-280bb25e0879", "value": "30b0b3b0d4733f3b94517ab4e407214e82abf6aad3adf918717ff842e28d672f.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "449af6c6-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268812, "uuid": "b2054059-c7a2-49fe-9caa-9977dc31ac7f", "comment": "Malware payload", "value": "97bd3d9816410b54186241690570ea28", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268812, "uuid": "bab8a9a9-c202-46d4-bfd3-dd46f02a4097", "comment": "Malware payload", "value": "3234c53ead052ba5b32c84c5ed125813718b25686be066bc4141d9d6fa9d0bcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268812, "uuid": "8a95c1ee-e89b-4e90-a330-d1a281afbb3a", "comment": "Malware payload", "value": "5067bf6216fc1580145073a88516603971a1b447", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268812, "uuid": "b3deb40d-56e4-4388-9825-036821eeb198", "comment": "Malware payload", "value": "dab09739e9ed7d3e685de3f3d1aeb9560a4e8c1c4b80cde40f81201bc6fa4b3ef451b7c499beb9f11caf7b012a73063f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268812, "uuid": "485a8d28-8b68-496d-84c3-9c8e9ee737c1", "value": "T13A45F112BB92D076C26631314E96E37966A9AD709F210783BBD07F3D1E341E1A93D30E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268812, "uuid": "78bef899-5bdd-42b2-a173-5aa3211a4471", "value": "656e4782cc18931342281e8311ff00f5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268812, "uuid": "df63eaa8-ea87-42a1-bd29-ed16d3756108", "value": "24576:acN3Kif0pDkdepzrJSyVCF4XEtDuKv57rStMx0MQ23l5UX:N3/f0tmeVrJB6kgEtMyXIly", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268812, "uuid": "407d3047-105b-48d2-be1a-829203a33d1d", "value": 1167360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268812, "uuid": "64517642-e9ca-4fd5-bbdb-87d11787c78c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268812, "uuid": "49d397ff-3894-4007-a4d7-8cfbfa038a52", "value": "SecuriteInfo.com.Variant.Application.Bundler.YouXun.5.21355.32197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3c8e07b-ea12-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711307707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307707, "uuid": "59c3d0fd-e060-48a8-8c23-aba595ee71c8", "comment": "Malware payload (RedLineStealer)", "value": "34468074c946943518ab33be24c01ef9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307707, "uuid": "f43f7853-5269-40ff-9427-a665ca8259bb", "comment": "Malware payload (RedLineStealer)", "value": "339f7bd2b39364138d088ddd6cfc4541b6c18da0f24315388bcf80af0ee3ac99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307707, "uuid": "9663b13e-0a85-49cc-9099-b3647b164564", "comment": "Malware payload (RedLineStealer)", "value": "742cf7ff13dcab6a99b372dc99f362f45be3d69c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307707, "uuid": "4e7a643a-8f5c-4945-a04b-5a44d1c651d1", "comment": "Malware payload (RedLineStealer)", "value": "bf4435a84d64ba68dc2deb56f88951edad12bf4c03b015492c47d07cd73bfb5344e19dc8ce75d8688a11c43090e3ee55", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307707, "uuid": "812e3c31-e1b2-4f73-88a5-3822dacc5848", "value": "T11EA4C022B2E27C50F56787324D2D86D8262FF9F38E256B6B33585A0F14712E1D673B12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307707, "uuid": "b9f1d14f-8cc8-4c75-97f4-fda539ffbd40", "value": "632c0082677b53886d85a93e74f074ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307707, "uuid": "57aed289-34d0-453e-9b10-a0b2c44bcb6c", "value": "6144:9qIH8p8GgMyYRhuPTMCGzlmJDZWgECsFjKdJtH3s5ZBjnA:9d8p8GgAWP4CYE4BCsmdJFij0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711307707, "uuid": "5bb4d616-a260-420f-816d-278a25dae29c", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711307707, "uuid": "f86fd4d5-d780-4ebc-876d-0652cf0f477b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307707, "uuid": "c7cd39e2-fd4b-4df3-84de-5ea406af2a15", "value": "34468074c946943518ab33be24c01ef9.bin.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a961501-ea30-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711320416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711320416, "uuid": "a183f48a-8fca-4ee7-b6eb-39a0a5d34258", "comment": "Malware payload", "value": "dcb5f7a58f8952ce3186aeb620f3bdb4", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711320416, "uuid": "0d594a7b-2044-43db-99e9-23fad8e126a9", "comment": "Malware payload", "value": "36567ff084c6b61f3c428300ff760b89bc7b54cca449b5d182bede9f6733590a", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711320416, "uuid": "e9e2b8f4-ce14-4bab-b53c-9679f0f309dc", "comment": "Malware payload", "value": "6570abaa6a3c93737733754bde4844bdc0d84e31", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711320416, "uuid": "d98e317e-4f5f-43a0-82f4-6408330d64dc", "comment": "Malware payload", "value": "16c719ce65f29dfb1169f54bc0a7f0f895efcd90d22da0bd5eab382cb90cdbd5a264ea701059fcaa9b9edd970dd98b0b", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "electron", "colour": "#0E2A60", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mauqes", "colour": "#3BF91D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711320416, "uuid": "27c32175-0ab3-406f-9a8a-eef0e312a1d0", "value": "T1D4183311E1BD6468FC9A6ABFC1638CC95682360D9E06F9DDC35F4873C9BAAD010D85CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711320416, "uuid": "b9a90577-3bcd-49b3-aaf2-b066c63b417b", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711320416, "uuid": "79daaf1a-a499-44e6-90ea-74d5a6d97285", "value": "1572864:B/WHHr9a1EDPtraubd7GHKqOMVhoOP0F218/s0H6UcQ7QAT+rd7ND6hJx7uw27:B/8L9a16aubdqHKqzIOMhsrUD1Ng7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711320416, "uuid": "324b5f73-fbd4-4d28-b53f-5890cbac9c7f", "value": 85388454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711320416, "uuid": "eb14c6d8-b045-4dd2-9523-2a236631929b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711320416, "uuid": "5525aefc-d747-4e4e-b539-90e4431d9c48", "value": "Mauqes.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d37967-ea12-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711307709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307709, "uuid": "9094fb8b-3726-4d2a-a677-dcded903c33d", "comment": "Malware payload (RedLineStealer)", "value": "ef4b0d33ed0eb8ec64c7073ea8409cad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307709, "uuid": "c49d9d77-f333-4252-8cb5-fba4ac08e028", "comment": "Malware payload (RedLineStealer)", "value": "37c593afa2791249363f27cb2818fe560338c9abdfb2b270b26a88696a87c3e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307709, "uuid": "e12e15ce-4863-47f9-83e5-b781da3535ec", "comment": "Malware payload (RedLineStealer)", "value": "b3c1b0b7e282a26bcc4ddb84cfac0437e3cff209", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307709, "uuid": "03a8a2e7-5ed6-4bcf-be53-16e913c66403", "comment": "Malware payload (RedLineStealer)", "value": "7aefc377308075344256132826fc80d0fff2a6782959b808b6ca9ad0b77380efc95b8a5ff0bb0e753502f5e04902f8c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307709, "uuid": "0d889b60-c3be-46bc-9859-1be35f610395", "value": "T1FDA4C00272E2BC60F57687324E29C9D8677EF9F38D667B2B23589A1F14B10A1C673711", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307709, "uuid": "24df89de-8e25-42c8-b6a9-149395d7b270", "value": "632c0082677b53886d85a93e74f074ee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307709, "uuid": "5393ae53-d027-4b39-952a-c4ba793aabb6", "value": "6144:Bh7X83nIRrTE2aRAglvla7noWKfsTGnlwa0rNO94Acf546oZEM:BNX83nIRrWflNMoRfdD0ro9Eh4PV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711307709, "uuid": "00e895f9-6e05-4f6d-a6ef-23df665d2758", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711307709, "uuid": "bedb24c1-d1e0-406f-b48e-e7ab994b6ae4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307709, "uuid": "900f533b-5f13-4321-b727-8729e98872f9", "value": "37c593afa2791249363f27cb2818fe560338c9abdfb2b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0633667a-e9c4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711273862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273862, "uuid": "abba433a-1618-400a-838d-bca966eb506e", "comment": "Malware payload (Mirai)", "value": "2de0d0efab4d7599533fd33d21c5ab27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273862, "uuid": "44305c6d-61df-4703-905d-5cf5fbabc7a6", "comment": "Malware payload (Mirai)", "value": "3aab5141c5ebe903129303ebc35dd6d181c34f899ecd62fff98f7ca1d1e974ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273862, "uuid": "a83602f3-a26e-4d99-93d2-d183a9d0599d", "comment": "Malware payload (Mirai)", "value": "95517de462f78dbd35211474273204c8a2e93415", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273862, "uuid": "3afab5dd-e3d1-4b80-9922-c727773f2445", "comment": "Malware payload (Mirai)", "value": "0f278ec85068f303f6bb366237be78738cffdea532a8e21bc45516d2779e336a49ca60c22c8a76273f379755f6f7f639", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273862, "uuid": "0064ce20-3382-47b8-bb8b-8e0962176307", "value": "T1F4B3615AAE109B28F69C973147FBAD24835A23E32AE5D54AD19FC5001E3131E6C0FFB5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273862, "uuid": "2c96bcac-dd0d-4288-97ea-a9b620fc6acf", "value": "3072:1xPGVHVnig10jCBwgrUHwtNJ0F2jcuoZ3Fb1lwWT:1xPGVBig10jCBwgrUEYFb1lwWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711273862, "uuid": "608d3320-1410-4b7f-b83a-9cb2b22cf35e", "value": 115148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711273862, "uuid": "2d26beb2-57f6-466a-9102-2ad1298e08bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273862, "uuid": "d3a949b5-05d2-4250-9309-c40b56996217", "value": "2de0d0efab4d7599533fd33d21c5ab27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3637fae-ea0c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711305076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305076, "uuid": "0a5ff3ac-71f6-403d-8f5b-5a58bb1cddc6", "comment": "Malware payload", "value": "99127ae3b7a20e6eab2fb53d82dbe4c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305076, "uuid": "285fb99d-a0ab-4f7e-b3c0-601e3291e249", "comment": "Malware payload", "value": "3ab32b42ce04399f90babb655d4e60eef91590182fe5fbb9b5004322e741a7de", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305076, "uuid": "456ecb04-0978-4a6d-a69d-eda3be5a1548", "comment": "Malware payload", "value": "792e93f77caa353b8f1118b2c15f43534b73fae6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305076, "uuid": "3722c635-c9a1-4aaf-b36b-87441030c634", "comment": "Malware payload", "value": "cb438f7d2a20204df49e31968719c079805d8aaef93a0ec395cee4fa596396bf7ff21177b1c54d893293504728abd99b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305076, "uuid": "f4a18ae4-fc34-47d9-8885-d48a539cc2a1", "value": "T13C853366FA29AE21F79FCE7EA2C8535034C2E2E14D4458F0FBD5E80A61758B51BE034D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305076, "uuid": "47a0dded-713c-414d-abad-2989451d657f", "value": "6ed4f5f04d62b18d96b26d6db7c18840", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305076, "uuid": "01c23eb7-0867-4e8f-a8a3-4401b1b50b17", "value": "49152:o5Cr5baJF1sdEu3CF2yujs9cc2gfnr6sqokO6q:oKaJ/sSX20P2iwO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711305076, "uuid": "be43ef78-186e-407d-9774-71991216b35c", "value": 1825792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711305076, "uuid": "0cb6de88-f509-4514-8b12-2bc7c5e01502", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305076, "uuid": "2bf54f60-824f-494e-88f4-611c0f12a789", "value": "SecuriteInfo.com.Trojan.GenericKD.50490841.8029.29679", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7162c6a-ea0e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711305995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305995, "uuid": "6b6a160c-bad1-40d1-b14a-2699d8df2827", "comment": "Malware payload (Mirai)", "value": "ca1352e14af7e0cb2cac20efa876126c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305995, "uuid": "69ba048f-b300-4aa5-9050-2f57ef36f3b5", "comment": "Malware payload (Mirai)", "value": "3b14ef9f21049cbdaf8f65f5a5cd6ae9406f8c9e92ebd2effa925fdc6cf2cb12", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305995, "uuid": "1ce36581-0376-4f93-8867-d0be291239c8", "comment": "Malware payload (Mirai)", "value": "46ceb1fe877f6c845efa309d0351a6fbd22cf1a4", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305995, "uuid": "40302b4b-f1b6-429f-a964-158e7b569870", "comment": "Malware payload (Mirai)", "value": "571c72ec9b2a47c5f67c41fec0816dc47a22883cc675ba9455b615d61a84c562d80bcd1f26e6e9d9a1355ab83be2349c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305995, "uuid": "c6b88b2a-1585-4a30-a7f8-03c7c9d78b9f", "value": "T15B93E516BB110FFBDC6BCD374AE90B0134CD594A22A97B363634D828F64B24B59E3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305995, "uuid": "de8199b0-aca8-46c9-a4ca-22806539d3bc", "value": "1536:Pz3yEj8flIqGWcblm71E1orB8t22RiR/Z0wgnrIBZH22bbYcDBoW5c9KN:P2EjwmxiEqlW22RiRR0wgnEBwiGock", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711305995, "uuid": "42ceb8ae-373e-4067-809e-5dd7ed23900b", "value": 89668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711305995, "uuid": "0d565564-e856-499f-acf0-4d6a2688a259", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305995, "uuid": "e7fda8a3-f855-4c5a-99fc-5f39c21f9aea", "value": "bot.mpsl-20240324-1846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0f29ccc-e97a-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1711242446, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242446, "uuid": "bb283668-7c79-453a-83af-fea2be36551d", "comment": "Malware payload (QuasarRAT)", "value": "f07bada4320fae092a7353f47b4e3183", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242446, "uuid": "8a65624d-0bd6-42f4-8836-a49c51e6676a", "comment": "Malware payload (QuasarRAT)", "value": "3c3b47e05f6960d1fdf233949ba2881dd32341ea84240ce3e9b59f0d29ec9fa7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242446, "uuid": "5f9cd09d-638f-4850-b2a9-98d0dac78383", "comment": "Malware payload (QuasarRAT)", "value": "046b3e26e91f8c261b2c4de34831a4bbeaf7fab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242446, "uuid": "15a36d7a-f41d-41fa-9ad3-79a15005ed94", "comment": "Malware payload (QuasarRAT)", "value": "64b94a20680cb0b79624665e622b10569bbff6a4d717eb28037c0315768c707ffc8c463a9de1073bf2781bbc4e251619", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "POL", "colour": "#244A04", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242446, "uuid": "c2db6aed-3df7-471f-8b95-4e90cf3d5773", "value": "T1F3749C577798E93BD1FE173AF03246044BB5D407BA12F38B5A6854B96D233868D823B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242446, "uuid": "dbaa8387-edba-4504-acdc-f8b58336f113", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242446, "uuid": "5247010c-0ea8-456c-a16f-7fe07ae50222", "value": "6144:VjNHXf500MPTrfOfVPfVdANHibPkBZDlr0ALSGxG:Zd50tr1NPrr0ALSGxG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711242446, "uuid": "059327e3-5037-405f-b5bf-98dca1e0436f", "value": 356352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711242446, "uuid": "541a7ed4-4c34-4e73-9290-bf92eb023133", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242446, "uuid": "acc812cb-ebd4-4699-a4cc-ac72b73fb674", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974ece34-e988-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1711248335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711248335, "uuid": "d3e18259-1906-4020-9f14-4dc5024ad339", "comment": "Malware payload (Socks5Systemz)", "value": "664ad7eeb31c7658d3d88e2633b6b2a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711248335, "uuid": "0621766a-3add-4c9d-a956-69e3f492efde", "comment": "Malware payload (Socks5Systemz)", "value": "3caf20651766fe9fdcc804393c554152365e2e10fe62db7afb11259be2888247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711248335, "uuid": "da7d193e-3a7d-45d2-b9d8-4e01a2a35950", "comment": "Malware payload (Socks5Systemz)", "value": "29a061044c69b18124d59b1bfba1140bf477df96", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711248335, "uuid": "ebaf9f2f-03a0-4ec0-91ae-c184e5d61e44", "comment": "Malware payload (Socks5Systemz)", "value": "444057b9cc0e8f41489faa75b183420b9a7a41365d912e9cf1288c888d7e2972fc1dd8bd7b78626a31646d6ca807bcf1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711248335, "uuid": "c7f621a0-c5a2-4d7a-a6e9-89a11a47e48f", "value": "T15AB5339753FBC03DE0E19F7D1917986C0477BE22A930A45CA9DE9806073FE6DAC84B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711248335, "uuid": "99a9f18c-fe0f-475b-8f64-88861d0db7bf", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711248335, "uuid": "c05e9ab4-ca0e-4c8a-8656-d08c066a1e5b", "value": "49152:32oeqsP/sudBrbboZuydk12g3VEk0H4rAl2uiSHTZY9KWM:moPs3zdVSH+lVHe4El2uiSzZY9FM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711248335, "uuid": "752de21c-76c5-4063-9b05-64f504fbfb6f", "value": 2309886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711248335, "uuid": "b182a804-d7bf-4c1d-9c4d-76ddacd28725", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711248335, "uuid": "bb301ee3-1582-428e-ac86-5f120b83e6e9", "value": "664ad7eeb31c7658d3d88e2633b6b2a1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bebdc04-e981-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1711245337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711245337, "uuid": "a05d2708-8904-4a02-9fe2-f7beb395c940", "comment": "Malware payload (Socks5Systemz)", "value": "6ae8b64b038154e44fc14f9db35cf23b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711245337, "uuid": "d0f3e8e3-6694-432e-9e68-b12b85df4931", "comment": "Malware payload (Socks5Systemz)", "value": "3face14fa194ab9f0e7a534ed938a0d6c5ad0529017b968c9cff394400f80e89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711245337, "uuid": "ea05a330-8c41-4e57-93ea-5b2fc47118b3", "comment": "Malware payload (Socks5Systemz)", "value": "ae8ea54fec185b96a65bece3f0a3030ffdd1d7a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711245337, "uuid": "dc3697b7-408c-46a7-b6dc-bd809b7074b2", "comment": "Malware payload (Socks5Systemz)", "value": "ae3d3ae29f7d35ecedfe032afa47da2bfd9c8b800382c3f45014dde5b4973d5a869b8fd8724de56c800b1d46b5e63e6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711245337, "uuid": "e6fb0970-7389-4329-a4f0-c9036334b16a", "value": "T1EDA5330977E8397AF265CC765903DE1545373E98BDB1740139AC2BC90B3A06C7C2AB2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711245337, "uuid": "c51df6ba-5956-4928-8dda-2c71def2dcf4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711245337, "uuid": "0ba98a48-168f-408b-bd4a-8047a6162277", "value": "49152:326F3YAI83Njb41dNKGD1a12gVy4Z8xJr/sWO6mbwLd8M:m6F3YAI6bgKc1a8eZ8PjsLrb+d8M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711245337, "uuid": "8183c7f0-212e-4ec0-98b7-02250eaeaabd", "value": 2113642, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711245337, "uuid": "1ef5bc0e-b038-499a-ac47-ed348b007d2a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711245337, "uuid": "ddcd4cf1-7b9d-4d58-b36b-edde33c750d1", "value": "6ae8b64b038154e44fc14f9db35cf23b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcfa6c31-e9ac-11ee-a120-42010a9c002e", "comment": "Malware payload (DanaBot)", "timestamp": 1711263914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711263914, "uuid": "5db64f7f-1fc4-4b58-8f72-1fc5bc8127d5", "comment": "Malware payload (DanaBot)", "value": "ececbce914bd50de31a63fa62a4e0d5e", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711263914, "uuid": "f11a04c3-5269-4dcc-baee-a10776403ade", "comment": "Malware payload (DanaBot)", "value": "406cedc7bdf20d64b4805230f84af6e47d356e0a10a152de68805b21772c39ae", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711263914, "uuid": "b21d2945-1de9-441c-8c2c-4a8371385855", "comment": "Malware payload (DanaBot)", "value": "326ac02720d9b274951ce65dc74d3fa76d13cb90", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711263914, "uuid": "6ba1e10c-f89a-43b7-a57e-dd5a6e5f861d", "comment": "Malware payload (DanaBot)", "value": "7dea5679899f6c612a233ef92ec91f22d33f596e34ddab3bd3ed99dd904d00900edd0b5791fa9f2c54ee7258ae7dda0f", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711263914, "uuid": "1d168c3f-142c-4354-9201-88d77c163e82", "value": "T11F368E31F380913BD0771A77487BA6B4587E7B602E25CC1F2AE40D4C9F39641BA6639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711263914, "uuid": "cea0f2bc-e68c-41f7-95d2-9f09b5107452", "value": "88b32203d0a05a747b387c7374b2b4fd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711263914, "uuid": "1672604f-e330-43cb-8f1a-088533c285db", "value": "98304:BG5Q0uLctqYqMnTXrbCzCSFprNi8owNMI0XF4t5szMxj:EQ0NtqonLr+zCMrNigNMy5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711263914, "uuid": "b58cf7c5-3097-4de9-91dd-c5733384ae9f", "value": 5302272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711263914, "uuid": "2a0abf7d-b68b-4242-967c-ad2269a8c7a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711263914, "uuid": "6cc8e7ef-2632-49bf-bf6e-978c1edb54ce", "value": "ECECBCE914BD50DE31A63FA62A4E0D5E.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651fcea5-e974-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711239661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239661, "uuid": "a1749cbc-97d5-418e-a3df-5778fda031b4", "comment": "Malware payload (Mirai)", "value": "8f838197950353b732f0154fc09d0842", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239661, "uuid": "9e82c3e3-63bc-4260-8c6a-b988c0d7ef8c", "comment": "Malware payload (Mirai)", "value": "41329a43aa6e12bf278be3db7536b51f0cd54886563dc67cfa2c2322f8eb42e9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239661, "uuid": "cd95d6df-b9c3-41cb-9e39-bc674d88dd69", "comment": "Malware payload (Mirai)", "value": "6da4606f8aed0ba478ac9fb2335b0f766505eba8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239661, "uuid": "69493af1-6ea8-45fe-b919-16b73af3ebaa", "comment": "Malware payload (Mirai)", "value": "749fea6b527b54282a0912753bf4be540933db34faaf33b2d0dd5609bbb9f0573ff178b552120bea205daecc078692e1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239661, "uuid": "34728b0e-3923-47d2-950e-212476ab179f", "value": "T152432896F9858B13C5C2117BFB2E42897A2A03E8D2FA72036E345F65378B5570E37846", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239661, "uuid": "498ce724-6636-4ad2-95c8-82cf9fab49fe", "value": "1536:d/SjvuuszV2cC1Ov10VsWzqF3O33A2xqx6BFv1Hw3q2:d/+v9szgR1Ov0RuF3O3Q2xqxi1Q3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711239661, "uuid": "53bcfa05-982f-48cd-a31c-d96a79108fdd", "value": 55188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711239661, "uuid": "91adb9d3-0c17-44ad-a0dc-eb5f3a564086", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239661, "uuid": "0503bef8-5c0d-4c18-9186-4e44fb3c08c0", "value": "8f838197950353b732f0154fc09d0842", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f7187102-e977-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711241195, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241195, "uuid": "3c2608c5-ec34-4a05-8bcb-5013eb774106", "comment": "Malware payload", "value": "928fa58ba97fbe9baeb259fdd46fbdcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241195, "uuid": "59c51f19-4f2e-4f39-b81b-92767416d41f", "comment": "Malware payload", "value": "4446fc2580873a1a35fff0c52c19e7a5b8946fff1fe7e34d11a2cce478707dc8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241195, "uuid": "7d55f8f6-872a-416a-9365-018cc56eea69", "comment": "Malware payload", "value": "250972595a8af89021cefb5180302607ab33f154", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241195, "uuid": "272a9e07-058e-45e1-bd03-f04f31c5609d", "comment": "Malware payload", "value": "99ba9cfc5bb404ea844ba8cbac673fb767f277afcb2d40ffe835accdf3b5f7e382a519f78fa0a55f5bb711456b01e926", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241195, "uuid": "ee2c6b6d-4a11-4709-9790-161413b80048", "value": "T132D34901D7E85B05C6AF8B772870F330167CEE426711D69929E8DC9B7AA33D04E5227B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241195, "uuid": "88992804-a979-4e97-903d-d4f9af929e85", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241195, "uuid": "ae8511ec-1f8f-4353-be99-2da759409519", "value": "1536:W+1eTWXfv0+2D5ZYZHK02weo1iTbeKRijYQO3SC9ynIbNgRLwibxjsw5:W+1KIn2FZYOwt14NmqSqmFbxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711241195, "uuid": "90e8cbaf-ed83-450a-a4bf-a488f24f4f42", "value": 139768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711241195, "uuid": "aa14ceee-37b1-4504-a1eb-875892257254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241195, "uuid": "38162be3-0296-48f1-b720-3ef1ccfe38d2", "value": "SecuriteInfo.com.Downloader.MSIL.gen.rexp.30484.4197", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e77b3f5-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265393, "uuid": "7f880a7f-e559-41ec-a549-cecd1f32cc85", "comment": "Malware payload (Gafgyt)", "value": "f8855bf7a1b2240918bd21d05a9ef789", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265393, "uuid": "8990bb3a-816e-4ae6-9e1b-f54c98fc02fa", "comment": "Malware payload (Gafgyt)", "value": "4480d72a324f519d3a630bf2ef7b118f4e388c5bccdd0a5465bafd2253daa619", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265393, "uuid": "eb1f7eed-2bbe-493c-a24e-7a4447d17b14", "comment": "Malware payload (Gafgyt)", "value": "700d3c35db19ba525f1076fc35e8937df756911b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265393, "uuid": "e838a006-045d-45c7-9fcf-b2da7b890077", "comment": "Malware payload (Gafgyt)", "value": "c00fafb506ba7695a8dfcdf2052024c05726bd4b62a5ccdae8e208a0683355402aa6fc242fcfbfd084312a3e733fa345", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265393, "uuid": "81ff97f3-3ab7-4280-b994-ba88f493b4cd", "value": "T12BC31841EA508667C2D22F7BBB9A434D37366A58A3E733055528BFF43BC37981D3A211", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265393, "uuid": "2e19c39d-2e89-475f-8fd0-e341d16c3fea", "value": "3072:XgXRGuYlxHF/kxMiEqvlY4YY+SG3sdhmyQa8GHibW:XkGlUnrvlY4YY+SG3ShmyQa8CibW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265393, "uuid": "61f3ab0e-e84b-4c5c-aefd-cba6a420659a", "value": 122197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265393, "uuid": "353941c7-ee1a-4ddd-96e5-69758d98ac91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265393, "uuid": "032a8d4f-626c-471f-af77-59ef1c9c9093", "value": "f8855bf7a1b2240918bd21d05a9ef789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a7356ab-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265386, "uuid": "cebbf3e7-3387-482e-a0c2-c476348d0dfd", "comment": "Malware payload (Gafgyt)", "value": "9276946341d81db5eeabc777caacb99d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265386, "uuid": "8baa8a30-cd49-442c-b08d-6695b335c41c", "comment": "Malware payload (Gafgyt)", "value": "4509e84a9abcb732f0ee90bf27dd300247b23b6dac9b41cd01f59d6384b5348a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265386, "uuid": "7d1c99d6-8f58-4768-8ae5-14373278bf49", "comment": "Malware payload (Gafgyt)", "value": "7c56380e28df0eee301ae3608043cbac8a74af1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265386, "uuid": "e06bff21-2608-4105-9554-7556418ab3ec", "comment": "Malware payload (Gafgyt)", "value": "bb8c9328f8ab89b1261a0e5e31c7c448123d4eca3ee7e62223d228fb1309214665a4c22809f0ee78af831b3a97d2ea6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265386, "uuid": "53e0f904-37af-4586-b4df-1f18021a1015", "value": "T114F34A05D6408B57C1D2277AFBCF824A33239B64A7EB33155938ABF43FC27A94E26115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265386, "uuid": "a679c089-87a8-415c-94cb-4703c15ba26e", "value": "3072:p2Y+/6kCgziZQ8a3eJfpaJowkggE8ayiyDPH/WZPXWmLwSguWrpW:U6vgziZQ8QeBpa+wkg9hyiyDPH/WZOmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265386, "uuid": "ef225710-47c0-40eb-b2f8-38683ac4e228", "value": 163101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265386, "uuid": "fc560869-0c62-4b75-91d4-8240cd9e592a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265386, "uuid": "45342630-9e71-407f-8fa8-9f6c4cd21ab9", "value": "9276946341d81db5eeabc777caacb99d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4df3a1de-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268828, "uuid": "0435d15c-a13a-4db6-9d03-9d5efb44c51f", "comment": "Malware payload", "value": "0a21fe4eedd9880af1f09af76edb8e55", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268828, "uuid": "0df4d442-1745-481d-866b-5640ce4cf817", "comment": "Malware payload", "value": "4738743d25fe7ab2345fc243677ae896047bb3acd7d3e416962c85f0700c4795", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268828, "uuid": "283fbc6f-90fa-48e9-9fe0-7cdf8f12fbd9", "comment": "Malware payload", "value": "29651a66b936aea4c9fa8dbe60f0d211fc7d9960", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268828, "uuid": "64fe666c-1f68-47d7-9e8f-1e02b296448c", "comment": "Malware payload", "value": "5373f629d3c38dadd186eb812243bd87de3fffc59fa3dc28e6637f5918163ea1a291f9a2579a43bd83c7638c0844b2a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268828, "uuid": "120d5ea5-cb7b-49c3-8097-5bcc02dea6e9", "value": "T1E8073344B27205E2D99C91F5D10A86E469727F418B23D7BF07F071E52AB3B98E836F12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268828, "uuid": "2f659d2e-2cf1-4999-9dcb-585b16bd8fee", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268828, "uuid": "d253d96d-f4db-4050-839a-bb08c5ae8b6a", "value": "393216:iEkQvCF2xrvaUX47d45xrpJSjDDu9tUYFVir9x4:isCMRaUI7d45x9keSYFK9x4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268828, "uuid": "23071157-5c7b-40d1-b383-2d3adc33c2c8", "value": 18044823, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268828, "uuid": "ead87f03-1068-4c71-9416-96ea48147353", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268828, "uuid": "ca99b6f7-8849-4f37-898f-f7c5203239f4", "value": "SecuriteInfo.com.Win64.Evo-gen.17494.7440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94bef71a-e986-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711247472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247472, "uuid": "ee2041d7-03b0-49da-b111-c7a83f4cf50e", "comment": "Malware payload", "value": "4dda4f887edfcbff11e6ba4fca9e432d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247472, "uuid": "652bc40b-2e5b-4f4e-968a-62f691ff098e", "comment": "Malware payload", "value": "4a6263aca861f81fe87bf8eb4bfef2e24fa0e10cbd9162ebfc0d12fab67b8393", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247472, "uuid": "36ac0408-3932-4a9a-9758-bc6f82c942fa", "comment": "Malware payload", "value": "72d5cf8496156f011fa688d8d0a206ab2288cc15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247472, "uuid": "e460212f-e4b1-4265-b9f6-5839ed97c5dd", "comment": "Malware payload", "value": "b7ef21b0587ea09cec76c9e01251620ebd6cefcad578bcadc23dd2a208c3cf18053edf93b0e9119e4adcfc7e073fb593", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247472, "uuid": "e60d1339-1585-4c8f-9c5a-45daabcb5668", "value": "T1A7A501A398405193DA09DFFBC02E548BD5527EDCBEB3E89DC87DB91A57729C0C668032", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247472, "uuid": "ae9e1fd5-e20d-438b-be11-6e6b0b9e7eb0", "value": "fe5fb373dbec3ba73ffb51335d1fc086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247472, "uuid": "ca620f87-d6ea-4936-90e4-e96c5b827522", "value": "49152:350ZsURAlnmObDHLZX5cG96+kHkNPn1sxMweM1D:3isUupDHLAG9iHAP1sxp1h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711247472, "uuid": "2bb27ee6-c02f-494a-ad32-d0f328639082", "value": 2152720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711247472, "uuid": "d31a44c5-edbf-486e-9147-463598ab63f0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247472, "uuid": "7173c995-f0f0-40f3-8c66-6d9a7e1202b5", "value": "SecuriteInfo.com.Trojan.GenericKD.72085515.30278.22681", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "944e1090-e9e9-11ee-a120-42010a9c002e", "comment": "Malware payload (GuLoader)", "timestamp": 1711289991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711289991, "uuid": "53ec36fc-98e7-4765-bcea-83d792de124a", "comment": "Malware payload (GuLoader)", "value": "848ced66c05a735b64b58de6e60a7cb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711289991, "uuid": "e8aa3fd8-c022-4ea6-9e14-8349152706e4", "comment": "Malware payload (GuLoader)", "value": "4d8d20365deb38fb52d0df02cc5be37a15873f731134199de6a2286854fd6512", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711289991, "uuid": "9f96b8d8-786a-4569-869f-2ac05f0e7612", "comment": "Malware payload (GuLoader)", "value": "a4b9f061aac9f2caf9a21d7b6b6b4493c39332f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711289991, "uuid": "1cd47c6f-ce82-410b-8ed3-5073b62a438b", "comment": "Malware payload (GuLoader)", "value": "e131665a0bb4a5dc880ca526f5419669a6095f6a2450b9726127b27f0412bc93aa0e5341a63593b5ef44051ad8e297cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711289991, "uuid": "a83040ce-b8b4-46cf-b400-b64213765f44", "value": "T144E469FE6C60B599FE39C6F62A548A30E71A2C11F4103676627C72DBC9B988143D790F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711289991, "uuid": "6d0c8eac-6031-4d7a-af24-14da82a48349", "value": "4f67aeda01a0484282e8c59006b0b352", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711289991, "uuid": "8b25a426-b925-4daf-b166-c3d837899d30", "value": "12288:co5vFoWSR4nbLQ/mxVfon79ho/7lnoNROHnU:coj2cbz079ho/7lnoNRi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711289991, "uuid": "38796567-1785-4c62-960b-8cdb6736cf00", "value": 722136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711289991, "uuid": "ce2d627c-4d3a-4e9c-bcde-b22e3cad4a45", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711289991, "uuid": "f4c8ae88-4094-48d4-8c09-c98cfea55380", "value": "rpayment_slip_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c4aad0-e98c-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1711249841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711249841, "uuid": "e68214c5-64a0-4517-9dfe-a9fe28cf82fc", "comment": "Malware payload (AsyncRAT)", "value": "c5e81046d6b6c30a601ba8c80c5d1338", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711249841, "uuid": "aba3e060-feca-4824-82fe-1a5297258067", "comment": "Malware payload (AsyncRAT)", "value": "4eb8783186fa38907a62878e9f821a450c4695f2dcd674b285d5abda4bf06485", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711249841, "uuid": "009d3131-9335-41fd-8b4b-dc134951d6a4", "comment": "Malware payload (AsyncRAT)", "value": "af7a89176f5bc899b3d187487180f7610b91c08c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711249841, "uuid": "c49e7ce4-7d10-44f7-a45a-901f89b3d056", "comment": "Malware payload (AsyncRAT)", "value": "2f94469db8fae2367ee1269477b272fcc84a3f7f132627953ba957efe99a9da204ee7ca8fe6a775ea2e86776d0835e8c", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711249841, "uuid": "325ff6d0-de8a-4ccf-a260-16008250fd66", "value": "T168A3F1B1B7CC8452D5E307703DA9F9E00993636AEE52EB3B29CE2B87D527B210751235", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711249841, "uuid": "0f1e633c-a85f-43b5-a756-2207d385c2be", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711249841, "uuid": "b8bcd35b-318d-4395-afa1-747a5fcdc3af", "value": "1536:ezBCrc5Iv4jBsYEJNbcYszAwh4lc68h2f+IuI05bhGJLd5UIq081edYlwz:6BCI5Iv4jBYPSAwMHHfBAVsO9086z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711249841, "uuid": "b5649fb3-a24a-47cb-8d1c-e0d41964f9c3", "value": 98816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711249841, "uuid": "909d2d94-7926-4fe8-a81f-e245625b96eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711249841, "uuid": "7a6cb372-e3f7-4826-8054-29c37c9d2380", "value": "C5E81046D6B6C30A601BA8C80C5D1338.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cd56e6-e974-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711239607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239607, "uuid": "a864474d-af41-411f-82d7-190914cac3e0", "comment": "Malware payload (Mirai)", "value": "01feec289208bab5b86459de582900d4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239607, "uuid": "1e7b116b-8067-4f0c-93fd-4770bf711b96", "comment": "Malware payload (Mirai)", "value": "51469b2d273423acb55f71636cd2f3c06e2c706ff2cc7d28b91b142334e9f747", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239607, "uuid": "482fdeee-8a58-457f-84a3-d75ac4fb0033", "comment": "Malware payload (Mirai)", "value": "be3f29e47c8fd68f4b2c2971f32065a8ec224535", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239607, "uuid": "50597cfb-8ae7-41cc-ae97-d5a18aca5ead", "comment": "Malware payload (Mirai)", "value": "ae1eabf697fbf02f4ca77ea693c845d1ba6e7eae1d7f84a85414bd19da2abcf96fa851909f2d43fd1b04c9cda0c80ea5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239607, "uuid": "0b6099cb-9a53-438a-b285-e2d9f184c295", "value": "T13893E82A7621CFE9E15ED23047F78F314A6526E11BA19181E36CDB502F2238D6C5FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239607, "uuid": "bdb03f14-1b89-4dc0-aa5f-123e9dbe0685", "value": "1536:NRvdR03xs2clYNF9vrgxPhSOTBxxjbPcDsc+AS2XHgMVsLmc5U0yM/pzt:+rcPwOvxXCs72XAMVSmwU0X/Zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711239607, "uuid": "cfdacb4a-fabb-4e50-a6eb-cd5b7dd725c1", "value": 97512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711239607, "uuid": "01a84913-a201-443d-b061-b87fb52a207b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239607, "uuid": "72382c8a-86a9-40d7-9771-7b805b3659d4", "value": "01feec289208bab5b86459de582900d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6c65ecd-e995-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711254079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254079, "uuid": "53883c5f-8ba6-443f-afd4-cc6af12a2dfb", "comment": "Malware payload (RedLineStealer)", "value": "867db3f60c59188cb4baf8a5aa399752", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254079, "uuid": "d3111b6e-736c-4cd3-b855-617338276d75", "comment": "Malware payload (RedLineStealer)", "value": "5197def97c9d6e3f9c0e55f4a91a424ece5a89d4882a0d413a9260123010ec4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254079, "uuid": "d6b432ff-b763-4426-abfa-d2b1e7dabb80", "comment": "Malware payload (RedLineStealer)", "value": "64a62a163ef37dc75601aaa3a9b1459f6972ddd1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254079, "uuid": "b588280b-87e2-40c4-b849-babd513e6590", "comment": "Malware payload (RedLineStealer)", "value": "5da3166f8ba21e2443b2c543a1100f85aba46a736e618ce38b2c72521e3ce8092b0f683442b2fcaf1e876879c96c0368", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254079, "uuid": "43bedeb5-b431-4b25-9c6a-0e270150a127", "value": "T1E594E10239E2D872E6F7473118709A9015FBFC725A758A9B37983B0F18706C25E76B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254079, "uuid": "d9863987-66e6-4967-8643-16499b4bddfa", "value": "ff23e32a63aac9251bb507fbef91be04", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254079, "uuid": "d86c0a16-bbea-414e-a264-dbbc5e67ae96", "value": "6144:UnBevYGqhRcp5ke929s5gGQJgRCe7e4nY9bTCn:+AYGqhap5ke97yoRfe4nqvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711254079, "uuid": "26e7b962-63f0-4b7c-8521-77e9ad3d6b4a", "value": 435200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711254079, "uuid": "e29456f5-4d0a-4b8f-aec0-90b8449e7a71", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254079, "uuid": "964f7d8c-31f1-4fc0-9403-b5a2a1f56faa", "value": "867db3f60c59188cb4baf8a5aa399752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b9f05e-e9ec-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711291341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291341, "uuid": "23bc5981-2bfb-48ba-b011-d6446963e4ae", "comment": "Malware payload (AgentTesla)", "value": "b4482bf455efe7ffcc19b8bf1aadf052", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291341, "uuid": "1ba11e63-7054-4cc0-8dae-d71e4fbe0f03", "comment": "Malware payload (AgentTesla)", "value": "534d3e3464fe4b9cd4382189435b14f5c446890d7a4779a49bdabaa01cacfca2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291341, "uuid": "74e5f164-1e0c-4ae3-8084-0fda74982f41", "comment": "Malware payload (AgentTesla)", "value": "5559f7c57746b546cd1b385b650f6415a38a7386", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291341, "uuid": "5cbc2276-3873-4446-86b9-b9b47c055357", "comment": "Malware payload (AgentTesla)", "value": "e19f4cf6bd0b63f3937be177e145fc665282cfb5a83f58a75edbd1ca5a953b3dc897274ff2a3b516f5fda635551bcc5b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291341, "uuid": "0d5ebcfc-c4a5-458b-b790-7a1def79f3a0", "value": "T1B1D423D7337C73CA27C4B3961310CE6A677FB4339638E14449A32AAB58E616C97D11AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291341, "uuid": "9e745e15-4121-4e8b-89d3-fd151610d86b", "value": "12288:B9XRQ4DUE+PrOMzmrdmyod4O+5dZHYZnV6X1vCP7t9QZPZ7Z8:B9XRDotmrw6O+3ZHOV0KpSZPc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291341, "uuid": "db56a46c-b36f-4d67-9bb5-fc2f256e0e6c", "value": 633136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291341, "uuid": "44de88a0-f866-4bec-9f4e-cf62aadb2c06", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291341, "uuid": "f613ff4a-882c-4be9-ac75-261263cd8c1b", "value": "nNew_PO #178391.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f75ac0-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265327, "uuid": "e220e782-347d-40e4-89ad-fd68ae54a0c5", "comment": "Malware payload (Gafgyt)", "value": "11932ffe67998c0b9226a0ec35b059ff", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265327, "uuid": "038bb4ea-2b68-4353-ac44-c20e0b813fe8", "comment": "Malware payload (Gafgyt)", "value": "549d3aac3b42f702f29ab27c653c0f239a51601a6aeb50564beda614f8f1f33e", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265327, "uuid": "d98097f3-8d66-4a32-9896-583897c602ec", "comment": "Malware payload (Gafgyt)", "value": "42e1048b5682bf20af13a5e535967b29da426b69", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265327, "uuid": "b188a65d-a86a-44e9-b993-5d55f82206f1", "comment": "Malware payload (Gafgyt)", "value": "10174dce55dd5c31f596e119bd38703bc61585dfc8b8eafbb08a84dd3634feabc8ae56f257f606f633050b482e24b4e3", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265327, "uuid": "6fc32d13-5829-46c0-82ff-1c57f7a3a302", "value": "T122B32903D960C47BC48B52B65FDFE6626233F8790732620B2384BEA52F15999DF99343", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265327, "uuid": "3cfee333-a3e8-4966-b895-1bd6a6adb6cc", "value": "3072:XfeUZ9ywFr740I1yWnc+1tvHhVsPmf/Bl3nQ/:3WnDbGmf/BJnQ/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265327, "uuid": "c6bd4d68-c459-4205-a1cc-2fb8bba99ae7", "value": 111687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265327, "uuid": "271fcba6-9bda-46b2-a8f0-7c52340b7765", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265327, "uuid": "8d177a1c-4b1c-49ae-adb7-7c6ccc98e610", "value": "11932ffe67998c0b9226a0ec35b059ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc1c439e-ea0e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711306003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711306003, "uuid": "0c8749c1-c587-49ad-82a2-7c980781cda9", "comment": "Malware payload (Mirai)", "value": "11593b91ea836dcfbc783270b1c8e57a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711306003, "uuid": "725f83ea-f195-4f06-a09b-6e3402a16bdc", "comment": "Malware payload (Mirai)", "value": "568a215bfc6bd71828cde42da40393352627ace59d8ff699c89fb66d2fb255dd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711306003, "uuid": "0786fc73-a2f6-4480-91de-733ddc388a7c", "comment": "Malware payload (Mirai)", "value": "afa21dac02ea57703513539f9e33b79b02b024cd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711306003, "uuid": "15952439-fa14-4078-8540-0cf47e5fe001", "comment": "Malware payload (Mirai)", "value": "e551fd126f1edc7e0110dd5b7eb3523edfa77fab815cbb2ec83f50927113e2e5cfe30f4a17632526634c15370ec0d7f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711306003, "uuid": "f2c726a1-39fe-4e5d-99c7-15f81956f090", "value": "T1E0533A17B54181FDC09AC1B44B5BFA3AD93371FD0268F1AA67E0FB222DA5E215E2DD40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711306003, "uuid": "dcb2da68-8858-4a5b-9481-76a338756331", "value": "1536:xwjMr7Ugn59ewLxBxPdCdph3u611P31vcFYcrhvmM5U:9rggn59ltBddCbhe61/vfcrh+SU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711306003, "uuid": "56a6077c-7df8-4538-af63-55db0c75ada2", "value": 66432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711306003, "uuid": "aa3fde5c-db2c-481e-b3c8-d2ef88b706ce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711306003, "uuid": "7f0bbc10-7a60-462d-a026-1c07ed9f58f9", "value": "bot.x86_64-20240324-1846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9939ee39-e9eb-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711290859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290859, "uuid": "a52fee33-b6c7-4d99-b136-5dbb412b03ab", "comment": "Malware payload (LummaStealer)", "value": "f72f6b9036a9273958dc09effeb0a10a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290859, "uuid": "6c8829f3-4115-450e-8311-5353557fece4", "comment": "Malware payload (LummaStealer)", "value": "5846798583be774901279b9bca21a8ef095d0f12e459a7a83535b5b0339046bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290859, "uuid": "7ad5166f-7549-4f8a-9bed-9c1e80167d16", "comment": "Malware payload (LummaStealer)", "value": "88c6d3521a345c8fd688a7a35c25299cdf96c5cd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290859, "uuid": "32988065-d05c-4cfd-b5cc-07667a961637", "comment": "Malware payload (LummaStealer)", "value": "de9a3544c4d8f6402fbabb1fc652a7759c44ed165264d5a51790db1cb17a0beec3b85b322e845a5acb12c6cddaf73bf4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290859, "uuid": "d6b0264e-0d39-43ea-94f3-5c993f32115c", "value": "T1EB74029E7B989B92C92C82B5E0D3A47E03F5CA5EB273DB4F7D4527510D023A5CDC1A84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290859, "uuid": "869b61aa-8303-42c0-a489-173ced6f494f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290859, "uuid": "201c2c0c-0bb3-437a-89a9-499ea2e32b43", "value": "6144:GraVXnTkSAH6vhHCb/qghjb3Bzeh0HNhlbnaUtMVSrZYeC15pdbGUJvcSvXj7gT:GcTkevhYhb3BTJbna8MjdbZnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711290859, "uuid": "d52694e6-a2e2-4a11-8bb6-acfea38a4a59", "value": 362496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711290859, "uuid": "1a9e830f-856f-4ecd-b167-c51b4e12740a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290859, "uuid": "b5afc485-cb54-4dc6-8152-bde1016fcb65", "value": "f72f6b9036a9273958dc09effeb0a10a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57d99fe9-e974-11ee-a120-42010a9c002e", "comment": "Malware payload (Okiru)", "timestamp": 1711239639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239639, "uuid": "32153870-50c7-4b87-a9cb-b4bd494cef62", "comment": "Malware payload (Okiru)", "value": "1c0b9123b7ef6b8ba0e49f75091a8607", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Okiru", "colour": "#A5AADC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239639, "uuid": "e873e3a2-2e30-4cd6-9b99-c57f5190b1cf", "comment": "Malware payload (Okiru)", "value": "590f383735ea3e0543ad00c9d3771a20ee899e2c2423315c8ab46e7dabc10c0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Okiru", "colour": "#A5AADC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239639, "uuid": "13473198-e9ec-429c-8b67-e4c506199473", "comment": "Malware payload (Okiru)", "value": "72eff28e2bc38905877f104db7ccc375c2f73fb2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Okiru", "colour": "#A5AADC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239639, "uuid": "04d2901d-137d-4513-a11b-41e11049e2fe", "comment": "Malware payload (Okiru)", "value": "1fbcbca8e500c514c1ba542beda1793e822a96968e9fafc7dedbcd494d8cd199dc194f29daafbfd3c1b2ea5801d5353a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Okiru", "colour": "#A5AADC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239639, "uuid": "f5cccd94-5747-468e-8bdb-f684b9804500", "value": "T180C32B56E7408B03C4D72B76BADF93413333979497E763065628BBF43B8279A4E23906", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239639, "uuid": "4c6b5baf-ab29-496e-9c26-f0b7547eb648", "value": "3072:u5Za9Q1eYsb37LmCb8A+dHHG5xVNAXmjewcnXxt:u5Za9Q1eZbe4+dHHG5xV4mjewcXxt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711239639, "uuid": "107f35c9-c18d-44bc-83b1-a029caccd6bd", "value": 127481, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711239639, "uuid": "054eb4b3-4a5a-4af1-8e46-ea5a3e3de2bb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239639, "uuid": "03889dcf-b240-4075-9c0e-9695354005a5", "value": "1c0b9123b7ef6b8ba0e49f75091a8607", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "425326ee-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711265373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265373, "uuid": "8ca94195-5823-4571-b5a4-b5889cf229b9", "comment": "Malware payload (Mirai)", "value": "19393f627920eb5348d880f7df5585ec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265373, "uuid": "060780e5-c1ec-4db4-8c76-f920467379d1", "comment": "Malware payload (Mirai)", "value": "5afd4216921f55f063471a3d7b100fb6c8c43bb6191b1bfbc8b230b730ad948a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265373, "uuid": "c486757e-e90a-42b4-b229-fb5c73039325", "comment": "Malware payload (Mirai)", "value": "f84d556cdf7576f33697553765f63161c7604f68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265373, "uuid": "984a1a40-a143-4a15-984f-b54ed80d68d9", "comment": "Malware payload (Mirai)", "value": "8974b75184d74dfd78dd73d7df17bbbd905d38c695d851fc1b1774fcc3d7aa6213832b7b255566738fca8947ef3b7f81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265373, "uuid": "d68537bb-d17e-4164-8a58-c575678208c6", "value": "T1CEC2D030418E6E51D635C636B724CA847F554AACA3B311AB7E81E3B4F0C7857EB7205A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265373, "uuid": "c22333d9-5d58-4d91-a9ac-d0c629e7c99c", "value": "768:HRYtLOjiI0iTehHr6qiLGOXQJYu5RZMJbvbs3UozG9:Hat9wALKGlYu5RZM1vGzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265373, "uuid": "c0222592-1322-45a8-8749-0013f8dd4ecf", "value": 26328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265373, "uuid": "94627fce-ee9d-427d-95d2-26e6b08e97ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265373, "uuid": "3097b044-11ba-42ae-89c5-866146f23ea7", "value": "19393f627920eb5348d880f7df5585ec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27dec487-e9c4-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711273918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273918, "uuid": "7aed3128-336f-4bd2-9af7-83ac31c039dc", "comment": "Malware payload (AgentTesla)", "value": "a24cf230bfe65032876ed807459d5608", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273918, "uuid": "144a1998-7fd1-49da-a977-3fb635a2f78a", "comment": "Malware payload (AgentTesla)", "value": "5c6d50f37b2e6b846eac7935111d6f3eea25cfcd4d13c64a3df2f1f4d04c833a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273918, "uuid": "34e7c68d-beb9-4237-84da-95b24da96c31", "comment": "Malware payload (AgentTesla)", "value": "8b86f5f200648c52c46f7225c4d33b5004cb7227", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273918, "uuid": "f76c99bc-2696-45f2-9e69-a7539571707a", "comment": "Malware payload (AgentTesla)", "value": "e495df4eccd5c5fdee2990d3b200dc50e9f37de86b558514b0922906336904313d887da08cbdc9c4df869e886965c9b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273918, "uuid": "0df8c777-2be0-4faa-acd0-8c2f4afaeb5c", "value": "T13253E22EE74F0925DF55D67B435A4B4A09FCB33D738100A139BC97343BAD81E8A62978", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273918, "uuid": "fbe7eda5-e195-486a-8c66-76a081c4f4e3", "value": "768:4MN0xjd2uq16hDVUOrwbhXmDNbnJu1CGiigjEDMwqn1QGI26s5aSW59YS4Gunr:4MW5abxmDNgCAszzn1NNaSW59cGunr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711273918, "uuid": "09ade98c-7690-4855-b002-6b5652868ce5", "value": 65725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711273918, "uuid": "f64112c9-f340-454e-96d4-740b3e7bfd75", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273918, "uuid": "f1255fb8-fcf2-4ace-8967-353a0fd630b0", "value": "a24cf230bfe65032876ed807459d5608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235bcab7-e9ed-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1711291520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291520, "uuid": "7c2651fd-7f6e-4357-ae74-46c7d9007177", "comment": "Malware payload (DCRat)", "value": "1994f3ef2118aeecbb74e6c8976fd47b", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291520, "uuid": "dfca2e16-5162-47c2-b0ae-fbfb44c957b0", "comment": "Malware payload (DCRat)", "value": "5d3aa443debb15bdf756b94980e0a6bcbef950edd72941905f70eded5238590c", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291520, "uuid": "3ce3238c-6d50-4f11-8a91-756827133307", "comment": "Malware payload (DCRat)", "value": "8f157fc5c2af51db24b66085f29d3c1240be36b2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291520, "uuid": "35cb7dec-04c5-4c44-bc38-c162853799de", "comment": "Malware payload (DCRat)", "value": "4e7cc47cb9810f051afef2f671a9df7e9fd925a1ed124a6aaf12a502be85fd8e6f19500305741857a3bc595739f7c6ce", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291520, "uuid": "5fad2756-c640-442d-b801-a5f5498da510", "value": "T1D5E5E0017E05CE41F0881A33E3EF46544BB099526AA6E72B7CBA377D5A113A73C1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291520, "uuid": "b4046bce-16bf-4eb5-b947-14e70ef31773", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291520, "uuid": "25521372-5203-4019-a95c-932fde4defe9", "value": "49152:a4iktlQ2cj9ScADsiz76m0JVqeUYfHuv4mDrsdWE2hnKQ9nO1zdhBFMGIEdY/0/w:aXktlQQsE49UguAiu2cp1zjLddZ9QY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291520, "uuid": "308d88cf-0c7d-4cce-b379-d30627442481", "value": 3314176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291520, "uuid": "35f73aa0-272e-473c-a7ac-dcb23c14b262", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291520, "uuid": "0f6379c1-c44b-4bf9-997b-fc0e1601b4d0", "value": "1994f3ef2118aeecbb74e6c8976fd47b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531980dd-e974-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1711239631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239631, "uuid": "01131f4f-f21b-4272-94f7-0bf3fc24116f", "comment": "Malware payload (Socks5Systemz)", "value": "336e9bf05f1fe2d98473bbb424363322", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239631, "uuid": "46e10fd0-7180-4480-b6aa-fe28d66b26cd", "comment": "Malware payload (Socks5Systemz)", "value": "5e00b8843a33d3dd8cc77eaaa1b4a8350182d639a8ce83575946b3786b356dfb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239631, "uuid": "ea5c65b8-cfe4-4838-bc18-3c105f1c4466", "comment": "Malware payload (Socks5Systemz)", "value": "7f1cbeb05e4860646c2600813bda69b468dc73ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239631, "uuid": "41771838-1ec9-401a-b9f9-54c0a05a6c2e", "comment": "Malware payload (Socks5Systemz)", "value": "e401a3f663c1ae3eb6e1900bcb6742907cf437827383ead186862e1db5f7c4ec5b315fbb0db3531ae87fb8fba8a23cc8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239631, "uuid": "021cccb7-84b0-4e39-836f-8fa3954db218", "value": "T159A53336B7885838E471AB320B021834CD7736963E39945D336DBECCD7AD0D0AA467A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239631, "uuid": "df2a4238-e226-4314-adc3-dbe7f6bfacf8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239631, "uuid": "ac900efd-91b7-43e3-a318-d50575fddf7b", "value": "49152:32115Bqx2wgevTb1FR0FdsEoZlDgrZcwiIx3WYdfSRM:m11qxPRwGl0rZc4SRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711239631, "uuid": "3dbb0efc-25bf-4805-9792-5d038a4477c8", "value": 2105084, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711239631, "uuid": "5c3b8c68-927c-41e5-813a-585f40cff683", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239631, "uuid": "2be349be-f3bf-4be0-be29-ef2f44dc711d", "value": "336e9bf05f1fe2d98473bbb424363322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6bfb25-ea0e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711306001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711306001, "uuid": "3089afb2-2db5-4a69-98e5-e6edcfb6ee44", "comment": "Malware payload (Mirai)", "value": "8e37fba4901dec84720b985f29672516", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711306001, "uuid": "57b10b8b-edef-459a-a331-58958dbf9f2f", "comment": "Malware payload (Mirai)", "value": "5f3fc96e9d071c7ee234d668c6d10d2a22f149f08ffeb9db224c66f290d20e75", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711306001, "uuid": "f1b0076b-4626-42ac-a37e-2e050f625830", "comment": "Malware payload (Mirai)", "value": "226abbdd40f7687475509a89ed9b46904816ad13", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711306001, "uuid": "5b13f513-6934-4b25-b253-7d7b9f879f03", "comment": "Malware payload (Mirai)", "value": "f841bcbed89beed78cb261e2b29e6d4a6e94e3c7f1f48e3508cf461e024f6f82e35c96481c263cf364998dfebd318871", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711306001, "uuid": "10fa69ae-e4a1-41e6-a9b5-0c7eca972b47", "value": "T1F193B71E7E218FBDF769823447B78E21A75833D627D1D645E2ACD6002E6034E641FFA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711306001, "uuid": "997d2a77-7ed9-4284-8b27-47d33ab5f4e7", "value": "1536:8+5tv88dfOUt6S07n5zWo0I1EeaGaW5h52:j5O8dfOK4nB0I1HaohI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711306001, "uuid": "309aa094-939e-4884-8073-a988b8e92797", "value": 89172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711306001, "uuid": "b5518d9d-ec78-40dd-97d2-59a6ae358c40", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711306001, "uuid": "17d62dc1-6353-41eb-8607-1fb0dc7915ee", "value": "bot.mips-20240324-1846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f20defbe-e995-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711254071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254071, "uuid": "2c30c2dd-6283-463e-b562-699f7e00d178", "comment": "Malware payload (LummaStealer)", "value": "597c1d87c0c8315922ebd6b24e29303b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254071, "uuid": "f768c147-82ea-4320-875e-50ae334dcca7", "comment": "Malware payload (LummaStealer)", "value": "5fad09bde8551c6f4df812e50bd9917a71463ca93359bf73ecfbe05967c3203e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254071, "uuid": "7da3f7fd-42ee-4c4a-8665-d23a66f3b724", "comment": "Malware payload (LummaStealer)", "value": "736af77ba4e1ba525c0fd0356eaf7da8fef694be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254071, "uuid": "d988cb67-d85a-4227-bc3b-d46fd027d29b", "comment": "Malware payload (LummaStealer)", "value": "02debb3dcaa6fa228742799171e849e74121848291e326b79ac16424e8259203f530ed3df2d72bbd5897fdd3eaf142fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254071, "uuid": "2ab45b7c-f679-420e-a367-cf3da8e98662", "value": "T1B974E0117AE2D4B1E6F387360970A9951A7BFCB25A71895B33C82B0F5C711C15E32BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254071, "uuid": "50d6a8a3-2d73-4a7d-b652-e657241c81af", "value": "2d647858024fd9fb9c601e98afa143d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254071, "uuid": "17291337-b1df-4e29-b2b7-fd1b38d4d742", "value": "6144:u5t5lPnhTu48BmQOPR//alrvyjjL/V4otuJUHEu:+lPnhy2QOgtajva4uJUt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711254071, "uuid": "78a6eb21-0888-4478-b26b-0c4f28efbf6f", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711254071, "uuid": "b1933003-9ab0-47a0-ade4-c11faa335275", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254071, "uuid": "b7cb4b72-17c1-4bc6-94fd-aebce734b2d8", "value": "597c1d87c0c8315922ebd6b24e29303b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6e42763-e992-11ee-a120-42010a9c002e", "comment": "Malware payload (ConnectWise)", "timestamp": 1711252683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711252683, "uuid": "9aaf5845-96cc-4b95-8042-73e79fdac864", "comment": "Malware payload (ConnectWise)", "value": "15295523233fe92ea748934480b75553", "object_relation": "md5", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711252683, "uuid": "89b85d12-27eb-4510-b374-4d0dab62c607", "comment": "Malware payload (ConnectWise)", "value": "62206c6dd37f38c9b0362171642c6dd0ef0ef32afec28e885047552bc0567afb", "object_relation": "sha256", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711252683, "uuid": "9743228b-8cd0-43d2-a526-f87a60b60ad3", "comment": "Malware payload (ConnectWise)", "value": "e4880db7e86406f1c0c811979fe530cb13b3e415", "object_relation": "sha1", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711252683, "uuid": "9f85ba32-4bf5-4a27-9cbf-1a4715f31313", "comment": "Malware payload (ConnectWise)", "value": "272080fea34af8cdd9666ab4cd203ba0c019cf284829ceaadb876d4a32927ee197337828fe4c39e90add3602ed24f596", "object_relation": "sha3-384", "Tag": [ { "name": "ConnectWise", "colour": "#0E7BBA", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "screenconnect", "colour": "#C7D6F6", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711252683, "uuid": "55dc2bcf-7944-46e8-ba11-6c715b90c78e", "value": "T18E46F001F3D695B5D5BF1678D87A9265AA30BC048712C7BF5390B96D2D32BC08E327B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711252683, "uuid": "55ea31e9-6384-4d87-9a7c-e8d275b6dda4", "value": "9771ee6344923fa220489ab01239bdfd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711252683, "uuid": "e2632c17-c0c4-4723-9786-8e04833e28b7", "value": "98304:JBs6efP9AVjPL0K+IdYdnkGzCgJU18bM:LfefPMPIzCgK16", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711252683, "uuid": "5a2a25d4-e3a7-4e6b-9d6a-d4219bd68230", "value": 5490600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711252683, "uuid": "d5ceb861-4cb6-4d22-a9d7-232c8a3739a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711252683, "uuid": "e3ac98a6-749e-441d-b233-6f0931869c54", "value": "SSA.REPORT-4126437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec568cdf-e979-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1711242036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242036, "uuid": "a084c91e-6661-4450-968f-f03fc2acb9ea", "comment": "Malware payload (Socks5Systemz)", "value": "e1ed82cbc13b80a7dde61c3708120a21", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242036, "uuid": "fff62198-2f21-4707-a0eb-20fe25d8768e", "comment": "Malware payload (Socks5Systemz)", "value": "6243e73fcf75709917694b16bde39e15af7138768b7dcb49d43fb91177ebc16c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242036, "uuid": "0f6a49fe-e48f-4273-ba7c-557bed75de31", "comment": "Malware payload (Socks5Systemz)", "value": "3f8bb8ae282064d1f9d8aeef43eef14b6c91f24c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242036, "uuid": "5e8578d9-93a2-4d6f-87af-77c673e772d1", "comment": "Malware payload (Socks5Systemz)", "value": "90664a11e6f8e5abb258c8f2d1cc5acfeda0ac5bf81584c7fe097d0bbf8e43df45f4930df6e4806d8de81e829057f0f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242036, "uuid": "6f258798-969e-4efe-8894-44bd5f3a13ac", "value": "T128A5336FE6F5447FF1F15A705CA564A89873AE321CF43C1432CCE9495A3ECA6910B32A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242036, "uuid": "baa470ad-1d7f-4705-b475-f4cfc48a49a1", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242036, "uuid": "f6ba4e03-dd93-4538-b899-a0b2c1702ecc", "value": "49152:32/DjD65r8nm67RV94/br4xfobNdjN/JGReQPLXOunLt7M:m7jer8nDRXIX4xghdjNBGReQDXOMtM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711242036, "uuid": "25ed4a90-9b53-4769-9dc8-7ec883c788cf", "value": 2148288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711242036, "uuid": "9d77a69e-ddab-47c2-b08a-046557da8834", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242036, "uuid": "beee1374-5f60-4e82-bf64-463999147dd9", "value": "e1ed82cbc13b80a7dde61c3708120a21.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "139b6f8a-e9c4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711273884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273884, "uuid": "924cd04d-c5cd-44c5-85fc-67dcc6199c37", "comment": "Malware payload (Mirai)", "value": "f291b5c9359d0166f30e70ba3b2a7b6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273884, "uuid": "8306cf64-24d7-4595-b01b-6c8789df382a", "comment": "Malware payload (Mirai)", "value": "688809ac2f0f2beb45d7ea2beb37fac5e7d164dc9930b32eea3e639103e91e31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273884, "uuid": "1b972522-69ad-4265-a90a-8ba504080cf9", "comment": "Malware payload (Mirai)", "value": "db3dd8809233a6f958b8f0843f404bf9720d6a7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273884, "uuid": "99eea36d-1824-4545-833c-abf034fe053e", "comment": "Malware payload (Mirai)", "value": "fe915111c642b4fc286a260d0b827ee738a9abd62f9db786a363372ec015bc4408afa39690db5ef2fd8f48ef05f25542", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273884, "uuid": "79bed2b1-6ae3-4aa0-8761-686120b08621", "value": "T1C4C34B06FB418B13C4D61779BA9F424A33339794A3DB73065A286FB43F867AE0D53A05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273884, "uuid": "487e88ab-4cd7-4f7c-bef7-4cb7baeb6288", "value": "3072:zCC2zP17XYutxC5X3J8APfqFKDZRbUugsM/9cUw:zCC2zP17XY8xCx3J8APyFYbUmM/9cUw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711273884, "uuid": "060dd0ae-345a-4e5b-ba74-f7bf010c6112", "value": 127583, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711273884, "uuid": "7f4babf9-1b42-4fb3-b74e-73c8ef4a085c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273884, "uuid": "571692b8-48a4-4ae3-b53c-7e5dfa946925", "value": "f291b5c9359d0166f30e70ba3b2a7b6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f899b46-e9ea-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711290252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290252, "uuid": "27510d25-56af-467d-838b-b658373e9416", "comment": "Malware payload", "value": "d9636339310fc72e3c7cdbf2e164a379", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290252, "uuid": "6b04f89e-7319-4ec3-ad93-cb123ac8ee96", "comment": "Malware payload", "value": "6abad63b1beaf538f1badd47910426d77e98f933d7334e618267cbf43f5fd126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290252, "uuid": "2128466d-59ac-4169-bf8d-04353460d075", "comment": "Malware payload", "value": "aecbb93eeb54f3379215ce27be6377458185f8c1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290252, "uuid": "4d4c9036-4016-4412-ab79-89c3110e34f8", "comment": "Malware payload", "value": "251e46bd9a8d5fd2a06c39e7b7e97227622a310d2c393e5df39b23d64c2376f6a0a89546b57f9aca837929cb9be45253", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290252, "uuid": "eb0a8ff3-b47f-47ea-8463-52e64e92fc2b", "value": "T177D3AF1371D1D8B2C8A70171499ACEA5D7FAF930ABA5890377F8078E6E623D1163B353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290252, "uuid": "8686390e-ce05-4a71-b7d4-acc3de060a8c", "value": "e5aa7ffaeb31ae9c34f722c9b0a4833a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290252, "uuid": "80219c51-79e6-454f-821d-daf8ac1518df", "value": "1536:1kooPkUEkswgKPmLzu1kVl7ul/iwab//72k2rvI0A1uj5+w/VvsCTaF2+OL:18s0PMq1Gl1brSVj5+w/t7aFJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711290252, "uuid": "ccaee20b-27ea-4d07-9d1d-59615b70db8d", "value": 136680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711290252, "uuid": "2652a7f4-f7d4-4a9b-a88e-2563c5c48289", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290252, "uuid": "63e0a0e1-2ddc-417e-99a8-1c34e8e56c1e", "value": "SecuriteInfo.com.Trojan.0001140e1.23349.1173", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b999e7ff-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (PythonStealer)", "timestamp": 1711265573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265573, "uuid": "7de4c087-fbae-4054-838e-5c31c51faa8d", "comment": "Malware payload (PythonStealer)", "value": "2a2071ca70ad6eb060fa105663a363f4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265573, "uuid": "783d5db8-f4c2-4a1e-96cd-a9a85d296b3e", "comment": "Malware payload (PythonStealer)", "value": "6bc531752a8aa3bb01126d1533feb5b5e7fb46b7de1a5c023edbce5a0b60286b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265573, "uuid": "af37c11a-bf14-4822-99ea-ed6044936f6c", "comment": "Malware payload (PythonStealer)", "value": "f4f4b1f10e606846af5e05a76611dd6f09d82ce1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265573, "uuid": "8a1c0240-87da-479d-82f7-7e677ab66cdf", "comment": "Malware payload (PythonStealer)", "value": "69e88b3780d44a9220d3fec4a159ac63705428d6797cdd61a28eb8db3f3f456562a4e30db1696b59e296ce8a41c96365", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PythonStealer", "colour": "#F1BDD0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265573, "uuid": "fa4d8941-bcf9-4f5a-a297-12d2f0b53250", "value": "T1D366339AE3134AE8D78FB4F469D45991A674FCB84620D07B021063BB6F977608FB43E4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265573, "uuid": "e8fb4a39-bc56-43d1-ab54-52100b663508", "value": "0817b0523eba4a04e10419286455ac5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265573, "uuid": "87007338-a281-4983-885f-857bdc18ea15", "value": "98304:NDFSZG7EoZkW5/SZzbqsKUy6Sg+41ei6IWrZznOEUb74dnaSvXDHP0:Z4C6zbqdy7zQi6IYnM7MVv0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265573, "uuid": "06691b14-4155-4c3a-9bad-185cd4fabd50", "value": 6766080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265573, "uuid": "37c77598-34d7-44e0-8c25-7bb5dd416a1d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265573, "uuid": "db4e72a5-ef24-4c74-a0d5-c192e843823b", "value": "steamodded_injector.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbae6944-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711265684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265684, "uuid": "b2d13405-ffd6-40b2-9037-9b3f7056763e", "comment": "Malware payload", "value": "23c36291056735c770acd94a1eeb2d74", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265684, "uuid": "2fdb2df5-239f-4baf-a5bc-6de3b8a8f0f7", "comment": "Malware payload", "value": "6d8e4f00f741733562a2c7a4a186bc3323c398d3a6c919e601ee22404be2cd07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265684, "uuid": "8247226f-d200-4344-ba3e-3a5c93083e3d", "comment": "Malware payload", "value": "c9938743be5e89b47babf05c0aa3a9411cd326fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265684, "uuid": "b0d9e46d-6125-42fa-91da-0a2462c62463", "comment": "Malware payload", "value": "d0d9879ce52f9c4674452e41f78c2ac00f7e5e38a80ee0f434058dd8f04a45ae1228bdf3c7990daa7138f8a49c468aff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265684, "uuid": "0e3fa147-2797-4540-bdb8-41704a008b98", "value": "T19C54E0027AD390B1E4B747720C648E124B7FFD314A75896773E8268E5EB05C16A37BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265684, "uuid": "6a1164d5-e6ae-46b9-8b92-cdb432da0d79", "value": "0be152bdfc9ef291ebc79442873fbb26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265684, "uuid": "55132a60-fe85-4f51-b148-6063da291cf7", "value": "6144:omBGQYIVvlIfGAbq/5VayaiH5MUxtkUHiaPK://YIVtrAbqRA6+UxyU3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265684, "uuid": "2c363dd7-2042-4fa5-af3e-16e36e8aa25e", "value": 280800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265684, "uuid": "5cf91243-1f39-4823-a8f8-86985b0f0fb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265684, "uuid": "7452c772-6be0-4bcc-a8dc-e3c3df5ff486", "value": "23c36291056735c770acd94a1eeb2d74.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b9e83d-e9c6-11ee-a120-42010a9c002e", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1711275017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711275017, "uuid": "b7a890e0-0663-494f-8998-5b77f6c58a9e", "comment": "Malware payload (ArkeiStealer)", "value": "1524f984753f60aa2b865ef86b79a58b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711275017, "uuid": "c337e1e1-0e09-47ba-b25a-209b1ddc4397", "comment": "Malware payload (ArkeiStealer)", "value": "6e2f1f2570bb49a0ff0e8b7e781f03d6e7f78798afe053ae373842ec42712702", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711275017, "uuid": "dede6559-4368-419f-9ef3-9ea033419f9d", "comment": "Malware payload (ArkeiStealer)", "value": "07579a5c92e8cc92e3f391a5460d6de74310883b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711275017, "uuid": "31f5e6ea-5d55-4768-93b1-440b479a7faf", "comment": "Malware payload (ArkeiStealer)", "value": "0e9566d2719444409e87a12002d39286bf995abde0208ec987b44113db0328f17a1a17ffebe7e1f7270d05fdf143b983", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711275017, "uuid": "27e15eda-1626-4ee7-892d-0e6f184d7a7b", "value": "T161F37C38C240E16EC4A2407AC97B9B34FD99AB32138915DB53D4E8825B351EDAF3385F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711275017, "uuid": "a4da04df-c3bc-4e0b-ab14-56a9d2ab2c50", "value": "4e06c011d59529bff8e1f1c88254b928", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711275017, "uuid": "91706994-2f69-49e4-8f88-79019366a1d1", "value": "3072:U53/H9YArDiGiDSDCosstkZtqJSp8Bb8EG:W3/WuDi3stJ8EG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711275017, "uuid": "480f644a-47ca-4d49-870e-916af3d613f4", "value": 163328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711275017, "uuid": "ebc5a35d-cb91-4ff1-9413-86ee00bfb5ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711275017, "uuid": "b2293690-654b-4124-a730-a306de5a65ba", "value": "1524f984753f60aa2b865ef86b79a58b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aa0c903-e9e3-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1711287318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711287318, "uuid": "9bd56566-a424-4d00-97ea-213026e91ba5", "comment": "Malware payload (DCRat)", "value": "1cf1c8a6b74890f6d1913bf3b9e46a79", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711287318, "uuid": "8b8b7078-dd4a-47f9-9b01-fb2c75e0e9ab", "comment": "Malware payload (DCRat)", "value": "6efee44acf580c370d19926398438acb40a8c63120bad4e2502d8a847e011239", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711287318, "uuid": "97e54a60-9bcc-4696-8f64-31f64bcde73e", "comment": "Malware payload (DCRat)", "value": "3baa803148359d5ecd3afac11352e8ecab90ceee", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711287318, "uuid": "da5249a4-c075-43a4-8111-49b74d73c199", "comment": "Malware payload (DCRat)", "value": "a73f97ffd0c274b8ce9715285068920d066add8cf99dc89914716cf9b281023e723627c2ae8104c98ab4108083e9bc5e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711287318, "uuid": "faf0f1b8-0454-4e0d-99e6-ad1183c6fd84", "value": "T1F285AD027E44CE21F0195233C2EF450447B0AE542AB6E72B7EBA376D66623937D1D9CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711287318, "uuid": "513d27ab-01b0-49b7-ae49-666b838cd70c", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711287318, "uuid": "eb59972a-880a-4d1e-9c10-3a4aa01958e1", "value": "24576:J2G/nvxW3WAAJElP9nCWgiFzoJNkvnw28BAc1eThSQFdO5q+4OvqLqzvXrJhtZ:JbA3Qa4h527ceSQFdOo+HqLqHfP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711287318, "uuid": "155d3bbe-891a-408c-b915-0ba3c8c03327", "value": 1832598, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711287318, "uuid": "f5e8ddb3-42f7-470b-af15-22c3037edd7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711287318, "uuid": "261b4be8-52f6-48f1-b479-a7a948de9cac", "value": "1cf1c8a6b74890f6d1913bf3b9e46a79.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94955d8d-e9db-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1711283979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283979, "uuid": "f615b1d8-bfe6-4326-9706-9c58c508dfcf", "comment": "Malware payload (Adware.Generic)", "value": "01990d577660c9c67fb442194b088d75", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283979, "uuid": "75c063c7-4645-4bdd-bf33-3ab42616ba68", "comment": "Malware payload (Adware.Generic)", "value": "6f0385a47ee13b6b5232efa0b5413951b18601d889469c45083d76235bc2130d", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283979, "uuid": "031295e5-3c1d-4f4a-b2d4-0fd83be4affb", "comment": "Malware payload (Adware.Generic)", "value": "a1f84565ca0f519e54fb5e49db3a5a646e10367f", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711283979, "uuid": "3138c1da-df4e-472e-873f-84e317d1167d", "comment": "Malware payload (Adware.Generic)", "value": "1b9f34659e62ce84a65d580f7ed38a6a1152f3a1af32794ca98a2c4827b4494e5c3bf010393ee0ce45dfe4923643fc84", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283979, "uuid": "b1f1afa7-7557-4627-82f0-4181406a75f8", "value": "T162B733A36291A06BD566B7340722BD7114F7A4BCB5165E1A32DED08FCB264D00E3BBF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283979, "uuid": "0225b10b-a111-4c3b-9810-7f7ee2e4d743", "value": "eb5bc6ff6263b364dfbfb78bdb48ed59", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283979, "uuid": "923efff4-03b2-46dc-bbd4-9534dce5f206", "value": "786432:maoKAkvKGy/yQ+yeW4j9dvYc2yjWeaq6q90sHHp71MUGDS+Izk07UnV/aaLEY:mJKZS//yNngddqKCZx/gnViawY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711283979, "uuid": "a266c7a3-d0c3-4c8b-96eb-78c7d2967c37", "value": 49152664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711283979, "uuid": "96e711a7-8614-4eb7-9850-b7172a481f54", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711283979, "uuid": "9769215c-3764-4405-a842-5f52eff40193", "value": "SecuriteInfo.com.PUA.PCAcceleratePro.18846.12105", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c69578e-e9b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1711265712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265712, "uuid": "5a78127e-8671-454a-a07a-6ae870b74b1a", "comment": "Malware payload (Rhadamanthys)", "value": "8cca1082f0cb2ab2b60025033d56af56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265712, "uuid": "385c69b2-8d10-4f14-bbed-04c248b70a24", "comment": "Malware payload (Rhadamanthys)", "value": "70a7c05b84920869900bfb4d677f13d57ced658d907d495a1ffe66e1b0d420da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265712, "uuid": "b564f291-f328-407f-b41e-9286f3c37d55", "comment": "Malware payload (Rhadamanthys)", "value": "f3f4fd5a12031d7d1f86bec1665576c5ddab2936", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265712, "uuid": "8b2a3a99-09d0-4c72-8973-95805bdff14c", "comment": "Malware payload (Rhadamanthys)", "value": "084f514436b38fe1f4f482f9e4af026140296c4950cd2bf8f70df2ce68676aa4fff893dd7bc3caac540b4034519fad9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265712, "uuid": "c82db2c5-ec32-4b34-aee4-815722ce67d6", "value": "T1AAC4E10272D2EC70E5728B324E2CC9D41E3EFC624E556B5732187B6F19B10A2DA73B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265712, "uuid": "a74519bb-11d5-45c1-8364-c426591ec3b3", "value": "0be152bdfc9ef291ebc79442873fbb26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265712, "uuid": "5d036398-562d-4be6-96f6-bb599020ef28", "value": "12288:YpfMhcqJOtdh15RgDKKw780M4Z2hHX34:YUNujRgy7hIh334", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265712, "uuid": "3eeace14-0647-487b-adc4-28d3d8dae6b8", "value": 549376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265712, "uuid": "d3b78e8b-7083-4d47-9826-7915e96cbcb3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265712, "uuid": "82a1e1a4-db85-4d59-b9b2-23a998ae3e24", "value": "8cca1082f0cb2ab2b60025033d56af56.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dcc0257-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711265365, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265365, "uuid": "1b290760-cdd3-431e-b318-6373f6e5da33", "comment": "Malware payload (Mirai)", "value": "378730f6eaf90a1ac6026cb740ce09ca", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265365, "uuid": "880dff42-1183-44d9-879b-b99d2bf8756f", "comment": "Malware payload (Mirai)", "value": "74a12c37da10a28d879a3a4517d63b91ea4e06df2cacdbe5722350f398ce3fe2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265365, "uuid": "53f77556-0e40-49ee-ae60-70c145ed0a42", "comment": "Malware payload (Mirai)", "value": "8c9b5e904c3856540c2caf90aa7e16f74318ca7c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265365, "uuid": "04a33f91-c6a9-4d8d-a299-87c0a763d423", "comment": "Malware payload (Mirai)", "value": "1ffee3972afca6e185a3c77a696d068d427789283341510d0409a0565a49c324e3a509d057f066966612cc26db6aa705", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265365, "uuid": "46b986bc-0405-4cdd-86a1-014b03877d58", "value": "T11CF2E071F9622530E2D09974211D4F853A904CBC817FB820B0AA7A8DBD61E661B3EF83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265365, "uuid": "6ebf3c38-a5f7-46ce-86af-46d0a13d3e50", "value": "768:qu9YDJSsqL8dTvlz+kZaJftXp/KJxrKu+lmLSZn9i3ks9q3UELCK:qu9CgsqL8dTlqk41tXp/K/5+sLF3wLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265365, "uuid": "1c880109-52bf-4050-9b6f-fb18a78ae701", "value": 34500, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265365, "uuid": "d30ca540-a84b-467a-8a87-090605ec4004", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265365, "uuid": "4b1ad7be-a9cb-42c6-83b5-bdb1297a0d10", "value": "378730f6eaf90a1ac6026cb740ce09ca", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9291b6b1-e986-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711247468, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247468, "uuid": "84f8135c-05ec-457e-93b5-8f117b672bcc", "comment": "Malware payload", "value": "3a2f4181530a7baa87318af2d05b951d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247468, "uuid": "b6691cef-d08b-41ca-8cb4-7848b38d9926", "comment": "Malware payload", "value": "76cfeb442e2840a54c0d44f57e6f48c13dd266fd9d5e12e6f977d9cc764aad6c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247468, "uuid": "d7523e07-2b56-4ea3-af15-266c7c689410", "comment": "Malware payload", "value": "985e3d794fb8411eed8829eef5764f142ae4fa25", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247468, "uuid": "d13dc547-1890-4d32-aadc-e6b598ec0d29", "comment": "Malware payload", "value": "7077ee4ef0004e3b399e39c67dd5c32003d78222ec9227efe2a3b102fae396741faa4ca76f202001f066ea2040d1928a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247468, "uuid": "dfde6775-c529-4863-8e61-dbfaa9b8454a", "value": "T1009533435901D0D2D980EF713608C9A29C627F931CF1E76C9C4AF6468F72BD3ABC65A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247468, "uuid": "e05034eb-d837-4ff7-880b-beafa8b026e5", "value": "fe5fb373dbec3ba73ffb51335d1fc086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247468, "uuid": "d35adc54-a718-48b0-91f6-e001526822ac", "value": "49152:HGIpewgyJTYTh5xixq+HG1c948ngBb2/mJ0K3deD2VOr2NPT:HGWpJ8V4q+HZe1Bb60d3deDjr2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711247468, "uuid": "cee39864-7346-47dd-a84f-bab23f2d2a7f", "value": 2018752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711247468, "uuid": "67b418d1-94fd-4b2a-b732-744e6a74841c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247468, "uuid": "72fdbf38-6121-42e7-b0c4-2d0284386ffe", "value": "SecuriteInfo.com.Trojan.GenericKD.72085374.27573.2254", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d243e7cd-ea0e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711305987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305987, "uuid": "a30e43ae-3df2-4f77-bdaa-75b7022dc766", "comment": "Malware payload", "value": "808f443d7c7450978c3493d30b6a0cf5", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305987, "uuid": "411d37e6-7370-4c8f-b2d9-f0b197ed3960", "comment": "Malware payload", "value": "77ce9c0e0f7f5b540c7bec12b74b45513287fb3aa93bb4e75489005b5aa0ff28", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305987, "uuid": "4fce9242-2a61-416e-9cdb-5969e822a02d", "comment": "Malware payload", "value": "64c55da5f2ae1b69a60511c652a3cf81f39ecafb", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305987, "uuid": "c4cd401b-fb1b-40ad-9d77-e722ef547ad3", "comment": "Malware payload", "value": "341ec906e3f3a0a10e249303af02417456f6c32a1651e18a16f373e0284ac853f23ea2bf68defbe2293e579da9416a64", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305987, "uuid": "e6b6861e-cb24-410b-83e0-74053c4845bd", "value": "T146632851BC819623C6D212BBF66E02CD3B2613E8D3DE72079D226F2137C695B0D67E85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305987, "uuid": "960a6ee1-a203-4ba7-a77e-3256f34ded18", "value": "1536:XOH8Ctn2pwdPQMICU0+Pp/M59NqamT58AxpxwmSnfdQKv/W5D:XO7Y8sE5jqamT5LfGmk/oD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711305987, "uuid": "cc8e86f7-a4ea-4061-b17f-d4d67c96bf84", "value": 71584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711305987, "uuid": "8067d756-3b2f-46ee-a167-63fe0d6ff2c2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305987, "uuid": "776cbd6a-4304-4b96-b081-0c66030e0226", "value": "bot.arm-20240324-1846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bea216f-ea03-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711301117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711301117, "uuid": "6de02ca9-b8f5-4ba0-8745-de905bd3dde8", "comment": "Malware payload (Formbook)", "value": "1d6590415fa189e9c982e883dc3bcdde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711301117, "uuid": "70b7d149-d4b7-472e-bced-47367a0ec9c3", "comment": "Malware payload (Formbook)", "value": "7803d28b1cfcb0c4f3a63515fea88508357e02dc2ee982f7ff1f0c2f40af3649", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711301117, "uuid": "7dfb48e6-57b8-4ff5-9187-eb580fa2cf1c", "comment": "Malware payload (Formbook)", "value": "8261a5718af6eb9ebee4e822e5bd0138f7915dc3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711301117, "uuid": "f1e16422-95c1-403d-b45c-374a78050ce5", "comment": "Malware payload (Formbook)", "value": "23dcdaf4422e4ab32c45dd1d65b2c89fb106fe8c81ca7e9dba6484170736dcf5fa931a9acfb19bc23ec08abbd1e5338b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711301117, "uuid": "ba0a6f0e-439a-4ae5-892d-407263f40f8e", "value": "T182F53380B81D6DC9F83E6D716CD72FEBF9A53616181AD60A13142A17EEB3C09CC53CA5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711301117, "uuid": "e4ec178a-cf72-4273-97ea-16b4a9c77a01", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711301117, "uuid": "53c8c94c-7d84-426a-b16a-e9a66a037792", "value": "98304:oZ1HRsp8NbXaaIptoNMrF4NOgmwCof84h:oZVIaIpeOrmNOTwCol", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711301117, "uuid": "fceb17f4-fded-4709-816b-96e6821d52fc", "value": 3420160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711301117, "uuid": "b956b9ca-f7e4-4414-b724-0f7cfeb51394", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711301117, "uuid": "368cdcf9-6775-448c-af53-846c3afe366f", "value": "1d6590415fa189e9c982e883dc3bcdde.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d9b5f7-e9ec-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711291355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291355, "uuid": "9cccf7f2-b22e-4851-9265-97a8b0643dc7", "comment": "Malware payload (Formbook)", "value": "777f716b47261f01d1f8d131c7b7c587", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291355, "uuid": "6313a5db-d80b-4281-8422-2d6851cabe53", "comment": "Malware payload (Formbook)", "value": "78b15621d0319e8b7a105e1aa9a1927fb434bfce29e2a4f56051f552e393f08a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291355, "uuid": "aa0e4ac5-89e6-4977-842c-6fe563505a05", "comment": "Malware payload (Formbook)", "value": "ad6ecb132c05290ecd79784f6a8c1f074cb26b89", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291355, "uuid": "9b926626-5849-4ebd-a7cc-7b5140b2c78f", "comment": "Malware payload (Formbook)", "value": "b6a2582f42c9b00b03ca20ef989c58bc85e7c5880e66eb50675c4c48bc9cd7e166b1cf67a168544bf06476e4e05bddfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291355, "uuid": "3104773b-8008-4a69-ab2b-1b4925590195", "value": "T13ED4230586E716FBF96263355C9D365C2B7EC2083D5BFFBE6C9E21CA27A52274014813", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291355, "uuid": "0697b8de-6cd4-4ddc-b757-2b1783af60a7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291355, "uuid": "939a34d1-a627-4195-8a03-676081473c23", "value": "12288:zFOJRYWqMPxhP9grhYkHVAq8US57gXSqp/dsYq0piayf5uQR2oc8ubx:zFOJbdPxDWGkHVAMOgCqvs2pKU0nu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291355, "uuid": "e1942385-2159-4c80-ab95-5efe3f144588", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291355, "uuid": "371b85a3-651b-4ffa-bb14-d7443dbff96d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291355, "uuid": "e6885bfd-8cf9-415f-bc09-68294753b2d9", "value": "rDOC2837464553.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e527aec-e9b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1711265715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265715, "uuid": "af16a3a8-61fd-4eee-b3d9-6d35862ef62f", "comment": "Malware payload (Rhadamanthys)", "value": "c58456f1423e916bde295f230485c1cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265715, "uuid": "ea3b2e91-3940-4c1a-8891-b6a3f983939e", "comment": "Malware payload (Rhadamanthys)", "value": "7956d6d4b29d847f69e99363771fbe91983f4311b407e13860a025ab20869d90", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265715, "uuid": "b886e3f6-1b08-4de4-8226-70fe53543f62", "comment": "Malware payload (Rhadamanthys)", "value": "c6b4c47300e1371680cac2e39a8ce3dc2ada27f6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265715, "uuid": "161ba3b4-8da4-45f3-a7cb-98d8438b519e", "comment": "Malware payload (Rhadamanthys)", "value": "8bcc571bc81cab59ea9d57784eac910ebbdd237dce8cc62599956fc190e19eaef718154757ec631db10b247bcd418e71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265715, "uuid": "af197e0f-b449-40ee-96bf-6f740eca656a", "value": "T153C4E102B2E3EC50F56ECA324D29C5F4263EFC618D19AB5723787B2F14701A3D662B65", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265715, "uuid": "6ba55a3d-8d75-4c74-b7e4-1bff77e30dda", "value": "0be152bdfc9ef291ebc79442873fbb26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265715, "uuid": "f3259380-3673-47d8-a404-109a9da36cc9", "value": "12288:xW1s0S5CXGPawnEf12i4pjq3vnSrV/L+hejV5uUNCl:xgS5T3Et2i4pjqf4V/L+AjXhCl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265715, "uuid": "3f769db1-d7fe-42f8-bb06-da88522197fe", "value": 558080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265715, "uuid": "5fdaa68b-04e8-4a75-9922-a7feccd27e92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265715, "uuid": "9973d8bf-ab7b-4436-9fba-dd830378388e", "value": "c58456f1423e916bde295f230485c1cf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27e12824-e9b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711265758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265758, "uuid": "fe8a9d2d-2805-4332-8a59-26d7e15f8599", "comment": "Malware payload (Mirai)", "value": "47b6d35e402f464f362e32d728f9b0b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265758, "uuid": "bb1d4a68-b76c-4d18-83cb-732f02e415d0", "comment": "Malware payload (Mirai)", "value": "7a3a141da6cf5d5d60e9f9388799362b750c404518617406d03ad42722538e1d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265758, "uuid": "cb338aa4-5664-48c6-acb4-67709ffa468b", "comment": "Malware payload (Mirai)", "value": "4a2b566ccf3bacaacaecf9408594114da0141325", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265758, "uuid": "7af5039a-c537-4aab-94f9-0431d78fe736", "comment": "Malware payload (Mirai)", "value": "db280d26db359ae43bf336538200f4ca508fc0673e08e10953dbc9ed411a953571a754bf14a6ce64416c6704fba63391", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265758, "uuid": "bc503b5c-ae58-452f-873e-f39ca9382f83", "value": "T186E2F29CA9C424E2C5BF0CBC451A0F769918F590B24F6B8A62014DDCFF4AF4B4D948BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265758, "uuid": "6bafe7f0-bf79-4cf4-9ce6-6ddf35dd7c8e", "value": "384:/n6Ppdqf3I54hJulN7s1kNYTA/fKiFs4V9B6f8Oj0bCwFtNKpugmQ/zTRWGVCz0m:P4YuDs1kNJ/fKiFUf8OGCgG/bdWJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265758, "uuid": "97d50a9e-b2f0-4bf0-ab48-e9c54645735d", "value": 32028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265758, "uuid": "3115f027-1190-4843-85bb-0e0fdd9987ad", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265758, "uuid": "c0445bdd-ad06-4468-aae0-603ffca7eaff", "value": "47b6d35e402f464f362e32d728f9b0b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e6a567-e9ec-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1711291254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291254, "uuid": "003705fb-cffa-4e42-8946-b96ee8dbc1f5", "comment": "Malware payload (AsyncRAT)", "value": "0088e23e1938555eb6b425b3c0cc512d", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291254, "uuid": "f6b64066-5e9c-4c4e-8169-ca480d7dc520", "comment": "Malware payload (AsyncRAT)", "value": "7ad0f0311b7f8ffad3133178adf9605db676b930a2b9fb9a5247616d2d4c3a9e", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291254, "uuid": "69634079-62a5-49c7-95a6-38b02a474407", "comment": "Malware payload (AsyncRAT)", "value": "2a3fde30e9bc44b7dda01e6e5ae6ae8145fb0ea0", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291254, "uuid": "1638661b-77ab-4a44-802a-364a62d24d64", "comment": "Malware payload (AsyncRAT)", "value": "a7602639a7737d2a9794393b7186216a32ddb6465bbfc87dc2d5157a1e8ecb8dc7e51c01cab20759d7fbac1840ad9aa5", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "tar", "colour": "#0BC0E3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291254, "uuid": "b4db23d6-4b2b-4f84-9070-df88aadf2fce", "value": "T19DA412B133F68A03D67A49F48571A66007F7BD1A5402D7CCACED30DD5AE3B448BA2A47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291254, "uuid": "eca3301b-d1b7-4835-a1d9-efb4a760a1ba", "value": "12288:XT7M4mCX6nP7Jz8V3Ec3NJnoxV27nI344cNJNDnXqpFcRzEuxuZhFe0R:jYegPd63Ec3Pwd44cNJNCFwzZuZLe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291254, "uuid": "7ca954d5-1999-49e8-843d-69c85dc3684c", "value": 479744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291254, "uuid": "8beff4ac-d010-4c67-b39d-519089b5cbb6", "value": "application/x-tar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291254, "uuid": "e2f315e3-e4eb-49a0-8b7c-9f214e892a7c", "value": "nInvoice-AWB-Document.tar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42408f38-e9c1-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711272674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711272674, "uuid": "4ced7552-94a6-45eb-b93a-04b551d802aa", "comment": "Malware payload", "value": "29b6abe158203df777e4ea6c10650774", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711272674, "uuid": "d560c25a-7d5e-43ae-9724-3fc45ef1c2f5", "comment": "Malware payload", "value": "7c64dbc662ee66a3f79259189330fa98740a5a021d878e92c290e7236204b5da", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711272674, "uuid": "10fcbe5e-5b74-47d8-9646-4c0a36f0a0c5", "comment": "Malware payload", "value": "9c03a9adf758d96eea9358f5a098fd87d7c6ffdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711272674, "uuid": "fb4f0f59-c54e-49b2-869f-16664aa032cf", "comment": "Malware payload", "value": "f8bd0c2048eb7cba44a2bb82148914cbaca858ef5d27ae726602bbee374dfa462e9bb216cdb00f54029cdaa1e6943151", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711272674, "uuid": "5889ce1b-3089-4047-a201-19ae28bb371a", "value": "T1AE9501D668442DB0DADE8B38917A795C88688C473FBA35BE7172F0404BBDD895331AC7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711272674, "uuid": "514990ac-44e7-415f-9820-a252d401e035", "value": "fe5fb373dbec3ba73ffb51335d1fc086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711272674, "uuid": "3f4352dc-2f60-4f93-b4d7-6c63c8876901", "value": "49152:61OOKgkBsWP5UXpv4k6rKRTgDsDv3AOhRWtNXK3hCglZN7JoO/dxe40Kzz++BGtV:61ZNKe54k6aWsDv3hbWtA3hCENdfFY4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711272674, "uuid": "8a31f1e9-ea77-4108-b3ad-1f87c83ab89b", "value": 2009360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711272674, "uuid": "f93ed55e-2851-481e-964a-b8b8564eb97c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711272674, "uuid": "8720eb8c-ed3f-46ee-bb20-23206a4c6b44", "value": "SecuriteInfo.com.Trojan.GenericKD.72085485.27709.28970", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a307d56-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268822, "uuid": "1b61e2b1-c0f6-4d57-832a-ce0668470bfe", "comment": "Malware payload", "value": "542aca8826e3f8a97e4b0468c31f154b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268822, "uuid": "0bda7ebf-8920-4e95-803b-a2af91eba926", "comment": "Malware payload", "value": "7d3dd72b6c622b0a48aca0bc0a6e0bda5ecfe7776cdf7f075aca5fe1dd5f58f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268822, "uuid": "e892aa6d-5199-4401-b698-2be58ca5a843", "comment": "Malware payload", "value": "53d964ee9ebd36f6bdca650f09252c8da5c82200", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268822, "uuid": "7b751214-bfd1-4989-ae99-93f0671f4aa5", "comment": "Malware payload", "value": "5733ab5a6eb99b7b212e5be1e950b41dbb653abb29cb49b9bde3bf611839da68b6dd0a8e198cf9639cd19936a61aa539", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268822, "uuid": "dac3feda-7d74-4737-af3b-e720e6bd27e4", "value": "T175E2B007DB0364A1DAD148F017F348C62EB8A3326BE909E7F65982D91D943D02B5E63F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268822, "uuid": "6f6260e4-14f5-43c7-9641-0adc9c257817", "value": "2ce3a028f67b8cd50455db6ac7115c66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268822, "uuid": "e81c9575-f621-4128-ada6-3c36729ccbfe", "value": "384:qhQG0ihzFV7sUyiJVlpa6FxjnBWtcNNFqN3HcfBLAzfRZF9al+DnLZ9nXQXUXVPW:1G0oRBbBFxCcNPOchALjzn9VZ7paqI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268822, "uuid": "e096f2a3-4a53-4b13-82f3-20abd9512a74", "value": 33848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268822, "uuid": "d22a8fa4-0545-4ee5-a60b-e28f5444c250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268822, "uuid": "d367a865-6315-4bd9-9a74-bc08f7c93802", "value": "SecuriteInfo.com.Unwanted-Program.00587b831.5339.6631", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23152262-e9c4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711273910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273910, "uuid": "d6bb67d1-ee88-440e-88e4-6bba10544e6b", "comment": "Malware payload (Mirai)", "value": "008af656a6e05eb0f1db870eae43d812", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273910, "uuid": "5b2f4aff-ab92-42be-abda-da6d43df53b3", "comment": "Malware payload (Mirai)", "value": "7deceeaf2c51f40ef0644628f157db1e1146826c036f7c08995e02d58d4336f0", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273910, "uuid": "bddb919d-d59b-47d0-aa7e-12905b778c15", "comment": "Malware payload (Mirai)", "value": "aa9236e88913172b759c92baf735565770d0852f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273910, "uuid": "235da7ad-8a67-4109-b340-0a2ef7921c39", "comment": "Malware payload (Mirai)", "value": "9ee11db9fa7eb96cd6b36c3b9cd8658578525ac2a69f9ea10ce505aac6729fc93518d0b577e2300d1742a00aca3b2952", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273910, "uuid": "2c88cc77-f923-4682-ac1d-3150bf36c14a", "value": "T16E43E813F54241FCC996C43846AFA43BEC6779FD163CB6962B84BA319D22D221E38D85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273910, "uuid": "72a26cc0-b751-4154-85a6-06badf1d7ecb", "value": "768:tG9wLw72KMhycpB1wM+mW8zOg6cnbIFzAR0Pr5S1BVxgvnw2EUxnw2EUsu:8T72KMhycn2jpDF0R0No1go2r+2rs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711273910, "uuid": "b82cf799-d2fa-47ba-9a16-a7efb60468b7", "value": 57088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711273910, "uuid": "535242c2-8a86-486d-a2fc-1d4f8058a05b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273910, "uuid": "6951fded-d4f5-4a8a-9117-8d85ad1cc851", "value": "008af656a6e05eb0f1db870eae43d812", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87a57ce3-e9ec-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711291259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291259, "uuid": "8a80066e-aa70-47ba-bbef-fae4915edfa5", "comment": "Malware payload (AgentTesla)", "value": "50c2d334c691b43163a048c0117f5d87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291259, "uuid": "fc235ce4-a9fa-4381-aba2-59fce272624d", "comment": "Malware payload (AgentTesla)", "value": "7e714a80d7aa37f095574ad215cea691c865fc3314bae6489346974f6c4cbefd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291259, "uuid": "61d9d33e-8e1a-43cc-ac47-418e3a01fba7", "comment": "Malware payload (AgentTesla)", "value": "13ad3b8af8c8a9aa058887ca48bfee410ed7d750", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291259, "uuid": "24756ae9-2206-4c57-ba82-03401a986fb2", "comment": "Malware payload (AgentTesla)", "value": "333a17433fd62dc3458212a2efe5690505ed3dd436c3d85dd360ff60423bc92ae7661845d7638e3415f087c5f3fd4579", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291259, "uuid": "f3093625-a41b-45be-8077-dea0e9020930", "value": "T1C7E4235137E81637EEF1AAF48C3198410BB960AB4915C2DE1DCDB1DD24EAB118272F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291259, "uuid": "874eeffc-acdf-4d28-bcde-a802213e1697", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291259, "uuid": "da545146-46dc-4c53-a18e-04af16e85b6a", "value": "12288:Il/Uq0AxN1kz0MbcETdqQP+kj1jRXCOEs6sFS3fZi7azsZwoZ+LfoYVn5pwk:Il/Uq0AxN1ZIcGdqUjJRXp6ssr2n4pL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291259, "uuid": "0fab9c0c-3716-4f7b-bcdf-2b0cb0ee08e5", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291259, "uuid": "3fc80d34-a050-4b96-8dc4-5bb5d85f0459", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291259, "uuid": "cbb07cc7-ea85-4554-a85d-d4622ffebc9a", "value": "rBoymoBZeE3WVwdL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb528507-ea20-11ee-a120-42010a9c002e", "comment": "Malware payload (Nitol)", "timestamp": 1711313706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711313706, "uuid": "4d699722-2518-4b9c-a05e-798fdb234717", "comment": "Malware payload (Nitol)", "value": "5e16c2c77a0ffa99e1566e9667057675", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711313706, "uuid": "8a565f76-cc7f-4a62-86a9-84cbb50cff36", "comment": "Malware payload (Nitol)", "value": "800496c36c7a3285afa7613989a7719062940c7fbe0fd8e11d7c49ca9fddaee2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711313706, "uuid": "4292edb7-8b4a-49dc-a3c8-bb2ca202a936", "comment": "Malware payload (Nitol)", "value": "274b6ea9b3632ec95c5c71494469e784981733b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711313706, "uuid": "72a3f3a4-9d26-46c9-a1ff-c17b2f60c19d", "comment": "Malware payload (Nitol)", "value": "dcd2133d04659dc15bfc218377b61375b7140ee97b4b619977c8ccf39a3337521b2bd5d285ab16163727c3924e113aee", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Nitol", "colour": "#2681EE", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711313706, "uuid": "dbaa85eb-7b3a-4f12-be6f-a12735bf9b88", "value": "T17F84D014F641C42DF0C681F5EBB9CBBFF4289AB0234428D3B7E4A69627351E5593298F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711313706, "uuid": "b982d711-e2fb-4d31-8a0e-c9dc6e74f529", "value": "032ac126bef9dc99c70a99a6b91b16f2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711313706, "uuid": "0536980c-a597-4f0b-a601-c8ff2396388c", "value": "3072:RvK/yLrQbWaR5Qax8c/Yt5Kgm45EWWdfnaZf2j4lu:ROyLEbWaR5CchE6nmux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711313706, "uuid": "b20eb160-6d2e-4dd3-b237-9408b32be72d", "value": 385024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711313706, "uuid": "b4dc5c88-f84a-4d5c-bcd4-466ae793518a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711313706, "uuid": "4bffc8f9-559d-41c0-9257-ddf61ed3e7c1", "value": "5e16c2c77a0ffa99e1566e9667057675", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b71388f-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268824, "uuid": "bf54cd1a-8ac9-48bf-a9ba-998d6ec267ce", "comment": "Malware payload", "value": "dff30d47326226ef3f79e705179be75e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268824, "uuid": "e4c767b4-eae3-4e1b-8d5a-5973e1a43681", "comment": "Malware payload", "value": "81021c3a553ec2d618dad97966071370fb4903fe55b4296e65debf52e9b2bcc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268824, "uuid": "7dd2fdef-2dc2-40de-94d8-782f6f228069", "comment": "Malware payload", "value": "eb9441a16311f77befba1ab2102aa7faa0c9fdd4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268824, "uuid": "6b6b06f4-679f-45bd-9437-32c7c50d8d68", "comment": "Malware payload", "value": "6554a655782c27059bc86c2a9d74ecdd185fee053df339d4c999ab9c3c97ac8a2166e36650cff19842703e2b8096bfaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268824, "uuid": "9e84605b-1391-4712-a431-ea3792202244", "value": "T11864D0157AC1C8F2C80A943104E5EB265A7AE6301F61C7D7BB584E7B7F602E21E791CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268824, "uuid": "d1316894-0510-4835-a2fe-9ff946c3539d", "value": "b4b50f01529bb76779ed95a70fbeb1eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268824, "uuid": "c70cfcce-f10e-4ce8-8329-cc7d3c19c711", "value": "6144:/3Y4lLCo44rlVeukmKiuwv11rf1Ar3QA5CWB1K:/tGo44ByiuwNV1AbQWjK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268824, "uuid": "bcf657dd-9279-4856-b94f-a96103cbe256", "value": 313400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268824, "uuid": "e44fcad1-41f4-4dc1-930d-ab6001ed4dfe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268824, "uuid": "b53fd441-ccab-4c90-9896-c9a44a34f4ce", "value": "SecuriteInfo.com.FileRepMalware.15311.18063", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7ef60a4-ea0e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711305969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305969, "uuid": "446cc19e-3185-4636-8809-0424c6e0a426", "comment": "Malware payload (Mirai)", "value": "5f7deb5f1d93a45f97df7cac8b46d333", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305969, "uuid": "9af4e87b-5ce1-4f3c-a423-88b5899076d6", "comment": "Malware payload (Mirai)", "value": "82fc9ae92f7551f3ca77e7ff3d4aa61d8cd2630f4eda2fd56c8803b5ae4a5984", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305969, "uuid": "5b22e00a-0ea6-4339-bc9d-b308f82170ac", "comment": "Malware payload (Mirai)", "value": "cba4e24e543aacbfc8234494145bbfcee8c880d7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305969, "uuid": "5c4c4171-0a74-4c14-9794-3127efc39b07", "comment": "Malware payload (Mirai)", "value": "5aa4401032dc15553295a5c22666a1de85e8dece847f7ceefe6eee62068f318a1e9a0a9c615214ab3b013242187adf7a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305969, "uuid": "79465258-9295-4492-b964-05271a562b3f", "value": "T12B730856F8814B22C5D5127AF91E118E332317F8E3DEB2139D206B2477C696B0E37D55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305969, "uuid": "eabb94a5-9941-4390-b03e-f978337cd51b", "value": "1536:AsnuKvvKGg5JyOatlpXSFNWr+FxpvaNfW6vIqiysr8Azc58YIWXh:lvyGWfqXi1FxpvaNhsr8Azc+R+h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711305969, "uuid": "d8ccfea7-6554-4985-b69f-0358dcd4c802", "value": 79360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711305969, "uuid": "f7acb921-5b1d-4310-9db1-3e7c72034cc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305969, "uuid": "f453d6d4-28b5-4d75-8dbb-e7e736025cb0", "value": "bot.arm6-20240324-1846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca6589a-e997-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711254733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254733, "uuid": "a61ece58-4d0a-42a0-a75d-2c0412318593", "comment": "Malware payload", "value": "71c34fe8a479c6ce58b6fee34bf88a5f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254733, "uuid": "a41dc04e-98e2-48cf-9748-365ae20d0d7c", "comment": "Malware payload", "value": "844d0aa8c4d1a230d0467aa8f8c1c4f0c6b047d3198556c8b4758437bca00bc0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254733, "uuid": "66e131ab-05a0-42bf-b3b0-f84c4449f137", "comment": "Malware payload", "value": "24e38623a977b53c852cc5033f909e5e539be028", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254733, "uuid": "2fc9a73b-82f2-4591-b9a4-f5852adb693d", "comment": "Malware payload", "value": "20f5748e1848bb1922a9bbb33b33f5a0e5244ab979cf150e5db1d047f8f8e8617f413617d4540285efb46da3bc2df3c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254733, "uuid": "6be4c2fc-bd26-40b8-9761-7daceb6eb13c", "value": "T183A53334CAA3190ADA4E43330CE2595ACCFCD060B5B50B4AB79D802CDEB2F56ADD51BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254733, "uuid": "f3424955-07d1-4f40-ba42-18ea9399fa5e", "value": "a299f363784f7fd850945604d44940fe", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254733, "uuid": "c8dc7a99-f918-46b2-9dad-c9febb9f079f", "value": "49152:ua7g0KroUkGOOkUZ9QUxLlYRNJQBHxE6SlK:W0wPkG9kYQ4WZQIvQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711254733, "uuid": "757a0f44-6432-4079-8bf2-e276ed58cde8", "value": 2155424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711254733, "uuid": "45258dfc-ebe9-4333-ae7d-1e99d61c00a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254733, "uuid": "b283a6c4-42bd-477b-a3ab-73a66d72ef7b", "value": "SecuriteInfo.com.BScope.Adware.MyWebSearch.30197.31077", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "878d7b10-e97e-11ee-a120-42010a9c002e", "comment": "Malware payload (PureLogStealer)", "timestamp": 1711244014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711244014, "uuid": "e81dbdeb-b4b5-44a2-af1c-f418a570fa3b", "comment": "Malware payload (PureLogStealer)", "value": "b5208f91466898363a7dffc9798dfb99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711244014, "uuid": "8c41fe3e-0e7b-42f7-9fc9-8ded7a282825", "comment": "Malware payload (PureLogStealer)", "value": "8831149594da6932f7d05736d5bba5881e2349f251129a2e3d727cb99fdacf66", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711244014, "uuid": "f08ebabf-7ff3-4883-81ed-ec5260b8b020", "comment": "Malware payload (PureLogStealer)", "value": "36ab8696879a3adaba10e97bdbb6522e5653cf8e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711244014, "uuid": "42ee9c1d-168d-4a8d-a3d7-55148d28a474", "comment": "Malware payload (PureLogStealer)", "value": "cdc8011099e2833291ae1d280ee4eff3708863974db509401312a3d73df250c41d1dab6ed5d700df7f31fda55cf95bdb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711244014, "uuid": "e8736713-6cd6-4767-96e2-08382bc52c5c", "value": "T18E8633837BD70279D5828676D48A81890D2335611DF4B5BB3EFBCF0E0DB42E25AF6690", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711244014, "uuid": "cc3793d7-471b-4f75-b57e-ba5b801bd80a", "value": "20dd26497880c05caed9305b3c8b9109", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711244014, "uuid": "8ab7e3f7-20ef-4be1-8374-77cff8082031", "value": "196608:YWH6oUBcIzwx6ZOFroX+8Snye19xzx3KHcP5rhGT:2oUBcIBZOFc+8+ye19xU8P5dS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711244014, "uuid": "71e16113-0c8c-462f-8b12-e08b3665b08e", "value": 8127960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711244014, "uuid": "a960fc6a-1889-4818-b4a5-335720247757", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711244014, "uuid": "1e7f4423-b97e-410c-86f0-ac1cbdf7a9cb", "value": "SecuriteInfo.com.Program.Unwanted.5177.16995.23183", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7659305-e9db-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711284037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711284037, "uuid": "0f52777c-1d86-498e-8706-0981422152c8", "comment": "Malware payload (RedLineStealer)", "value": "380fd37db71449a4a1855a0475c05edb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711284037, "uuid": "3d1f7a7c-72ee-4a2c-b1d7-07df09d804f2", "comment": "Malware payload (RedLineStealer)", "value": "8964c329759b76bef968db9126bf2052f334baaf6e4cbcde52371ffc66b45187", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711284037, "uuid": "5e39aa1e-51bb-4e4c-ab01-539728edc44b", "comment": "Malware payload (RedLineStealer)", "value": "f7e10aae523a86fb6c23a8fed9d042f9e82dc557", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711284037, "uuid": "a870c3be-0f14-4d3b-b4f7-9f9c69199b8f", "comment": "Malware payload (RedLineStealer)", "value": "9ddf10e233a39f62f8044436a7b4b06448cdd5c29f3ad25de7684e36d76d0a36ef43a1e43f30da72f27c0218357493b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711284037, "uuid": "f4c99c32-2af4-4805-aeaf-34df89ae99ca", "value": "T1D4741305B75B40B6CA0AC679E48E90C007FCE70AD92BDB9F78DD114B1D257E9D4C12E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711284037, "uuid": "3499ad15-c315-4385-a4e2-6d4afb732871", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711284037, "uuid": "6c3e28a1-d697-47b6-947f-1f19a422ca9a", "value": "6144:mjrNhfh0Hl0eigaYddfnLBKSf8S6Lt7ttxGLvLaihTKcPorix7+jyXY:Yzgig/HT/kNVt+LvLakwNx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711284037, "uuid": "4464e3af-dfd5-4072-983c-f26a34b1a012", "value": 346624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711284037, "uuid": "378cb3a9-d559-4c8b-95f6-924f0ee17d13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711284037, "uuid": "c6c0a85e-2b0d-4d71-b31f-6e834ef90055", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c02b984-e974-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711239646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239646, "uuid": "780723f1-05d7-42dc-9ede-703167e2a97d", "comment": "Malware payload (Mirai)", "value": "c9f0f179938b95130d68f1a30a1cfd37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239646, "uuid": "a452d546-765f-45ad-ba9c-6c4863475e7a", "comment": "Malware payload (Mirai)", "value": "8a52dbe6e5aee4ba35c1e9042708cabcb70d53d4c811695e3a2ad174cc1aa12b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239646, "uuid": "392d0b73-b13b-44c0-9e8e-af24d6552b28", "comment": "Malware payload (Mirai)", "value": "dc6b53a562eee45b3babfdb33b49375da897ac47", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239646, "uuid": "09d44f32-03d1-441b-a977-910a1c87a4e5", "comment": "Malware payload (Mirai)", "value": "170ea35518c7951c23aae9b3bac4211285bb4baaf05ec9a7341ced8a9bc7e1a46131d4045f2ea4b59be71fb54760fffb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239646, "uuid": "c5ebbc1a-dddd-49bd-bf29-7bcd764965df", "value": "T147935C22772A4923C0E6553840EBD737B7F68BC52A30520BBA619FDC3B5A6E031537E5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239646, "uuid": "c0730c89-2db1-4a5f-8564-6667d271c6f2", "value": "1536:lWj1J0lBZAhBWfSPmgZtvpNICeDWR/UmngphVn/WHt:lWj/0lDAqumghmCeDWlUmnMht/yt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711239646, "uuid": "5e7f9647-e019-4e2e-9cb6-915eab0f2175", "value": 93993, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711239646, "uuid": "2e8ae200-5ece-46e6-bd93-ea3e9eaf8c55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239646, "uuid": "aee3c632-a19d-4913-a6d7-5ef0b4bc32f6", "value": "c9f0f179938b95130d68f1a30a1cfd37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "578257a4-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265408, "uuid": "32c7c6cc-48f7-453d-ae0d-611e223cd018", "comment": "Malware payload (Gafgyt)", "value": "7b5d70f2ae145d3ffd0aece973ea3314", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265408, "uuid": "2268de5f-4595-4ba7-aeb5-a7651c53211d", "comment": "Malware payload (Gafgyt)", "value": "8cfdcaf4611fd855672ad561de196417deea97341f45efd02e97e26d4674291d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265408, "uuid": "e887bb19-5b84-490c-80bf-9396a8b66acb", "comment": "Malware payload (Gafgyt)", "value": "2f1081711952ec0aaf93d886bc5636d96da756d4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265408, "uuid": "a5a37082-2e9b-4b0e-a7b9-2b3a11beb048", "comment": "Malware payload (Gafgyt)", "value": "846e541632c52feec03f2b736403ec10ae971db296a5397818beb27a95f16f367085b967c36cb969874c7f195b100726", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265408, "uuid": "b783363c-d538-4e4e-accc-b84c3bb18cbe", "value": "T189A33C06E3A2C1B3E4871B7602EBD6350631F9674B1E9F06E35D6EF4AB02584719A337", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265408, "uuid": "57aaec20-8e3a-4d48-8367-020358a81d33", "value": "1536:ccCca2l02U1bhr7psgJSyAySGBFFB8R+pKhgRZx8dtCmbE/38qRuqi0:c7cPHU1b1XJbAdaFf8MpK2XyMmg/3XRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265408, "uuid": "07ba8107-71c0-488f-8234-24fd13c79f94", "value": 98191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265408, "uuid": "6cd665e6-5852-4c21-a65a-455c51e5c4d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265408, "uuid": "fa9dccc9-b249-4825-8f30-c2f5b714a87e", "value": "7b5d70f2ae145d3ffd0aece973ea3314", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "827067c0-e9c9-11ee-a120-42010a9c002e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1711276218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711276218, "uuid": "2a68cedc-c75a-4c1f-a3b1-fb51bb27cf06", "comment": "Malware payload (OrcusRAT)", "value": "0374a5265d5ec5febcd31867d36fc3b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711276218, "uuid": "4afefe0c-5a10-470a-b398-62888d57b7f6", "comment": "Malware payload (OrcusRAT)", "value": "8dea2d324a4bf1fb49bd5eaf009fdafaa4001807912efff03f411082e01d24b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711276218, "uuid": "c7f987c8-5c6a-41f6-80a2-8fd5aba90501", "comment": "Malware payload (OrcusRAT)", "value": "7a0ddd9ea155a4bc7decf202fba4f3ab00945308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711276218, "uuid": "1d2c3db1-d9e3-4c69-9bea-45b13f700e90", "comment": "Malware payload (OrcusRAT)", "value": "768f362614f7d97e824cde63c199d88b089177bb914e78d628d8d24b587b1394cf53391b2922e6dba3a1dc9ea3c6ab8a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711276218, "uuid": "0de9448a-26b0-46cd-b671-eb2cb7a07a5a", "value": "T1AC2512C1D9698F33E31982BFF1D294224A36D4766C9AC0BEBC2DF17B5E5CB60C225502", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711276218, "uuid": "e523a6a6-dfb3-4d7d-ac70-427b4462e7fd", "value": "24576:He3veFbXAD9zWi4MxO6m6b/fYLGACf9Dtc2Py/+:He/etqzXOu1Ff9DtTyW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711276218, "uuid": "ba9db8b2-89f0-4b97-adcd-56318b4c662c", "value": 1016912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711276218, "uuid": "9e27f03e-c841-4e40-b94b-6581cfaf129a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711276218, "uuid": "35d6cf92-95cd-4343-b42b-65ad4f4783aa", "value": "0374a5265d5ec5febcd31867d36fc3b0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff82a670-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711265690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265690, "uuid": "5beca6e5-af1f-48af-b7f2-aa4d0a50da01", "comment": "Malware payload (LummaStealer)", "value": "746438ff428c71654f7498f3ff1fe140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265690, "uuid": "3b5d5ac1-604b-4308-89ac-326710a0d0e5", "comment": "Malware payload (LummaStealer)", "value": "902ffc3373b854572ad2e3a8e05775430c61a7c59ed7e2ccaba7d6bc2fd2b828", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265690, "uuid": "42490113-6eef-47cb-bb94-9df5cf636ad9", "comment": "Malware payload (LummaStealer)", "value": "7c88ae492a66adbaa7dd4e657b43185980b288ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265690, "uuid": "682bae82-8129-4eec-abc8-6b36f1b64caf", "comment": "Malware payload (LummaStealer)", "value": "c06d2a942e04efe0cedaccb2dd7ad26c2493f5d437da448935ed3f7d31810798676fabee0b18d64c201f809a7683a97b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265690, "uuid": "ae6a4492-d7b8-4c01-b956-fdee2f5a514b", "value": "T18884CF03B2D1BC60F5B687324D29C5A4263EFC718E196B6733587B6F18B01A2D673762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265690, "uuid": "0b423d25-620f-4ba6-92ca-bf5d16053dce", "value": "0be152bdfc9ef291ebc79442873fbb26", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265690, "uuid": "20949d2f-3afb-48c7-bc32-e0877254c6f1", "value": "6144:omBGQYIVvlIfGAbq/5VayaiH5MUxtkUHiaP88B3zI://YIVtrAbqRA6+UxyU3U8BD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265690, "uuid": "7810d50d-5e7c-4c05-8ca5-3d1591d7044f", "value": 394240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265690, "uuid": "6eb9e830-76f3-4d02-987b-4351fad060bf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265690, "uuid": "3ca192cf-8f32-48ca-a943-9c5e529aba00", "value": "746438ff428c71654f7498f3ff1fe140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45fb49cc-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268815, "uuid": "26ad953c-af18-43d5-8c7c-fff96e23203e", "comment": "Malware payload", "value": "66e1094e84990bb04a189a46eee8b13d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268815, "uuid": "9d2c6d76-9b72-4c4f-9d53-8d7b8ddea655", "comment": "Malware payload", "value": "90cec72880202a2b581ba1069ee9abcea5967a58affd53d927f4f73537ff3991", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268815, "uuid": "d5cfc290-0bc7-40ef-a154-c3e4add55e70", "comment": "Malware payload", "value": "f0955ad810ba3db9f76323da1ff5209c9003f61a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268815, "uuid": "f1aac2db-3a14-4329-b424-4ceb94ebb940", "comment": "Malware payload", "value": "36045595939e45e65a1c56df7153059141cc7274f857f5b08a0e42dd8d8965db33fcfd5f556d0896a0584fd968b88583", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268815, "uuid": "9bd3cf9c-6091-4721-9bb5-85b0fa1ecc1b", "value": "T170550282FB9A84B9DDCF1274323B971D9166A6814BD0C1C3D7586E9FEF232C25C3614A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268815, "uuid": "014d6435-5af6-482e-8d24-3ee4f402e3f2", "value": "c36083bf87fbac009393e9e37affa898", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268815, "uuid": "0903643c-8860-4b01-884a-b6e52a6c4939", "value": "24576:RLoBxb3d3puTiMIZZBpC63OI1oM0CMuDCUS4zbJFb5+69gjWQBxmOpBczV3hy:Mx3E3CZnbM754/vaVBA+qzV3hy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268815, "uuid": "b79ae93b-8a00-4b0e-a151-68173d9da1ea", "value": 1328184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268815, "uuid": "71b8675b-5349-4c98-ae15-e330ffa9ad50", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268815, "uuid": "e976db4b-1bd1-465c-988b-6dd85f97b99f", "value": "SecuriteInfo.com.W32.Wews.A.gen.Eldorado.11533.24729", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c704d13-e9f3-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.Generic)", "timestamp": 1711294112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711294112, "uuid": "d5ea39b1-767a-42c0-a9e0-c6db15d1b617", "comment": "Malware payload (Adware.Generic)", "value": "32bba6cdb55d3fb83cc16080889dbeb0", "object_relation": "md5", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711294112, "uuid": "dced53a0-2cc2-4783-90f1-0e6fa6b66d53", "comment": "Malware payload (Adware.Generic)", "value": "912932393cbec42250785fa33d300ad6debb9a861f8c2afb850f1d26410bcfc6", "object_relation": "sha256", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711294112, "uuid": "c5b7bf31-02ba-44fe-8bbf-ab11a78a636c", "comment": "Malware payload (Adware.Generic)", "value": "cf646993449954d787294382aee14f55743a0b40", "object_relation": "sha1", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711294112, "uuid": "ae404e2c-c8a5-4541-b389-ab3d2a820492", "comment": "Malware payload (Adware.Generic)", "value": "0badc606a346837707912aaa0831d6bc336b2ce1fedab1d92c339fcec8022baeb39668adc9b6acab5582f1e791e54b2c", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Generic", "colour": "#7894CF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711294112, "uuid": "089e0060-4702-47d1-b130-d00a738809a1", "value": "T1FBB5E03FF268A13EC5AE1B3105B39210997BBA61781A8C1E47FC384DCF765601E3B656", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711294112, "uuid": "9e22e050-ea07-4ff7-b331-30c3629559f1", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711294112, "uuid": "f99edce6-b999-4c11-bf8f-7e76cc31447b", "value": "49152:tBuZrEUXvVkx3a1xEbMVc6M+KS5ZV55DdN7POGjv:7kLQ3a3Eec6M+JH55ljv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711294112, "uuid": "91831c9e-fa7d-446b-b802-2bcb9335fbee", "value": 2490101, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711294112, "uuid": "9fc09b5c-92c9-41c6-9406-77807ec06daf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711294112, "uuid": "d11918af-79bc-4297-8c84-582eb4fc4584", "value": "SecuriteInfo.com.Trojan.SuspectCRC.13923.28428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e72eac0-e99c-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711256937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711256937, "uuid": "57daa70d-b638-4beb-89b9-1524b309f685", "comment": "Malware payload (LummaStealer)", "value": "059e591f9dda7d3ee0de23f64d791cb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711256937, "uuid": "af487318-5c86-4cb7-bc25-885fe9a21c89", "comment": "Malware payload (LummaStealer)", "value": "9550addd57ac80afc9a177a5e7c9e961892d96593296bac79ec7a6ea65cc12d9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711256937, "uuid": "a9e09752-4d06-4566-9e4d-639350f7483b", "comment": "Malware payload (LummaStealer)", "value": "55e1be730e1426d00354e994f3596764d40634a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711256937, "uuid": "0b2ff08c-667b-482f-a15f-45bf95144fe0", "comment": "Malware payload (LummaStealer)", "value": "738fb1176e2796d8eab3a2f6bcc3614a9161bc7dbbca7f8eecb3483ebb0bee17fe7853322d0983147402186d2213745f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711256937, "uuid": "00114778-9ce6-4bcc-b0a4-83279425a03e", "value": "T19874011FBA945721C1566679C0D3401503E4E2A7B1BBE34E3E4A03CA1E07BE7CD9EE86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711256937, "uuid": "dba77978-2d7d-4e4a-8775-64db1da94e78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711256937, "uuid": "cd7769b8-d786-4913-bf17-95fbf2791fb3", "value": "6144:m2MvkA3qTWHeffgUEmNkJykFilk8pU4uMChoZH8lqtfUiNn7Lp15:3MvlaThgUEmWJz8VuM8yH8IsiNnHn5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711256937, "uuid": "106daebd-6fb6-4898-b584-b4b6712be6e7", "value": 359424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711256937, "uuid": "27500164-5326-45b5-9a9f-25877b40553c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711256937, "uuid": "c9e62972-ee1a-4042-87ae-c484f4dde43c", "value": "059e591f9dda7d3ee0de23f64d791cb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89e70d74-ea27-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711316603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711316603, "uuid": "90909fcf-137c-4616-b0ba-c8fe485707ab", "comment": "Malware payload", "value": "aa7554fb38eb05288f7a74735999e920", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711316603, "uuid": "8f9d8195-c993-4043-ae47-e1f1d4447c9a", "comment": "Malware payload", "value": "96cf74926856e25b18f6c12c13e8093200a0b89db345ad0511c77659d0d25f1f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711316603, "uuid": "cdb0e286-b897-447b-b868-821dba4ef184", "comment": "Malware payload", "value": "8142826aac2be2739b7b03c2f446f561fc1151a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711316603, "uuid": "4a0624c0-6426-4cbb-b44c-445ba5190d93", "comment": "Malware payload", "value": "27ba5ec579077c7e7fe8ef97fc34321fb62b4d723e73164e9f86eca3d9d60e30f8aa053dadf9f07afb101dd650dde09c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711316603, "uuid": "8ceada1f-c1ea-4387-b00f-4de1f063a91b", "value": "T13F52D7BDA22368F3E17A59B414E6EFB1C93978234C734931FA90D282F53CB90B215167", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711316603, "uuid": "1c1e0d60-40cd-468a-8879-59e1d2966735", "value": "e9e98df639c35c794fd44c3163bacf7b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711316603, "uuid": "14684cdb-3cb8-4a10-a6c6-49d1b27228a9", "value": "192:T8Ueko0awm9s2yHvWXomicRHwjfqgGou:gbk2yPW4A+f9P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711316603, "uuid": "eda7cb6a-2f07-4153-996a-3a5f7b3678ac", "value": 13312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711316603, "uuid": "6fe538d1-52f4-47ee-af87-93668ee5f969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711316603, "uuid": "eac4fbe9-4ee0-4a55-b4bd-fe5ab4c7f41a", "value": "aa7554fb38eb05288f7a74735999e920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba5bce07-ea06-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711302511, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711302511, "uuid": "8b98e5aa-737d-4510-ba47-06888fe64695", "comment": "Malware payload (AgentTesla)", "value": "e31742e177ab89c57261b8464217d459", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711302511, "uuid": "c82dbac4-78ac-4ba1-bb27-d4fb3b89e078", "comment": "Malware payload (AgentTesla)", "value": "99cfd5ce295586761fd7188ce635b5768fd546b959e12769099645a32dcc9670", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711302511, "uuid": "bbf2a50b-1106-439f-a980-a0ab39eec43b", "comment": "Malware payload (AgentTesla)", "value": "4003f294d2349b2116557d467f4e336b72088513", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711302511, "uuid": "d5240708-320c-42d0-957f-1db560bb71e9", "comment": "Malware payload (AgentTesla)", "value": "7283090fbf06fa76c39c91c3b47820536b2fe052a88af482541acb48755389047ab96b129ca9c44a7fdade5a581c43cd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711302511, "uuid": "0d565c81-09bf-448e-a175-0fffb838cd81", "value": "T1F7D42328E37CAA3FECBE45B46D04D2A1557CA31AB7E3C2BB404FE4091652385747AF19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711302511, "uuid": "0458f22f-045b-474c-956e-c7c6ef3b20a1", "value": "12288:w7WkQKwUSac4kYKS6q0GENi2TCMx03MBuZuZJ6Ov6uGkBBz037lyrBSjKZmEYt:w7dJwUSKFKS6qcNFGucsuMJ6Ov6Mp03l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711302511, "uuid": "3551f834-de31-4a51-a483-462c7546ce17", "value": 628820, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711302511, "uuid": "57e2adb0-d4d2-428b-b542-104a96c697d5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711302511, "uuid": "4e5535fe-a879-4565-83bf-4d3e380e05b9", "value": "NEW ORDER QUOTATION REQUEST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b5648e-ea2e-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711319757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319757, "uuid": "ff1f6015-6eb8-4a33-82c8-8c16fabd06a1", "comment": "Malware payload", "value": "37a193112bd3af6c71f7e98837dbfb3f", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319757, "uuid": "18dc1f64-676e-439f-aa88-6a5f65a2b0ef", "comment": "Malware payload", "value": "9c7a12678651d72127c3c6e4dac250439fa4a3be0a8728754cea327c86a529a2", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319757, "uuid": "74d9d56f-5ff1-4f33-9dd5-cbd96feb4877", "comment": "Malware payload", "value": "253937627e0729ca2cb81b286c8f35d7421417b3", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319757, "uuid": "39daad13-7e77-4c2e-b402-2875dc6cc062", "comment": "Malware payload", "value": "6dff76fe4f3b7adf4aab86092ce14aa851b10c4c79519565c425b49fdb9dbc6c0278719a01c99fc7703a3de821adca31", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "Tsunami", "colour": "#BE6B05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711319757, "uuid": "c9b0b718-3bbe-4713-b44f-031816cbbef5", "value": "T15F23016FF2FC003BE0E51738BEBD0E399F5C6069AFDA228005AC52892A7D0938D5C525", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711319757, "uuid": "2a52a1b8-5c1b-4a71-8440-fe68b2b7b653", "value": "768:tY/ko7wrEIjqbBs0eMyRi4Wb6tRihbR4+gE6y4CswG1yyo+7n5yTvnKqCAC:tK2AIWbW5E4YuQbR4U6yW750iqCAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711319757, "uuid": "7c33c2eb-7d52-4d11-b159-56bb39cda1f2", "value": 49536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711319757, "uuid": "03db7173-863a-46d1-9f53-8862ec17f93f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711319757, "uuid": "e3eb3982-9a2c-441b-a7cf-0abe1f6ae93c", "value": "37a193112bd3af6c71f7e98837dbfb3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f595709-e986-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1711247436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247436, "uuid": "7e2bf5c0-c9b6-48e1-a4b0-4b238a11cb23", "comment": "Malware payload (Socks5Systemz)", "value": "f3f25d297e62930f87471d53806c9a40", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247436, "uuid": "c7ad0d05-e807-466a-ab2f-f8b2707dbe1b", "comment": "Malware payload (Socks5Systemz)", "value": "9f03088fe6d06a375fcfeefb08d11cedf5b8865ddd29ec5e593309555c55d0e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247436, "uuid": "d74f4424-bd8e-474f-be62-aaaccaccda20", "comment": "Malware payload (Socks5Systemz)", "value": "595ed64b276faac81f0a2d6380f64295b0674119", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247436, "uuid": "f8eeb724-37f9-4841-84bc-1a7410c216af", "comment": "Malware payload (Socks5Systemz)", "value": "72187143eef807de2de7c8ac4348dc906917bc7db20efb57635ad58648accbb683297a33797cc28a4c236d3f603ef0a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247436, "uuid": "76fc4154-ac93-4785-bf21-d132f2a82cbf", "value": "T138B5331166A12476EB549FFB0D600537A563B32A6B34604837DCDB6CFF3B006F46A3A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247436, "uuid": "fd2d5ecb-a32e-4224-b0af-3fd041d7cece", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247436, "uuid": "66ff1d3c-59fe-49f8-bf85-be7db4fb19d2", "value": "49152:32JVLn+sUNYgQEu8SQ1MaoHd82o4vEoO9iws+SmL967+NHz1PncM:mJV7+srQuak1vEoFwzL9++N5PncM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711247436, "uuid": "a36c7368-06e8-42b4-9cf2-6ca5f57219c1", "value": 2274085, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711247436, "uuid": "277761e7-b226-4f25-aa6a-c404ed970a29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247436, "uuid": "c1d8380e-b0e9-46ac-b121-6bc789fec7cf", "value": "f3f25d297e62930f87471d53806c9a40.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f6c28d3-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268804, "uuid": "2711cf24-3d76-4964-8344-61c82d9ae269", "comment": "Malware payload", "value": "c5811c59a0cfc82dbde5ac4a5d7c6305", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268804, "uuid": "93f456f5-2436-4f21-9cce-504c7af7e4ab", "comment": "Malware payload", "value": "9f3577a4d32799c90fdac88b55728b9e3458a98a8d922e6339cc3394cd54f99a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268804, "uuid": "0364a686-bd7b-4209-afbf-bbfdfc3fe448", "comment": "Malware payload", "value": "271a96025b4fc8a961530283d0390fbd2a4ea1f3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268804, "uuid": "780d66f9-9141-401c-a993-ae41aa247834", "comment": "Malware payload", "value": "1739787903f774bf609815cfaca449bd0dfcf4a9d97f9e382ca6995a906c3bb54ccf21c7971e14a85b5cc5d3388bc745", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268804, "uuid": "c4f249a7-2ae5-41f4-8572-b12c11d5da02", "value": "T151E2C0019F119421E7410F701BF2ED5DAABD1F92775291ABFB52F0873EB17443B4892A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268804, "uuid": "2489d066-9d0a-41cc-9c46-71b96ba02b05", "value": "2ce3a028f67b8cd50455db6ac7115c66", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268804, "uuid": "80240284-aec8-4e8e-a65c-85384e24caa4", "value": "768:4W0z6KG+B1pDdzj2fXQcFUSH7fVZ7paqI5:hbE1fzjIFUmZ7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268804, "uuid": "8a2e9f93-804e-4443-8952-60c0a4df4417", "value": 33848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268804, "uuid": "4c1bae43-9c43-4ec5-9697-d1f40a785334", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268804, "uuid": "edbc1333-046e-4216-a83f-a338b483bdb6", "value": "SecuriteInfo.com.BScope.Adware.Softcnapp.20417.10720", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb905eb0-ea0e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711305976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305976, "uuid": "672fdea7-47da-44fd-add0-c5b48d06fb8f", "comment": "Malware payload (Mirai)", "value": "ccdf82263d66e2e6d2a06467d4d1ef7f", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305976, "uuid": "c1630ace-dee3-46d7-803f-0fdf97ec8a96", "comment": "Malware payload (Mirai)", "value": "a032864f9d2a4554884f5f84b3ef1ff5bf44b71c290be32d7c2fcf844d74c0b9", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305976, "uuid": "986241fb-e599-4045-852b-1766e8f32091", "comment": "Malware payload (Mirai)", "value": "9bcda368d6e53dff8adc2c35648881d6948b33df", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305976, "uuid": "e1f782fb-37bc-4a8b-b162-de1872a4fc8a", "comment": "Malware payload (Mirai)", "value": "9c1ac59fcacaf204388bb210d39309307bc1e391d857549f973067198641d575cc1427517469822d7cfa5fa46eaa8e37", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305976, "uuid": "86806372-9a91-478a-b70c-77a70402ef0d", "value": "T15FE32A56FA814B13C0D61779B6EF424533239BA493DB73069928BBF43F8679B0E23905", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305976, "uuid": "c7d7c38d-fc75-4ab9-ae38-897ed2c98ed2", "value": "3072:Hq853Rkp6Ipca3nG6o4bYEl23pk3A+S+v2vJM/9Fdc7:Hq85uoOca3nG6o4MEllQf+v2xM/9M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711305976, "uuid": "585d07f2-a7c6-4d25-bf3e-8b87a1ee9c31", "value": 153008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711305976, "uuid": "219154b7-0aab-45e4-9122-6bd5b25d1246", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305976, "uuid": "b934929d-517c-443d-9f5d-6bf3f6f34ed5", "value": "bot.arm7-20240324-1846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f187bc9-e98d-11ee-a120-42010a9c002e", "comment": "Malware payload (QuasarRAT)", "timestamp": 1711250442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711250442, "uuid": "d5385a17-2de3-4f13-8adc-8275064bad5f", "comment": "Malware payload (QuasarRAT)", "value": "cb83f8f89ba1ddb971f451d0f2d9c2ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711250442, "uuid": "257c9eee-c325-4da9-bf12-14079ce8583e", "comment": "Malware payload (QuasarRAT)", "value": "a39273f1d1194875d532810da2f842c3927f5f853f5f749c0aa040519678057e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711250442, "uuid": "993493f7-a53a-4ca3-bedd-0c248a7c4748", "comment": "Malware payload (QuasarRAT)", "value": "339cfc2ee60247bf8127b90bc5d285eb44cd51d4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711250442, "uuid": "cf6b1f23-8b9f-4e9f-afab-5d6e5adcfe40", "comment": "Malware payload (QuasarRAT)", "value": "a8e1e9d55b18ee5f9176244ad950bfbf4b4a9a784bb48c67148b4f02cda9d98bcbda26ccb8dc112d0107b88fe1dc0f0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711250442, "uuid": "154ff4f9-d2c6-429e-a6d0-71340b7a7d78", "value": "T1CEE54A1437F85E23E1BBE273D5B0041267F1EC2AB363FB5B6181677A1C93B505841AAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711250442, "uuid": "dc98255c-32f3-49a5-ae2b-1086f721d54d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711250442, "uuid": "cd009670-f2d5-4f62-8ba1-63570851ed05", "value": "49152:Lvjz92YpaQI6oPZlhP3ReybewowCO1J9LoGdkWwTHHB72eh2NT:LvX92YpaQI6oPZlhP3YybewowCsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711250442, "uuid": "5771db24-b92e-4b1b-b051-05a92dc829e1", "value": 3266048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711250442, "uuid": "e34daa0d-d7bf-4074-a94d-01b4fcf9d54f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711250442, "uuid": "204b5c14-20bd-4c38-9f8f-5b5c016f2377", "value": "CB83F8F89BA1DDB971F451D0F2D9C2AD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e30d4b5-ea12-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711307430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307430, "uuid": "49533c54-3c76-42bd-8806-80dbe21eddbd", "comment": "Malware payload", "value": "a1fe2997f33d33c75860f5fefd961c54", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307430, "uuid": "3eaa313d-b3ae-4e07-8b6c-d02a3d3b0bc6", "comment": "Malware payload", "value": "a800ad4ee42e0e8e0b21b51f88a322e6452edd9952ce900d8f1b326364b2a37c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307430, "uuid": "7a9a3f8c-b4a4-46c5-ba7c-e01df2aaa754", "comment": "Malware payload", "value": "d087fd1f8538c2e27da7eb3616caa823d8c00269", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711307430, "uuid": "06bc4c57-afc8-4d1f-b6fa-49babbacc5eb", "comment": "Malware payload", "value": "ac6e19f4f198268c66e09230fe84365a989d95bbaa8027a4b451f691a9f0d23781363e5ac41c551045c51cc159d04050", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307430, "uuid": "bd1f6b3d-3573-4099-b68b-6f6a98a8f357", "value": "T17C563320A840C451D2E11E3260F5DB78692AF9211B628D2BFFD94B7D5D25BE13CB3B1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307430, "uuid": "8a0f338a-ab40-4517-aa87-63a181129144", "value": "332197ba5fd76061827e542a2853acf2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307430, "uuid": "2521055d-3652-4136-a5b1-71c4f3ad1094", "value": "98304:GU0gZX8OL+H6xKMKrJSxFAIzxtM63DIXGeBxx7xiLfkxJNfwqHphymEcwTWGKrwT:GoVB+H68ME8xFjFzDIh7Vxio3ZJEmEcg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711307430, "uuid": "da6807bc-543a-46f1-8595-74666acbb972", "value": 5945330, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711307430, "uuid": "2c091fec-5348-45d0-abd7-7b0860430146", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711307430, "uuid": "20f57206-28da-49a8-9e77-e453dc3f5af4", "value": "1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9838a092-e986-11ee-a120-42010a9c002e", "comment": "Malware payload (Adware.InstallCore)", "timestamp": 1711247478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247478, "uuid": "afea2982-87c5-48ac-ad7b-e1c2e67c8af6", "comment": "Malware payload (Adware.InstallCore)", "value": "fd5ed81daf2265218bbb11f21743320e", "object_relation": "md5", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247478, "uuid": "614ae433-f66b-43bd-8c47-e9f66292d83c", "comment": "Malware payload (Adware.InstallCore)", "value": "a8797c832092bd4bb851831e34fed617e6368acb6b4a419190df07e3d11eae0e", "object_relation": "sha256", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247478, "uuid": "8d5035e7-7188-4021-9c21-6a6478b8bf90", "comment": "Malware payload (Adware.InstallCore)", "value": "837147f1522a2aa8fff7bcf31aa69f828e82192c", "object_relation": "sha1", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247478, "uuid": "de42030b-dccf-4b0d-af39-196200eb5d24", "comment": "Malware payload (Adware.InstallCore)", "value": "0e7e30478d4e54ae2cc18d3f7802be2f4c2ec72b5dec75e44e1e800fb01918bec03e819cedbc73a9f7463fe7a3e52836", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.InstallCore", "colour": "#35D5E5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247478, "uuid": "d3f59979-b919-48c0-80b9-a7b55a7bd1a5", "value": "T1AAF633199E42CE35D68DA17016B3CE3567AE2CE8443C4A58B9CFFB7DE935500AF53288", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247478, "uuid": "6006f5f7-c9cc-4f36-b482-6824faa8fdcd", "value": "2fb819a19fe4dee5c03e8c6a79342f79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247478, "uuid": "0725eee7-ee19-4259-b673-1836ec1e9f86", "value": "393216:3yJM3E2RqbLeBb7wwv+36rEO5HGwnteFyszs48YVxoO:0M3ZRqfeBb0wmGEO5H+Asp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711247478, "uuid": "2d392cb3-9909-4491-a2ab-2254d50e1022", "value": 15537945, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711247478, "uuid": "b671a7fa-4254-4414-a8f1-5bbd70cfdb00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247478, "uuid": "a88df74d-014b-4795-859a-97bf5589dbd9", "value": "SecuriteInfo.com.Unwanted-Program.004d38111.13011.17795", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed25d51-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268803, "uuid": "3d6eecc6-6520-4353-b628-da4c76383dfb", "comment": "Malware payload", "value": "54fb287bdbb21f89c14dd09154ffff05", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268803, "uuid": "abb70444-5df5-463e-9740-d15fd083f60b", "comment": "Malware payload", "value": "ab112a0205b4d976bdeea5a36291e9aa8a1d1c21921b2122441b0ff0ded119aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268803, "uuid": "ebd7dfb1-b810-41fb-9740-2a2c2a3ad8b3", "comment": "Malware payload", "value": "cc4b774fc914b550f5a2fab9f5d525e723a97d17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268803, "uuid": "17c38b1b-762a-4d20-a49a-06c8853d46c0", "comment": "Malware payload", "value": "aed432b62f4a8e21fb8f0297d8e3f64d71f415ff6e5c14ec817defbd03c0baab09dcf73645a8f0914be576b641efd2cc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268803, "uuid": "a48af50f-ca64-4efa-9e27-7ecf4b04fd4f", "value": "T12654860AB74447DEE0572F7DD400D11869A2EEC62B0032FF376D7A96C2B5F912871AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268803, "uuid": "fd2b4e75-e888-4570-9d40-12ed0796fabe", "value": "84cd1ddf0ce9c6a74d331bc445074f42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268803, "uuid": "d7b5427b-584d-41c2-8cd2-ccafb14000e2", "value": "3072:n1G0sELXVE8tT/wFetENNXVmMfqgOMPV1E1f3IWlfwQvBU:n1QOW6ENFfqgOMPrOPlfVBU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268803, "uuid": "c1d977bd-6eae-441a-ab5c-1150fc8749f5", "value": 287800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268803, "uuid": "6ddeff28-49f1-49c7-8948-d52c869c654a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268803, "uuid": "6cd93ea8-eee9-4346-aed4-b4352a428c1c", "value": "SecuriteInfo.com.BScope.Adware.Wews.19872.20433", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "469d739b-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265380, "uuid": "9cd48db3-ef0b-40df-a3da-b994b0e45e38", "comment": "Malware payload (Gafgyt)", "value": "9e7502a085f10b02c1fa8c82df796f9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265380, "uuid": "7d16b146-d7e7-47d3-949e-141a7577ef46", "comment": "Malware payload (Gafgyt)", "value": "ab5ee18fd3df5a2d7f2d84c75b33fd2f73b76c8e0d2df278d9ded40943d16911", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265380, "uuid": "854f4e0a-7154-42a4-9b65-3d0f8a923bc5", "comment": "Malware payload (Gafgyt)", "value": "4aaa7e9d5860c7be2b364cf9b12d691aef8c6f4a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265380, "uuid": "033273e2-1bbb-437e-821e-5985f0c4a2a2", "comment": "Malware payload (Gafgyt)", "value": "2cb5f8b69a98063ac2068133e34e38487b3319a1c27a24fbd3a556ddd32c8069fa8b0ec10b04c2210040b9ab5c83adae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265380, "uuid": "b4b2c2b7-f1cc-4fab-8a84-35fe358d9da6", "value": "T1F7E3E917ABA15EBBC81ECE3301EA862111CEE1961295BB6F7274CB1CF74B94E09D3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265380, "uuid": "c4829b6f-e17d-4cdc-a8e8-a9332724e29f", "value": "3072:BX6sex58DceQVnlfw8a9DvQ9AxLxVmV+cEuuId:BX6tM2nlfrODvNmV+czuId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265380, "uuid": "b1cdbedd-a518-4479-a8cc-c191e221e650", "value": 155851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265380, "uuid": "4b3aedc3-56d8-4132-9ed5-ee9e51179a2f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265380, "uuid": "0e2145bb-3d6f-4c94-ae6a-6b39796c48ee", "value": "9e7502a085f10b02c1fa8c82df796f9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b39101f7-e983-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1711246235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711246235, "uuid": "bd89672b-1868-4e61-abba-713eab63ef8b", "comment": "Malware payload (Socks5Systemz)", "value": "641f8516e40cd57175e08290cb569e8f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711246235, "uuid": "bb5d5335-f185-4e87-ab2f-6cf652902eae", "comment": "Malware payload (Socks5Systemz)", "value": "acf1a8ba6e2046871a9aee94d88264ec9e40906beace50132592996bba3b7947", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711246235, "uuid": "27846c38-d303-4c24-b5e2-acc78adaceed", "comment": "Malware payload (Socks5Systemz)", "value": "8660b99ea39ecee95cdaf6de87d6db1fb6f6184b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711246235, "uuid": "77eba9e1-a1d3-4dad-ad09-1bce5ada1d9d", "comment": "Malware payload (Socks5Systemz)", "value": "e1ab7fbc35a8d539bd3f62984ae3f15ffce0b4053a51716ec98b6c41b397a4f57938e178cd7f4a28e1a3f1aa2e292c42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711246235, "uuid": "43b21620-f2de-4d2c-91a6-a96330d48d96", "value": "T1F8A533222BE519F9F4409EF20D12E1ED9C6BBE516A2439083A9C7C1E1B2F9595B4F343", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711246235, "uuid": "ee232fff-2e25-4dac-a6de-785ee33d2ac4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711246235, "uuid": "e04ff213-6c6a-4bc6-8a59-6ddb7bdd0f12", "value": "49152:320rxrsX/GZZlreAilqYVPkCwA4hd74RjsXdHk791O/vVpYaFhgC9M:mgS/kZlre9kYVMCvAwjMmHm//M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711246235, "uuid": "5d3ab8cb-a85c-467e-9b26-498af6899e80", "value": 2213840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711246235, "uuid": "2b5cf28b-087c-45c3-af0c-77d50243b9f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711246235, "uuid": "2ac309e6-e201-41f2-8db9-d54ad99dbacc", "value": "641f8516e40cd57175e08290cb569e8f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cddf6ae-e9bd-11ee-a120-42010a9c002e", "comment": "Malware payload (Glupteba)", "timestamp": 1711271108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711271108, "uuid": "623c99f6-8410-4d51-8823-98cff87abe25", "comment": "Malware payload (Glupteba)", "value": "faeea4484adbb16f4f37872b15d9972a", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711271108, "uuid": "06d5e618-0cc0-4380-9e37-2eeaf860de2c", "comment": "Malware payload (Glupteba)", "value": "adffd52446d0d94c4f726205482a0c062248d6eb35948df937336957cf747db8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711271108, "uuid": "dd84765c-543d-4075-825d-fe58faa744ee", "comment": "Malware payload (Glupteba)", "value": "34f5f1a5545344916dad04807ca07743258099be", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711271108, "uuid": "ce411a53-a253-402a-a131-3fe1b94479ae", "comment": "Malware payload (Glupteba)", "value": "2a196f1a2ec26c38de38e8515299a445a01931f23d148b5faa58b7956ab0123f73f62092a02ad4f6729d189c6616ba44", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Glupteba", "colour": "#9BA385", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711271108, "uuid": "4457af61-d7c2-41af-b97e-34c209709796", "value": "T1778422B0FB980129CEFF667EAEB2510155B2E397AA02DB5D0D9C440F199BBC41710FB6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711271108, "uuid": "95c9fe60-9119-4a60-8f9e-36c345bb76ed", "value": "12288:VvpMG3BLI6HW0XuX7XVGB7AKtyqLETeZEDb4C2:VvpM81z+LXV8tvLAeZMb4t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711271108, "uuid": "e32784b3-1b62-4d9a-b890-11aeb4c3549f", "value": 405240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711271108, "uuid": "fcdfaed4-4fd9-45b1-81b9-675f34ee8deb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711271108, "uuid": "4bb75858-82e3-4686-9c1e-df640cd6b44d", "value": "faeea4484adbb16f4f37872b15d9972a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cdfbf465-e9fb-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1711297819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711297819, "uuid": "956fd8b3-7f85-4bf2-bb99-b4f5b4b66920", "comment": "Malware payload (DCRat)", "value": "0660b68bc5d772462c7aed99f73ffe4f", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711297819, "uuid": "0a742fb8-e582-417c-bd93-97d7f65ef413", "comment": "Malware payload (DCRat)", "value": "aed6efbcad60ad52492ceb3f0da88bd7d457a7531cc43a7808c630cf5166bdbb", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711297819, "uuid": "b2d786c7-0bea-42fa-b899-454cdb900f24", "comment": "Malware payload (DCRat)", "value": "6f2e2da6d19be101f234c9bf20bba4f21bbc3cdb", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711297819, "uuid": "48fc2ef2-2848-4344-989a-2f8c47f73573", "comment": "Malware payload (DCRat)", "value": "9650571b6837724a2dab5cf0e2a2ffb422a77231c10e408be8ed64ba4654c1e8cc0da1101027e3230be65f7bc39bf03b", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711297819, "uuid": "a1a5d7f1-fe49-41c3-864b-aae8cc2ab453", "value": "T111F5E04696924A73C365BB31A4E7101F42A4CAB67516FF1B3A1E64D56D0B332CF223B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711297819, "uuid": "56bf7b1d-7767-4183-b8c7-ffe2619f1e3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711297819, "uuid": "3f476d4f-8233-44ac-b38c-f4c06ee25ee0", "value": "98304:5ZBpajg6xyTkPVXRCuTEGDo2cGrLL9leylId1l:5jpaRxpO2Ejwpbl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711297819, "uuid": "3a251c98-dd4f-49b5-a6e3-8ee302e89eb9", "value": 3572736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711297819, "uuid": "3ee48e10-bff6-4a6b-b696-8d12eb94b388", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711297819, "uuid": "d92a5df7-fd2a-4918-93af-8bdd8cdec0ac", "value": "0660b68bc5d772462c7aed99f73ffe4f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08e7682e-e9c5-11ee-a120-42010a9c002e", "comment": "Malware payload (Smoke Loader)", "timestamp": 1711274296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711274296, "uuid": "7ad714c3-5040-415d-8012-96eec69d40ed", "comment": "Malware payload (Smoke Loader)", "value": "5360fe5781d535acfbaeedd08e9c5b04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711274296, "uuid": "4ae0a659-496f-4c46-bd9c-f1609c92cc0b", "comment": "Malware payload (Smoke Loader)", "value": "b1637a25a2959c9a6da241d94d8ddac92f3e542d86dbebdc47c1a06a4f6190a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711274296, "uuid": "00d93bff-6a94-4dbf-b9b9-187d8e27a740", "comment": "Malware payload (Smoke Loader)", "value": "1d1aede764c4396086a9847c193b1ee15b528ea2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711274296, "uuid": "24986b30-e795-49f2-bf27-8e08b2e7785f", "comment": "Malware payload (Smoke Loader)", "value": "5d83bc2c03f863233800763418308b2cb19b5d0c7109c6df575822717d76fd99b25cd984bb735fa72c15151275dad8de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711274296, "uuid": "e0a04d62-7a36-4311-87d2-e07f056b9d9a", "value": "T10E549E03B2E2AC74E5B247325D2DC5D8263FF9314E656B7B23485A2F14B10A1C673B7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711274296, "uuid": "4eaf2eed-4729-428b-9b04-8205fdf62d16", "value": "3cfe9daad23da8bd86bfcc4d4948195e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711274296, "uuid": "6000a4ee-1b4e-47d9-b74d-0e92660422cd", "value": "3072:p/c24x3493JSl4C+VunyX/Bo7bAGGT6XL1MS6DdWcvMNm2zDngP9mQ6FIwG:p/Yl4CAi/o6XCSwMNm2a9m1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711274296, "uuid": "cd89a097-a2ba-4e4c-8655-d5c201fc7a9e", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711274296, "uuid": "db8c9d0b-107d-498c-9f43-bbf41cd034b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711274296, "uuid": "ff317a6d-4167-4d4d-a0a7-140763c93fbe", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc29e75e-e99d-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711257524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711257524, "uuid": "b5241c4a-7b2d-4bec-b456-b4209dac9dbc", "comment": "Malware payload (AgentTesla)", "value": "1f58225b0f2b8424292c1e20274ee351", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711257524, "uuid": "c7b4603e-502b-4901-a2d0-e0d218261025", "comment": "Malware payload (AgentTesla)", "value": "b19eb31edea25385e18376946f4a39e4b51a1eedc0b6cbf8c1bd90dacdbbe2c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711257524, "uuid": "242fc3c3-8086-4252-9ddc-094939ed0290", "comment": "Malware payload (AgentTesla)", "value": "22980882826c6ae11394a229894ee61b9fddd616", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711257524, "uuid": "681dd5d5-7bf9-45b9-a468-8ce613f7d343", "comment": "Malware payload (AgentTesla)", "value": "c9ef57a73c4fe76ad19967ccb333226e4bebc606c3f9fc45fa5eab69be8d8a0275d819a67f7a02f48bc90f53f3257a8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711257524, "uuid": "c69dc65d-6149-4c7f-ac85-f0ddae5e95df", "value": "T1DCF41253AE28B047CC4E2133755A074D1A2B1E1E7EE6FB57890FF289D7B32881575C82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711257524, "uuid": "d470bfaa-bb50-4944-bde7-9f2532cc76e3", "value": "12288:5aRJcEqJRVLXeOlOMqRJiF0Q74KAkkE03cokZt1qcT:ARoJverAj7ONfkZt1q8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711257524, "uuid": "340ca5d8-a322-49dc-ab58-52cec64c7c78", "value": 772692, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711257524, "uuid": "2e5d815d-377c-4c2f-b75e-6ea183825c3f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711257524, "uuid": "cec81cc3-9153-4e4e-b49f-b8e7e9b747b5", "value": "SecuriteInfo.com.Win64.PWSX-gen.371.14469", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc15ae44-e975-11ee-a120-42010a9c002e", "comment": "Malware payload (Anubis)", "timestamp": 1711240290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240290, "uuid": "6938e2a5-c7ff-4900-bc08-881042133156", "comment": "Malware payload (Anubis)", "value": "18a3c09ce58b3db05cf248730adb6bd0", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240290, "uuid": "ebfaab4b-05e9-4a0e-a501-1df15a8114ba", "comment": "Malware payload (Anubis)", "value": "b4bd65520d764bea63e2956f63cfe1e79109aa63efc39f3fd938e29df77cf0fd", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240290, "uuid": "042b3fc4-6779-458e-94cd-86db91723eeb", "comment": "Malware payload (Anubis)", "value": "b8df9c4fbc07539f5b25929b132d97c1416b6710", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240290, "uuid": "f2968e7c-64f6-4afe-8ac6-6e64cd2ea14b", "comment": "Malware payload (Anubis)", "value": "5396fed92f395981b86fcc21bcdbc2eb3790111e7a46609650ac9a0210a860205170fe41035422a95d98fbc1a7d291dc", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "Anubis", "colour": "#CA26C4", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711240290, "uuid": "a10f54c7-71b5-4d9a-9671-56636b0b45f9", "value": "T16B742315E8EA4391F027B6FD591737ABE824935752EC3B09374849C8F9DAC99AF2C304", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711240290, "uuid": "b6d2d37f-b059-4f07-b1ff-67c6632d4ae9", "value": "6144:DTomipFaxl2ZkyY47C+uGFKkOsOQwT7gTnEJD0VilSIKexXSFuauAvGh:DUmipFayvu+uqKkKQ+DliFuauAvGh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711240290, "uuid": "67f068b6-92c5-450f-bfe3-9e48695f68de", "value": 370274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711240290, "uuid": "97f57bbb-a703-4242-8916-beed0b9b1b93", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711240290, "uuid": "acc1cfb3-d2c2-48a5-bffb-b794982d84c2", "value": "AndroidUpdates.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72df5351-ea2a-11ee-a120-42010a9c002e", "comment": "Malware payload (RiseProStealer)", "timestamp": 1711317853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711317853, "uuid": "20e22a65-8179-4aee-bff1-8eca71566d25", "comment": "Malware payload (RiseProStealer)", "value": "3d8020adaca6738f5902dff8547f155c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711317853, "uuid": "63325747-7a37-4e05-a276-550661d6f051", "comment": "Malware payload (RiseProStealer)", "value": "b6a9cb3a4c33c5e04c8dc3519835ea0d9598c3a2dd0da293d597c66bad3b3bcf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711317853, "uuid": "32a01548-1e70-4517-823e-6f87be603994", "comment": "Malware payload (RiseProStealer)", "value": "6b9b7f53cf64d04361d4e33c52f0820c95c56377", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711317853, "uuid": "361943f0-50f0-4ab0-8af1-f072dd74628a", "comment": "Malware payload (RiseProStealer)", "value": "79142c2f7ce1740ccef881499f6186b76bc1814481f005848ecd26f116bf86352ae259e158fe22b0f9a642dffd0c3d6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711317853, "uuid": "33030538-ae47-49d5-8f47-a6ab7bdd9d35", "value": "T18E369C87BC9444F5C0EED336886656827B31BC480F3027D72A50BFA92E7ABD5AD75318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711317853, "uuid": "9e9b01a3-e1c0-485f-82f5-4a03e506e5b3", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711317853, "uuid": "bb7e83c9-0b3d-4ab3-9a57-23f16feffb6a", "value": "49152:vQsLHy/+BFCdShmG/RcxajYhJ5J8tEdTZaEjkulvWKw9pE6UumTS58M3g3hQjDVj:5O/+bzE3BjkV99C64u5o4JHpV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711317853, "uuid": "a7e74955-c1fa-434d-887e-33a66701fb93", "value": 5050880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711317853, "uuid": "418072c1-aa2f-4375-b846-13a965f31b5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711317853, "uuid": "645e9d17-2998-4c8b-86a8-a25d5739e5d1", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53d0a140-e974-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711239632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239632, "uuid": "d4c38351-1664-4dba-8467-565602647323", "comment": "Malware payload (Mirai)", "value": "f06d37ab1ad8ceeee04778cc2df96d27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239632, "uuid": "72e2a18d-c63d-47d5-9735-af134d1ef8a9", "comment": "Malware payload (Mirai)", "value": "b73ddb2fdd0bfa04b2f14aea926418f29e479204d9e10ef97755829756e58411", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239632, "uuid": "00167eb7-bb01-4e98-8dce-51644c0ea133", "comment": "Malware payload (Mirai)", "value": "34e1a6a4b477df6cb1c912b0144366290c8b2ab9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239632, "uuid": "450130e8-808e-4908-abe1-c74c1e8e2211", "comment": "Malware payload (Mirai)", "value": "4831b77a7fd092135e5ed7f29267d35eac83afa76056f30860af554cb1b0ab1a0571394c7343acc9f8ff508f8dc03125", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239632, "uuid": "31dfaa9f-3f28-42d7-ac25-1325abd724be", "value": "T1B0731A13D5624EA3C0831BB921EB9B740763ADE15B422F746229DBF80B43DCCBD94B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239632, "uuid": "7938aa9f-fd64-4587-9da0-6d085d40489c", "value": "1536:XNI22OALNUdkcUKyloCTx008x8DH2mtlgIm6Fwhz0/ge1:D9dymIBTWmXDmgwhg/d1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711239632, "uuid": "de356c51-934d-472b-8668-eca47f3796f9", "value": 77956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711239632, "uuid": "636d85cf-37fe-4ce3-aba1-3807d5017d09", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239632, "uuid": "1e1b6a2c-28e3-4294-aea7-65e9f067269d", "value": "f06d37ab1ad8ceeee04778cc2df96d27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad0373d-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268823, "uuid": "0deb0f17-5eb2-4690-8d4e-bcbcae14659c", "comment": "Malware payload", "value": "8a77ffd1ba2bbd25a8b96d24483f1cb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268823, "uuid": "6bba69c7-92d4-42dd-9701-b92e54993811", "comment": "Malware payload", "value": "b929d478568bde07c84d1de1d168620cdc1256d2f52743d2560a10f934eab847", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268823, "uuid": "2c77b1f6-20c5-48f6-81b0-ade6c5ba3798", "comment": "Malware payload", "value": "01de3ea024b9ad516d5049758f49d47d75bb5a61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268823, "uuid": "bad0320a-1598-4736-b0e9-d95e4004792c", "comment": "Malware payload", "value": "7c573a73040161c869e01b593601db37a18446e6b18154a87592296c4c38dffd1a0f6c3f9df788cf48be02b4c84963c7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268823, "uuid": "6adb568c-3935-4f19-afd0-2a84dd763842", "value": "T15754750AA74447DEE0572F7DD000D11869A2EEC62B0032FF376D7A97D2B5F912871AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268823, "uuid": "779e6a2e-22b8-490e-95c7-78535b17c8ac", "value": "84cd1ddf0ce9c6a74d331bc445074f42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268823, "uuid": "675b8f59-24bf-4c4f-8206-1c4385577c8b", "value": "3072:alG0sELXlE8tT/wFetE9iys1jPtfqgOMPVU5brfwmCB8:alQOm6EK17tfqgOMP65PfqB8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268823, "uuid": "0d35f7dc-95ed-43f3-b06d-58df297c3fc0", "value": 287800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268823, "uuid": "07adc70d-0797-4426-b1bf-84153a5a7d32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268823, "uuid": "377ec4e0-70cb-4195-b66e-757a6d87acbe", "value": "SecuriteInfo.com.FileRepMalware.2614.14343", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c13de47-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268825, "uuid": "0559ace2-002a-426e-923e-1903d54c1dfc", "comment": "Malware payload", "value": "916189b63b5c2fe79a544577eb077c68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268825, "uuid": "4e9819d3-0f02-46a5-af10-3ec11626a37e", "comment": "Malware payload", "value": "b97d68b5fd639fa06fad9befa1fe1c62358605b25bd5d74dba7769067a08fb84", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268825, "uuid": "e84bc107-a022-488f-a1d4-a3e0a407d5d4", "comment": "Malware payload", "value": "a1e51995321db24427b20f2951e62ac10cc24150", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268825, "uuid": "a4e34575-21b1-4f2d-b25b-07e4575c4e54", "comment": "Malware payload", "value": "83542fc2bb0cad1692ec0c37582e1ecd30c53c70acaf95b1f361818933d81da9719311232854f2ff520e487eb66eed6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268825, "uuid": "7c3b5034-e5fc-47b3-bc0c-6205720da7d8", "value": "T14E54970AB74547DEE0672F7DD000D11869A2EEC62B0032FF376D7696C2B5F912871AAD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268825, "uuid": "bd1f0b74-49cd-45ca-a5ff-eac2b1a29dca", "value": "84cd1ddf0ce9c6a74d331bc445074f42", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268825, "uuid": "f6b1b961-f641-4574-a5ff-95a8e2a094e1", "value": "3072:/NWcM0TX2Ex1LowF10Eli+cYhLtfqgO0UVCE4GvLfozwBT:/N4mDGE2YttfqgO0UfvLfDBT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268825, "uuid": "9f586db7-8c91-470f-987a-5bdf64075ca7", "value": 287800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268825, "uuid": "f7608d8d-52e9-414b-b561-52a2155341f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268825, "uuid": "39d1a5d1-c3d4-42c1-a5d9-d4310664f205", "value": "SecuriteInfo.com.Unwanted-Program.00587b831.20291.1301", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "475ccee4-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268817, "uuid": "ada270c8-df2f-454e-8706-0dfa67ab6af7", "comment": "Malware payload", "value": "80f30e11b8b57e93d177a7bb03db7863", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268817, "uuid": "0cc5ff11-b49b-48bf-80f3-2f9a1904342f", "comment": "Malware payload", "value": "ba64403e9a767f7f2ef25a8957d9d357dad7e5cc40093de43cfcf53ac47ad5b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268817, "uuid": "175d286b-c07b-4d6f-bad2-fa15016ee170", "comment": "Malware payload", "value": "8274ea96e4206803c95b76a653d0d0c226d9ab8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268817, "uuid": "baf3e0e5-986e-43b1-99f3-c82fe143c8e6", "comment": "Malware payload", "value": "a2e27ff3890f77e49c80df1fd729696f9c495255c773d2a0b3603becf4f8dd4f1cb833c69c74517946ea1efea533556f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268817, "uuid": "9d9164cd-5499-48ed-aa2d-0e05525dcfa7", "value": "T1ADA5028BF995913EE0BA0D30885386DCEA725CA02D28C5B757D4F75D3C720A4AA37673", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268817, "uuid": "0485e960-a77e-4b49-b2f3-0677d22c1926", "value": "31ec27f3fcc666263d48f5e22aeaa146", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268817, "uuid": "c84acd35-2c3b-419b-bfb6-ced171ca42b9", "value": "49152:oqemst5aYJHXC8ZBwH8DyNR0TpeRypa2FCIXLOBahlSA:BedaYNC8Zmc2/0teyNF9XrlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268817, "uuid": "213fc22d-c126-4a57-ba1e-7e349bd57f6b", "value": 2159317, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268817, "uuid": "81f13442-26b2-4a92-9947-c9d8f76dc211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268817, "uuid": "e835e9d5-59e9-4fac-8fe5-bf52f9403b51", "value": "SecuriteInfo.com.Win32.Evo-gen.27003.11292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "313ac2f4-ea14-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711308294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711308294, "uuid": "20082906-d7ae-4792-b669-f83f48eb6582", "comment": "Malware payload", "value": "880c3df217e5a572eee2d32d9fb7d3fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711308294, "uuid": "19695e54-ba44-4d74-be54-2f8de7319610", "comment": "Malware payload", "value": "bb1b643cdc5043c4eccbb894888579e8b593d7f1b41e6f8a2f90a247348dd59a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711308294, "uuid": "98ddec81-a920-497d-b74b-139c80963d73", "comment": "Malware payload", "value": "34ba8c06a89fc6c615544e01282eb499a9e5366c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711308294, "uuid": "aad402b4-22ae-4f00-afbb-8994b22ccfd2", "comment": "Malware payload", "value": "648bfc46ad27a0658e1e0e5ca731589b78c7bbaa5d6cc969e776db34f2369db382119b2068acd0c125f9b3a5abdde90a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711308294, "uuid": "ef78762d-75c6-4cc1-bf7e-e98f2ada650c", "value": "T1A7963345E5628C71C864193A05F8CF318D3EA5A10BB7556BA7CE8E3FAB423D1703B16E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711308294, "uuid": "b5091aba-31aa-4018-bbe1-30bead067caa", "value": "7f6374fa43fb59c8c933315a94a24259", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711308294, "uuid": "e3c592df-f1dc-4927-87b9-53a537b4fd95", "value": "196608:c/kAwefOljMWOHXGjAc3gFVAYvFXG4cJ8vNkqZ6rI6o6wjRQw05:hxl6L3bYG+WNT6rdo6595", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711308294, "uuid": "f3489275-eaf8-4d16-b984-cb569c649d0b", "value": 8753008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711308294, "uuid": "d4796ba5-f582-48d1-aad5-2b7f5f894b05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711308294, "uuid": "e7b4c7f1-34d7-4df1-afd0-b6c68b2ba6ae", "value": "SecuriteInfo.com.Trojan.005ac9c51.23743.12263", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bd3bd8c-e9b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265738, "uuid": "6d9f4802-65fa-4df9-b090-470444cf7df7", "comment": "Malware payload (Gafgyt)", "value": "b593ee2d3a9fdf1621295fd0d7a7cf53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265738, "uuid": "d67ded4d-29ae-480f-9bc6-a05f0ef1469f", "comment": "Malware payload (Gafgyt)", "value": "bf5e6947f6829d17b8a8e5984366efcf5592d8f6bc7ec6d7e85b1872bebcb24a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265738, "uuid": "50f9b813-d4c7-42f0-9894-2b32ff0e4c5d", "comment": "Malware payload (Gafgyt)", "value": "bb89765d73e4f702c8df9b352ad4e7146c456868", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265738, "uuid": "28a8c05f-c1e7-4bfd-a714-442826f036fc", "comment": "Malware payload (Gafgyt)", "value": "807aea9efe2ee86fcedeb29eef0447af2a6c6f6e056af6437f4c166eb21fe5b4cb05d9e5b6a6ce90ce3d27f6fec84da3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265738, "uuid": "f58b4fe5-d47d-4ca5-82a6-efcdbae4bd18", "value": "T1F9D32A2727660A37C1E5543441E35333F7B6CB8439B49347AAD06E9C2F1AAE435933E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265738, "uuid": "50231ff9-28cb-4d80-8e20-df74e3ec3673", "value": "1536:1SqVnAv9YsNS5NTzWvzvaAe3zSbkxttSjAMydCNiONNvim4wBWS67uFW:6YsN+TEe3zUkkfNFpim4wBxOuFW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265738, "uuid": "e40f7dcb-1dd2-4423-8471-fd38219be97c", "value": 131888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265738, "uuid": "ec55806e-4029-4b79-a574-2f6c317c50ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265738, "uuid": "34be10cf-8bcc-4d08-b5d0-320b50d2c4dd", "value": "b593ee2d3a9fdf1621295fd0d7a7cf53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fd33439-e9b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265744, "uuid": "f2dfc065-43cd-4d09-8189-d66861a30fc2", "comment": "Malware payload (Gafgyt)", "value": "ce638753065f91224f07020a456cbe9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265744, "uuid": "f1ffc587-ebe8-45c7-84be-1bdd35b367c1", "comment": "Malware payload (Gafgyt)", "value": "c192146c8311694342f73a19cfe69ecc53f3f1d6cab006526d2daa5134846357", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265744, "uuid": "ee0bac3a-2cb6-4f45-8d43-808065d53ff9", "comment": "Malware payload (Gafgyt)", "value": "912671cbe26bd6b7d1fee23e3f9d208d1beb1108", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265744, "uuid": "f40232f1-d978-4dc8-8707-c965a88eacd3", "comment": "Malware payload (Gafgyt)", "value": "512017d9824f9dde940a335a6b5316dbe56dc78c0b1c1873ad6f7a0df1092ca5ae5f576296163b81a9bb7d2f20ad8298", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265744, "uuid": "53ec8124-0455-44aa-a65b-b563e30179b2", "value": "T14FE3D92A3A21EBBEE16DC63107F35F70939521D227A19345E26CDB182F3128D5C9FB94", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265744, "uuid": "66c581a0-d34f-4931-bac2-4491590e1e03", "value": "1536:OHf2lkwEa+9OxaVe+vP2rKCyKGr+Wd/1uWP9gtl64zjchNum7rWoXuPatfGRQNWX:hjdw/tAzKFaPw7Ps243Y5JmV+cEuuId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265744, "uuid": "4ccb0f15-8ef7-48b1-930f-429f044aa359", "value": 155851, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265744, "uuid": "91b3dd65-bcd6-47e3-a7a0-f27fdc164cac", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265744, "uuid": "8a708620-cb94-4b87-89a4-1fd8f086076d", "value": "ce638753065f91224f07020a456cbe9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494194f2-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268820, "uuid": "7c8da723-310d-4869-aacd-2292714d3776", "comment": "Malware payload", "value": "b251ea7844ba71c359f45301130a55bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268820, "uuid": "fd6ee3ca-3d65-475f-8bf8-630a7c164576", "comment": "Malware payload", "value": "c5575abf10c97481e01900050b48805641ffc447d2777ca9a7883d4180ea99b5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268820, "uuid": "90597496-f70a-448e-9ab4-b9d3c57714ef", "comment": "Malware payload", "value": "170e54a4aeb4c36a1ce8375180bf1b3dd502b743", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268820, "uuid": "d9a197b5-41d8-4330-8095-f7f833a177f1", "comment": "Malware payload", "value": "a5167a31dea71423ebd28d594aeef689c6826086f97ceb3dc13f9cf9205f406e22f84489ee33da40316685952667311f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268820, "uuid": "0f5eac16-ef41-406e-94ca-ccdfe1ed169e", "value": "T1C7B3CF7337E6C1D7E1523EF0DA7A6A25A776AEB11421C94F0BF83AEA5870243CC0459D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268820, "uuid": "20d88abf-e9f9-4feb-9bcd-faae5e9442e8", "value": "e160ef8e55bb9d162da4e266afd9eef3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268820, "uuid": "d0f54f0a-0bf4-4477-9c91-b8ed0b3707ce", "value": "3072:XCaZ2Yrb0VTXJYrxqdLdU6eJmDHgG2ojdotyhzR:XCIo2rxqdLdU6eJAT2ojdoIhzR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268820, "uuid": "7f8ec235-ff94-4756-a6db-522bb6a1bfd3", "value": 112680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268820, "uuid": "090552e2-aee7-4cac-a977-f7a9b3f66fb9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268820, "uuid": "a724d29e-d5bb-4ca0-bdb8-5a8037a3ff5c", "value": "SecuriteInfo.com.Unwanted-Program.004d72fb1.16378.1223", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba36a31a-e975-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1711240233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240233, "uuid": "81c2a36d-9055-4c3e-a1e9-18b972708691", "comment": "Malware payload (Socks5Systemz)", "value": "fe4c1aa2eebc57c4d40a044e96f5d487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240233, "uuid": "c8ee7137-de51-42d6-a3c1-f9d43c8a1fa3", "comment": "Malware payload (Socks5Systemz)", "value": "c5a44d49487fc4ef176fab38c0761607e5f1005588079b1ccca24f5b11bcbde2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240233, "uuid": "579c9ba8-8008-4c37-8371-a0a5d971d3b3", "comment": "Malware payload (Socks5Systemz)", "value": "aa76ba4df9b79489d59d547e58720d015d6d2c98", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240233, "uuid": "46fbf185-527b-496c-bdce-21990fb2dff0", "comment": "Malware payload (Socks5Systemz)", "value": "b912c5aad29010dd0bd57709b718053121d76527f9dc4e578dd88a454da914cc1835a5edc110c32b3ce615dc4508d0d3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711240233, "uuid": "e4a88999-7c03-4c13-a6e0-92b8d4c217b9", "value": "T1B7A5332B68E0507DF0A2D8336E12E6368676FD8909BCA8C43B8D796D5F3719C444737A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711240233, "uuid": "29dcad09-880f-4272-b78b-9fe09655d46c", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711240233, "uuid": "4432b088-1a91-4682-b1b8-60019ae53a04", "value": "49152:32AgRwW0LztkRUZpA6DTWt8C7G1lW2sKwTIAM:mUEUZ++2a1EfXM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711240233, "uuid": "5032d547-c531-41e4-b576-b00124e25173", "value": 2122685, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711240233, "uuid": "c21a067e-60a9-48aa-b327-8d07a522f087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711240233, "uuid": "27bb12e3-308b-4d58-8b70-4cff9682321b", "value": "fe4c1aa2eebc57c4d40a044e96f5d487.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da50e7ee-e978-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711241576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241576, "uuid": "79604fea-1297-4a02-8fcb-230f7dedfdd4", "comment": "Malware payload (Formbook)", "value": "0cef447b5e4801587110015be62e85b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241576, "uuid": "c9f6cf33-aaf2-4c57-aeef-4d86f9fdf87a", "comment": "Malware payload (Formbook)", "value": "c7a16881f8c69d16a9b0bdcbfdd5c4aada81eba19521d1c03ee7f6005f7d6629", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241576, "uuid": "8dcbdabd-823d-4eac-a907-99c1f471d85e", "comment": "Malware payload (Formbook)", "value": "a70e73bfd24e44f496da074b4d9a5b30af91292e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711241576, "uuid": "d14b55e8-87b8-426a-a356-2140e42de90f", "comment": "Malware payload (Formbook)", "value": "d7021ac6ca44efb19e1b54579b5fd765e236de9a9bd5cc1ab25050c8e9a47abc7be6dd0c0ac5411b3a67b0dab737f60b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HUN", "colour": "#D5C697", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241576, "uuid": "4f0cd416-d443-4d9f-b430-5ec3196c0135", "value": "T1CE15ADEC321079EFC957CD76CA982C64AA20747B930BE243902705EDAA0DAD7DF145E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241576, "uuid": "9cf39b2c-9271-4e1b-8089-d73d09ee9757", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241576, "uuid": "82038ab3-0059-43f5-b1c7-f733bf4f63c1", "value": "24576:YhUT/1LpCKoqQwZTv8RV2dZ2G10H96KIXryNyax8B5Y6srTCS:YhMyK1QwFxJ1s65yy+Y5xsl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711241576, "uuid": "cfff0b38-ca57-4fbb-a960-5bb4959309ac", "value": 893448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711241576, "uuid": "cf9f849c-65b4-4693-b179-081f686808cf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711241576, "uuid": "62d21c93-9781-4789-96fb-5be622ce638e", "value": "rx5aqVjdjJKDgYx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6976d1fb-e974-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711239668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239668, "uuid": "fbb55d75-3438-410d-b674-01254e1db356", "comment": "Malware payload (Mirai)", "value": "fdfaa1d29a10f8d3c8914907eeed33f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239668, "uuid": "6d85f073-70ba-42a5-b978-2bc7c16495a1", "comment": "Malware payload (Mirai)", "value": "c7c37dcf6dbd7f91dba56449cad0e76ae3f4bedd2127996baef6aea33e5c49b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239668, "uuid": "b52a757c-87f3-43ec-b43c-f4ba58c7cfa9", "comment": "Malware payload (Mirai)", "value": "9f8e06d9c68b39b68b89f8136370edb7f91c648b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239668, "uuid": "12adb621-4c05-493d-b2be-bfdbfc71f9a7", "comment": "Malware payload (Mirai)", "value": "5faf9b9f48357049c83b162d1d7efec2423f1808a30c483e3f75aa96dd11d0c437290ab18cd92bdda83cc9f1a1dc0384", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239668, "uuid": "82559703-8a5e-4852-af88-31fb3e13cd5c", "value": "T161633C4AE2A2C5B7C4C31A7901F7DF264531E8D31B5A4E02E37D6FF46F12888319B65A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239668, "uuid": "0d00596c-b3e3-4cdd-8621-669427046ce5", "value": "1536:kFxMLEryDE0r3NPLzZoNKvwyuYu9GhOjJK6LmDp9ox3/SvX:krryDZRzOPyISOYomN9oN/0X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711239668, "uuid": "542a45f1-5752-4259-9314-d157451fe293", "value": 69410, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711239668, "uuid": "5596fb22-c638-4af3-ae18-bee02a7d1445", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239668, "uuid": "04293ea3-6411-48b5-9e75-8b32d15a781d", "value": "fdfaa1d29a10f8d3c8914907eeed33f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14410a36-e9d7-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711282046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711282046, "uuid": "0779ed9b-9f3c-4a5d-a88e-e94fadcb07bc", "comment": "Malware payload", "value": "54c3e70e2883a004455cc308bb2608c5", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711282046, "uuid": "47eb546d-bb83-4b67-a61e-ffca13a07487", "comment": "Malware payload", "value": "c9253184b706cb99cbcf84a6916b5a2b82d75aaf153cf1561caa2ab030eb04be", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711282046, "uuid": "07e72547-cff6-458c-b298-bd9484725926", "comment": "Malware payload", "value": "31e827844b61c807f4d6f3ef22617b14e5463949", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711282046, "uuid": "aef26c57-801e-486a-aece-55fb70344d1f", "comment": "Malware payload", "value": "7a23036eaeba35433259410e636cf388b7ef56a302bf26661a8498a3c09ef7cdcfe0af42007674a673f545b7e21f4452", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711282046, "uuid": "be4be30e-6e85-4022-9580-40ae1be08c14", "value": "T1A8E6DF93F398E569D4F38332863662B2969A4D24BF6793672114B63C6EF39C48705FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711282046, "uuid": "d7f69ab6-a79b-425b-bb1e-8030596ff72a", "value": "393216:MmVyekE/gR5jICHg5hKG8AvPeqdA70fWMdWocpp:38ekKhCaKGOqTWMdWocpp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711282046, "uuid": "60d78bdb-9301-4449-8932-fd8203ad8fe8", "value": 14706347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711282046, "uuid": "9a47c95e-dfb5-4666-85f6-99435363557c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711282046, "uuid": "6d3a5ee6-4037-4a9f-9f10-3df709af6f02", "value": "HD Beauty Camera_6.0.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43edfa51-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711268811, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268811, "uuid": "a6dbb2ea-3e45-4143-a212-389de822dd90", "comment": "Malware payload", "value": "9ffc6aed31acd99ee35a16a5f1c23f84", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268811, "uuid": "f7b265be-17ea-4bb5-a847-154536356c90", "comment": "Malware payload", "value": "c99642d95e6ec41a41092453aee34ec610e62c51aadf36aab182fdb01c2268f3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268811, "uuid": "f1efd7b2-ad9c-41bb-bf7b-0424c4b09d41", "comment": "Malware payload", "value": "74b694016af7420bcd4e9b0c2fa49e46842b5793", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268811, "uuid": "90a0d068-5b3a-4643-98d0-35ba0dbd6ae3", "comment": "Malware payload", "value": "865fd17a4665d1fde54ca70fe5aba2eefc536305cfab53a9c1f0e46dae178d304282b8ddc63e41c78ae0daec33630c31", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268811, "uuid": "2f875183-5c68-4bb0-b420-972c3b85c6c8", "value": "T1CC350281F78AD5B9CECE13746076671E91A965952BE4C2C3E7482E2FDD331C32C3A249", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268811, "uuid": "f181af71-3388-4d0b-b63a-5c488ae1707d", "value": "a6cf092c96b55681b166d71f6933371b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268811, "uuid": "87b699b4-2cea-4e6f-8833-d484e00e64b6", "value": "24576:OBiYwfvTT2RR7C7gd/kU91LeAhv37lfP/ygVJL:53TiRNCUlkUnLeAhDN/bVJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268811, "uuid": "b61a7c7c-54ad-4fe9-8948-94a97463fbd6", "value": 1116728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268811, "uuid": "7cad21e7-abae-4d4b-833e-cac5e90d5786", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268811, "uuid": "a3366940-dac3-4359-9fa1-86793aa55d76", "value": "SecuriteInfo.com.W32.Wews.A.gen.Eldorado.5466.31619", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5d5e4a-e9f3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711294114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711294114, "uuid": "155c56a5-be52-4de1-97f8-618f567b689a", "comment": "Malware payload", "value": "c59b5442a81703579cded755bddcc63e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711294114, "uuid": "6c9d56d8-2ffd-4951-bafd-43dfa03ddb94", "comment": "Malware payload", "value": "cac7fc4ae9c97eba7455992b2d41449ee257ec485c562bfc7245a90033b1d774", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711294114, "uuid": "6630a67b-ca95-4016-a26f-d5dcad922668", "comment": "Malware payload", "value": "c3e36a8ed0952db30676d5cf77b3671238c19272", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711294114, "uuid": "d801bb26-f86a-4fc6-94b0-81d00928aadd", "comment": "Malware payload", "value": "97e74b877bd442ce64ba71756348d2128bf8b2661ace200101d9cb6b111d5960c047d2ba8774db852b7dea25ef471282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711294114, "uuid": "ed8951d0-6832-4fb8-9970-05c3c8ab20eb", "value": "T1CA168D06ABD406E1E46BC634C67ADB32D7B2BC5E0735838B0954F35E1E33A915F6B221", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711294114, "uuid": "10ce5872-8bdb-4247-bfb6-47ef2aca85c6", "value": "c6cb129ed43fdb4b64636582dff56a11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711294114, "uuid": "a37804a2-213d-40a7-be32-d6e4ea93a58e", "value": "49152:JtW1B+dRs6iY7idGOL8/actfDdAvNgFzzP/v0x5+TXwwF:L1F0OpF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711294114, "uuid": "17b46b64-cb42-4d8e-b970-1365fdd44e7b", "value": 4252384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711294114, "uuid": "dffb3d9b-9991-4cae-9031-cca20d2d874d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711294114, "uuid": "216a1be7-24cb-4300-9173-0244f9eb2e3e", "value": "SecuriteInfo.com.Win64.Evo-gen.247.3191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512eb67d-e97b-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1711242634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242634, "uuid": "f6dca9fa-971c-4ba2-8353-a7d42451976f", "comment": "Malware payload (Socks5Systemz)", "value": "406974e05e94b8586cff2ecf2e00d2de", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242634, "uuid": "a233f030-2063-4e7e-a303-67f1ea0f1682", "comment": "Malware payload (Socks5Systemz)", "value": "cb8f045facd1167c5f65844bfc78f3facf57ed4c82cb9aaea9342d2666feba2f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242634, "uuid": "39bcb132-dd10-431f-a4f9-ee31ebfd7bff", "comment": "Malware payload (Socks5Systemz)", "value": "1a57282797d06ee6091af015d5095506dd83a363", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711242634, "uuid": "3094b92b-7a61-42b4-9073-16ca19fd7338", "comment": "Malware payload (Socks5Systemz)", "value": "abcf3350832bd09f1992d73cfc4c43d7ec67b2e975eab7276594dad2044f2d7f3e8f7b186eb7b90af911b57ae72f55ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242634, "uuid": "8ff7a089-6c08-4100-b675-29c2cd4750d7", "value": "T1B5A53301E0F585B8D17ADEF068C1C617ACF377658EBD04892A5F568A8E33295AC07FD2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242634, "uuid": "3fe2207a-2967-4f6f-a32c-6c168ec15c77", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242634, "uuid": "a2535919-6391-413e-8ab9-17e17680b96e", "value": "49152:32cJU0UwraR8jxQo8fh4Sc8jSwVrok7EKfQmgkoaM:maUwrZWNfh28jVrtEKIrIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711242634, "uuid": "caebe841-1934-4ef4-8358-b446317cf9ad", "value": 2165891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711242634, "uuid": "ab8c8b5f-78d1-4959-b454-4343de0326ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711242634, "uuid": "36b656d3-6a72-4515-8756-121a955b16db", "value": "406974e05e94b8586cff2ecf2e00d2de.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61214c99-ea08-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711303220, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711303220, "uuid": "2945daaa-d5a2-487f-91b5-77a3140501ef", "comment": "Malware payload", "value": "ae296b57faeb20ba68bb0ee461e27a37", "object_relation": "md5", "Tag": [ { "name": "mariyeltherapy.xyz", "colour": "#56046D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711303220, "uuid": "86b03aad-db84-4554-92e5-28ed62bf94ff", "comment": "Malware payload", "value": "cc04820c4e65537dbe9c233f26af709e5161a6b1dc796a45b536a4928d194504", "object_relation": "sha256", "Tag": [ { "name": "mariyeltherapy.xyz", "colour": "#56046D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711303220, "uuid": "6719436f-f2bb-4755-b2c0-1bccb28ab548", "comment": "Malware payload", "value": "8637cbd12ee729b11a3515967324bb0e3eb1bcda", "object_relation": "sha1", "Tag": [ { "name": "mariyeltherapy.xyz", "colour": "#56046D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711303220, "uuid": "52672b5a-179d-4cb7-aaee-da6337258743", "comment": "Malware payload", "value": "3b2daf6c73e8f01cfbe4b5a9924062d8d1a39e571916dea2ae42ee01418e68a515afe3a3089a1d57c2cab09342275a82", "object_relation": "sha3-384", "Tag": [ { "name": "mariyeltherapy.xyz", "colour": "#56046D", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711303220, "uuid": "95ef5ae4-5ddf-43cd-add3-761bac29153a", "value": "T15108337B1759A224F8A631FC153D6AAFE524D0A0379074E33C7BB6C18C868D7AC5C4B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711303220, "uuid": "5c0aa0fe-c39f-4595-babf-8c1ba79b6e8e", "value": "1572864:0n6LBYqMn+/9YQxwQBZHBFdNYZvpXuyUsA7T:0euD+/9RxfzFCHUsAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711303220, "uuid": "2430568c-9dbe-45e3-a4b7-0112dbe79083", "value": 82894799, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711303220, "uuid": "8faf0888-02fb-4e87-b2b2-68ccf2389eca", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711303220, "uuid": "30e857c5-9b9d-47f2-9d19-393218250012", "value": "MariyelTherapyInstaller.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "184088f3-e9ec-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711291072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291072, "uuid": "c3a9279a-6c0b-4c76-879c-5bbb5d91c019", "comment": "Malware payload", "value": "e4fa89413c3b355aaffa71759bae88ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291072, "uuid": "ef553455-98ab-4290-8dc0-107523d4767e", "comment": "Malware payload", "value": "d1d5a89d99751e1d9be2671f6f29315433990e1109aa633cbfa0fae6ac0f3568", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291072, "uuid": "6af8b55b-9bea-4330-b7c9-9d978ad2c8a9", "comment": "Malware payload", "value": "583fc9f2160779929899fe0400f4d800a4a66a2b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291072, "uuid": "6147f15f-e4f0-482d-810d-a8b67142537b", "comment": "Malware payload", "value": "baf074aef5eccbab48a7f40995efad4394da16e7e5316c495554bf2d806c9600d1f0e7177f501f347bf113197f5c3d20", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291072, "uuid": "67877337-4bf2-4fe3-9330-ce8bceec2107", "value": "T1A4D3CFD22FA95581E86146B42E91D70A79BC5FC13A0B0F3A70573B97C674CE20CA6BF4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291072, "uuid": "d52e1e69-91a9-4ac0-95dd-bfaf9a2dd6a9", "value": "ba072a972fe6c47c8cf7a0347bb0af7a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291072, "uuid": "2ce15067-0aff-447f-a876-587b8f2d36fc", "value": "384:y7cqdIxXkRswWS/YWyiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiiLiiiiiriiiih:yk0sS7wk0sS71sk0sS7hzk0sS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291072, "uuid": "fec641a0-99c0-4e3c-b934-87f54228de84", "value": 134861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291072, "uuid": "ba175887-eb03-4372-8113-44e4b806d437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291072, "uuid": "d8d891e2-0969-4e1c-b969-f58b472cb448", "value": "ncr.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "760db7c7-e9d3-11ee-a120-42010a9c002e", "comment": "Malware payload (IRATA)", "timestamp": 1711280492, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711280492, "uuid": "f29ed18c-9fb4-4faf-a946-30f752414b65", "comment": "Malware payload (IRATA)", "value": "83b1c3a87a43bb43fa670376b6fb7e53", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711280492, "uuid": "e5a38793-8bd9-4372-8dca-105b7ff2f03b", "comment": "Malware payload (IRATA)", "value": "d1edc721c513ec629ee83034b9232579705ed05e234c3aae5422675e570bb184", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711280492, "uuid": "12e18f8b-6738-4330-91c7-a66fcf75384d", "comment": "Malware payload (IRATA)", "value": "3678df843234f4a91b3851826a84299ab8571b08", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711280492, "uuid": "eedee06a-5493-4367-b971-78369220f7f9", "comment": "Malware payload (IRATA)", "value": "4dc41b8ec8982e3b4f5ea9e927a847e28de05da9f95631d203464720ddae1cf24b0a8e71c7104a8995fc76b6c15b55b6", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711280492, "uuid": "e455ce88-0cac-4baf-905b-bdb27dc1536f", "value": "T121F52347F256DA2BCDF2C3331239027611364D25CB43AB8E2A4877BE24FB9D84B956D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711280492, "uuid": "33ecc6f4-8094-41af-9b6a-e4640a69fae0", "value": "49152:M9Nw8Mrtb7ml99KMTSHh5dAr/EebNX8hWh0DHSfdBxieMz7+vVt3y7IcPNztn:+Nw7R+ZTSHh5yEeb4Wh0+lC7+T3y3PNt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711280492, "uuid": "fdc31e47-db0d-4276-915c-0692ca59123c", "value": 3602558, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711280492, "uuid": "6490215a-83f1-408d-9c5e-24c1b12b6e68", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711280492, "uuid": "90615d25-b037-433c-943e-f0ad640e05ef", "value": "KissLands.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f70f00cd-e9a8-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711262240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711262240, "uuid": "70d0ecfd-7d7f-4d89-b72c-dfb8e90cdc8f", "comment": "Malware payload", "value": "4e937db554cf18265ab7f3915db42b2c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711262240, "uuid": "416a438f-b7f3-42d9-878a-f0f8c4920ea7", "comment": "Malware payload", "value": "d2c0a67e9f5a36e878853d5f8a0e493d7d29362c2cff1b805cb7b29f52cd0faf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711262240, "uuid": "484c934c-cdd3-4ef0-b263-95f752b424aa", "comment": "Malware payload", "value": "d0f9f2f292414b50391ec656e58d8350a82d32cb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711262240, "uuid": "a4375928-71da-4de0-b676-5b6f67b58d8e", "comment": "Malware payload", "value": "f4bb5e9fbfe8576e48be9c0192e07c328d99f5bd5140ab11f52cf18d9b6f8c0eb665c7bd528855fe2802c21420e21273", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711262240, "uuid": "6c6dcc7c-1d9f-4dbb-82c4-673e6c05faf7", "value": "T11A159E0273D1C062FFAB92334B5AF6515BBC69260123E61F13981DB9BE701B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711262240, "uuid": "3e2f448f-ad0d-4768-a618-a64291484db0", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711262240, "uuid": "1f396fd5-181c-4965-9b4b-eb935790d095", "value": "12288:3qDEvFo+yo4DdbbMWu/jrQu4M9lBAlKhQcDGB3cuBNGE6iOrpfe4JdaDgaSTB:3qDEvCTbMWu7rQYlBQcBiT6rprG8ayB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711262240, "uuid": "6a08b030-dd05-4477-b13a-5f96cffb9245", "value": 915968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711262240, "uuid": "74cfc9d4-9204-4b9f-b004-8c9c26079069", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711262240, "uuid": "3f4e7c63-a88c-46b4-bd43-18e5db8bf39d", "value": "4e937db554cf18265ab7f3915db42b2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3f5bbe4-ea20-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711313721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711313721, "uuid": "fe9de95f-fe83-4440-8ec0-80a0a8b39660", "comment": "Malware payload (RedLineStealer)", "value": "287d2d8c6dc43061b992fd4767cac641", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711313721, "uuid": "329877dc-bc8c-4b1f-8848-9f79d167133c", "comment": "Malware payload (RedLineStealer)", "value": "d3231042d20e7e02069279a9470ede4daddf70137cf1122550e4bdc354ba1473", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711313721, "uuid": "0b2668f4-8602-4666-8393-2117c3b15b9a", "comment": "Malware payload (RedLineStealer)", "value": "bc6076dd3684d56476c4424e8e7b42d0a7e29d64", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711313721, "uuid": "5608cd9c-499a-415b-afa2-304217bf5bc9", "comment": "Malware payload (RedLineStealer)", "value": "3a692b8ed32b761571e002f1d623c65c30981d095f54de8c939def02943534d15807d33ce4357232f1359a1298f0f8f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711313721, "uuid": "e88d6ce8-e40b-4e52-abd6-f333c356708c", "value": "T10D369D41E3DCC4E1E0B205B8596DA321EEB1BCB51F3195CF2284BE1E6B31BC56975B22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711313721, "uuid": "05ea824d-b0bc-465c-a10e-092f0f719ccd", "value": "dbcf2a4deb216c4be49068990ac64d93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711313721, "uuid": "ab897217-c169-4ce3-9d8b-944a127d9e81", "value": "49152:CunOIh/VejoF8vwF/nluLRPct4whtfVKevv7m9gcQYPbH51a7zc60GtD:f/Veo8YF/nXMPbjAg60GtD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711313721, "uuid": "c17a3a07-bea7-4de7-8ef2-645ef77ff707", "value": 5104128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711313721, "uuid": "5d96d62a-cea4-4735-9cb7-8256836639fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711313721, "uuid": "e2ef8ae6-dd18-4463-81e4-3f768a3ef278", "value": "287d2d8c6dc43061b992fd4767cac641.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf819aa-e976-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1711240533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240533, "uuid": "aeb309f2-4151-40c5-babf-3a9487b8cb2a", "comment": "Malware payload (Socks5Systemz)", "value": "62a66a8f38b5d8c588710e33836ec461", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240533, "uuid": "880d9da2-bc2d-4f4f-9cc0-6e777ab59706", "comment": "Malware payload (Socks5Systemz)", "value": "d3eed14b62ecea9cde96248df1c2d216c004c62c6e80287da6bd0b7d09952e09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240533, "uuid": "3fccd1be-e6fe-45aa-83f2-629d32b9e196", "comment": "Malware payload (Socks5Systemz)", "value": "fa4cae82470c0b230b9c78050b7634945289a7a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711240533, "uuid": "783eef81-9918-44f8-8237-797e11c0d8c8", "comment": "Malware payload (Socks5Systemz)", "value": "eeeac51c5884a7785f7b64072abf8577d6be56bda522184ca3dcfc47011662010069ac04fc5b0580d8ac3581c482fbc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711240533, "uuid": "8ad6689c-f042-4984-85bc-7639f978fd49", "value": "T17EA533037B67C732F1E0FA384815692407F22D762678A9C0674FAF5E8F2B596190B397", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711240533, "uuid": "2aa99349-f5e5-4ac6-b644-5cd610a351c8", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711240533, "uuid": "92e14f7b-c9ad-4244-ab39-34ae9c50afde", "value": "49152:32pqWm1Pyj+QqyNT5i4zOi3VqfbLt/RMhUK+F4axtxM:mptIqj+M1ffFrzk48DM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711240533, "uuid": "3f26cbcd-e68a-477c-b537-75a946109844", "value": 2153335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711240533, "uuid": "30f0c888-9227-4a71-abda-f7ad859527b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711240533, "uuid": "4b502d3a-f2d2-4bd9-af73-03a1dbc40c3a", "value": "62a66a8f38b5d8c588710e33836ec461.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957ccb29-e986-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711247473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247473, "uuid": "689dde94-7a0e-48c7-a2d0-d61d12c042ec", "comment": "Malware payload", "value": "1f13cbde5a96caff6f2642a0dbe9fbad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247473, "uuid": "679f71c0-11fc-4c79-b470-9a1992b1c60d", "comment": "Malware payload", "value": "d68c0815c9318da74d949be7fed50a3441c6cb377b3981e75e114fa25207c77f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247473, "uuid": "25d71ec2-b8a2-4eec-8c9a-9e2fd634e344", "comment": "Malware payload", "value": "da68f9d03122bf8dfc181ded83874e04b4029fb4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711247473, "uuid": "99b09e1a-d629-4984-8f02-bb8ea4297144", "comment": "Malware payload", "value": "4dbf3fc19d3d292164dc0fa712d9fcac4d979760c73ac6965864432309b3f75df7ffc1792a607ab6380059acfb123c76", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247473, "uuid": "a2ceb6b5-3273-4715-84d9-d4a91032de89", "value": "T11DB5D0C0D588BCDFD147177B68F8A430095DEB3AF16800B618DA741A58BA8D3F6EBD49", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247473, "uuid": "3d72a71b-a3c7-42d5-8c8e-fbe968240357", "value": "fe5fb373dbec3ba73ffb51335d1fc086", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247473, "uuid": "8a0bae3c-07e5-4fa8-b0ad-5046d58215ae", "value": "49152:bGIpewFyJnbJwyyW0h3BRv/YwxuuATjYuKhyw6rBLSr9qnHETwiKQm:bGWiJ70hxRv7STjYuxw6rBLSr9QETDlm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711247473, "uuid": "6b6c6f53-2787-4626-a264-7ce5a288f24b", "value": 2293520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711247473, "uuid": "2b2dae28-2783-4f72-bfcd-7730b63d4204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711247473, "uuid": "396890d8-d831-4530-8573-e834e2791fcc", "value": "SecuriteInfo.com.Trojan.GenericKD.72085495.17857.18647", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f527f9e-e9c4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711273877, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273877, "uuid": "254e8bcb-2eb7-457a-a32f-0fd8d1d30afb", "comment": "Malware payload (Mirai)", "value": "5bc02bfae72399f12a583985c42fb187", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273877, "uuid": "26161f1b-3fa5-4e4b-8eed-085c1ba66a96", "comment": "Malware payload (Mirai)", "value": "d90a3e8c762e39b80647bd0f4eefcf66842e6f203f73949f2570d634309ded53", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273877, "uuid": "8a4b4e2f-373f-49b0-b80c-e745b14fb9fd", "comment": "Malware payload (Mirai)", "value": "ed9d5fc8d447940e4622d5a5ef7a0ba1d1d10676", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273877, "uuid": "bd62203a-70d1-43a4-bc02-fdbf21455f72", "comment": "Malware payload (Mirai)", "value": "64406a9bffbe1106d0fa94bfaac1b909b7c7001d7b94ab2af014230d3a15f60e011094e097f4531e34aafb9b15a6db9b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273877, "uuid": "93313115-a844-4de0-b3cb-19d56aaf0ed6", "value": "T11963195AF8014B26C5D413BAF91E119E37221FF8E3DA72079E106F6077EA96B0D27D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273877, "uuid": "1e28b5cc-5fdb-4e7b-9bef-cd27f54f4095", "value": "1536:k3nYYMsb12BNXs+UoRbP0AWSJpj6o5A3Z61vqCPEqBY/gSz0OXmDiMOyTd8:0PAxlbP0kLa3svq0C/22Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711273877, "uuid": "d8ca5219-5fec-4944-8849-40458750c223", "value": 70364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711273877, "uuid": "8404a988-54cb-4d05-acab-2369d47b8c59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273877, "uuid": "553489cb-070f-489e-9ec7-4d6957e60a52", "value": "5bc02bfae72399f12a583985c42fb187", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d511340-e9eb-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711290866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290866, "uuid": "afad6859-ca0e-43bb-9d62-cd1c5dffeb8f", "comment": "Malware payload (RedLineStealer)", "value": "cc1e287519f78a28dab6bde8e1093829", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290866, "uuid": "8de0faf0-6c38-4c53-995f-0436b404c8ee", "comment": "Malware payload (RedLineStealer)", "value": "dbcb61ce94c4d2d216de2b503937a2a964b984577f2d7730b7c6428b2b5e8db2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290866, "uuid": "8165f351-7b72-4638-9897-384d6b33df88", "comment": "Malware payload (RedLineStealer)", "value": "9262753386caa4054aa845d918364e964e5505aa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711290866, "uuid": "a9374c30-db34-4954-88ad-8d36de19eced", "comment": "Malware payload (RedLineStealer)", "value": "8a1a1d57548f2c0a752290e68406fba2f4b27d16e20d33ddce2b6490ee74abb15f1ef20d743e7c66253c4c70fed9ed00", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290866, "uuid": "c6f4c0ad-57da-43b3-9537-2ba55dfe4724", "value": "T1B5545B1833E89910E67F4B799470D67093B0EC52A863E31E5ED06CAB3D77780EE156B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290866, "uuid": "eaad28ff-35c6-4253-9e23-0490696fc5ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290866, "uuid": "a627a19c-6815-4475-86a6-1a511c5e98bf", "value": "3072:FqFFrqwIOG8tynFS8HDlVCadz2izv+sFlweJTZ4fHIkcZqf7D34deqiOLCbBOV:MBIOGH3Cs2iPl9JTZWNcZqf7DInL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711290866, "uuid": "b45186b9-a9f1-4075-9423-9903272165a1", "value": 304128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711290866, "uuid": "308e7801-13d2-4bb2-8b98-e5d27791aea6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711290866, "uuid": "f2de0175-907a-497f-b251-2bb2b79a430f", "value": "cc1e287519f78a28dab6bde8e1093829", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d76f2b-ea04-11ee-a120-42010a9c002e", "comment": "Malware payload (AsyncRAT)", "timestamp": 1711301409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711301409, "uuid": "080bafc9-7bc8-4ba4-ba8f-70edbf5d1062", "comment": "Malware payload (AsyncRAT)", "value": "1d9e58766825bd43d284e2dce090b4c1", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711301409, "uuid": "db230d1b-a866-448b-bf74-5698b91fda0f", "comment": "Malware payload (AsyncRAT)", "value": "dcaeae94e22c52c386a815c683fd05545047a8d97bc3406624f5a901415d853c", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711301409, "uuid": "529c2bfd-4e3e-4b31-8b7d-6aeedbb99dd8", "comment": "Malware payload (AsyncRAT)", "value": "e6b54f534401393ddd5388013f6ad3f333337933", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711301409, "uuid": "18dd7a12-cb02-46c4-a9bc-331342129f0c", "comment": "Malware payload (AsyncRAT)", "value": "4b3f1f6bae9a3fc5bf32408de56ccbfc68c2acc0d08b0d6730189578776e0935de533c8f0a43e7ef98ab946f2e290f75", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711301409, "uuid": "aa771e2f-8463-4a89-8c03-d20e0fbdbe82", "value": "T19783F131A7DC8143D2AE0B316C69F9E0156363679D53AA3BA9CB1ED3E7673700BA1121", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711301409, "uuid": "18f7ccfb-c2e0-47a7-a6fc-d9ac61fcf76a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711301409, "uuid": "07b1da3f-e035-4511-87e3-0ae3021b0057", "value": "1536:H5zBCrc5Iv4jBsYEJNbcYszAwh4lc68h2f+IuI05bhGJLd5UIq08F9iF:tBCI5Iv4jBYPSAwMHHfBAVsO90G+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711301409, "uuid": "25fe18c9-5935-4f22-a477-cfa8916b1389", "value": 84992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711301409, "uuid": "a08c1cd9-dac0-4fad-aa25-6e19955b601c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711301409, "uuid": "a851ed7c-3181-4d91-82ec-ca6d75387e49", "value": "1d9e58766825bd43d284e2dce090b4c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8254e91-e9ec-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711291421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291421, "uuid": "013264b7-0307-4697-8407-b5a6c534b13c", "comment": "Malware payload (AgentTesla)", "value": "68907b36a77b0eaa292ef416e56bd03a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291421, "uuid": "d0e82bbc-1eaa-4a4e-88af-f90be49f3282", "comment": "Malware payload (AgentTesla)", "value": "e0759869747654d95a1204a88b178593f4f58e7e1c674ac00243a1edc0393169", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291421, "uuid": "4f992f01-be77-4ac0-bba7-01f64d8fd79f", "comment": "Malware payload (AgentTesla)", "value": "d1c6f8c27668e384530975941d1130c973dc3769", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291421, "uuid": "b10aac51-6db2-47ea-83a7-725e82e8a696", "comment": "Malware payload (AgentTesla)", "value": "876bfff34daa10f82528b0b775f5c10fcbda91885cc66d286954d15ed4134ced571a812e281104c89e36fea5185083a0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xz", "colour": "#B4E6FB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291421, "uuid": "7bd1627d-2785-48a3-a2a4-d18dac81b0f8", "value": "T16BC4237250F5431BA02DC243E7BA2F78338D4BA6F50A12B7A747F7A7EC68310B991651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291421, "uuid": "d25906d0-b537-4779-9e55-c94b049c9a60", "value": "12288:mrZDSP3AyaPITsLabV2z8RCl/V1h/e5y8aO40+gzcQblgTb7:mK3AyaIrkzaCRV19Vjx0+gw5b7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291421, "uuid": "73d811e3-5f57-42bf-b1c3-c54b13abacd8", "value": 579431, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291421, "uuid": "c6250d22-b059-4596-9e72-e71bd4535e4a", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291421, "uuid": "0356e8b7-3a45-460a-91f1-5370eddc240f", "value": "nOrden de Compra No. 66534_980876564568698476456897807448675666.xz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351863b7-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711265350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265350, "uuid": "97221361-fe15-46a9-8d40-1ffae01ed1ee", "comment": "Malware payload (Mirai)", "value": "e8a22cc34f37369349d2d12ed98359ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265350, "uuid": "82e3bf79-7344-42c2-9fa0-db4adf480957", "comment": "Malware payload (Mirai)", "value": "e19c1f199c04c5d4d0c517efd9e0df5e51bd898edad6062485b7a8b0b240fdbb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265350, "uuid": "9e89461e-e3e1-459f-bb3a-d6aa1e9f34cc", "comment": "Malware payload (Mirai)", "value": "b4b5ca68fbb55ab6b89a5cd261bc5086a1743b79", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265350, "uuid": "d47bc825-f080-4a38-8d10-bad2cbc48577", "comment": "Malware payload (Mirai)", "value": "a46cc38c2443d14bf9ceae071f3429960f2cab3684f854d9fbfd3d8e7c6c2acf82119dd5a3e3b25e7b98d64a3896b0a5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265350, "uuid": "0feb31a0-8fdc-4983-bf9c-e261abbb232e", "value": "T16C333BCA66022D2DE9D65CFD80734F0AD9552311A4A3172BB3ABFDC739332A4FE45909", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265350, "uuid": "a9610be5-36d4-4da5-8370-e15cade94e0e", "value": "1536:D8+gH91trZyUr99C7ZQiD7cuMKg1p7i4fT:Dk99KsuMTp+4r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265350, "uuid": "4d331644-8f4e-4025-8982-8bc4dc777987", "value": 53620, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265350, "uuid": "4a256105-2b60-4fc9-ae81-2184d4e8d5cb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265350, "uuid": "b49f28bc-ac55-4193-8e14-35441cabd0da", "value": "e8a22cc34f37369349d2d12ed98359ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5a3087-e9d3-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711280445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711280445, "uuid": "29d2a394-e3ad-4844-8883-49e38cfb0676", "comment": "Malware payload", "value": "9b71ddc601bc4786123476315351bf5e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711280445, "uuid": "b69cebe3-b0ad-4509-ac0b-dba7867fc234", "comment": "Malware payload", "value": "e241a3808e1f8c4811759e1761e2fb31ce46ad1e412d65bb1ad9e697432bd4bd", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711280445, "uuid": "de6ae38d-a011-4a8e-ad90-e80e35a81604", "comment": "Malware payload", "value": "f29eaf19b4aa6cb0ddf25c14538fd13a83bbd401", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711280445, "uuid": "696083b2-4617-4c42-a61d-ad0ef50c8ae2", "comment": "Malware payload", "value": "14dba314ddbbe1768c0233f716532d256ea4a3a600ad6b11d9976baadeadb97f3f72e789305f0a2ab5b244946d1e0346", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711280445, "uuid": "b23e65ce-5635-4d3b-bccf-209ef176d149", "value": "T156F6AD77914338E9E5A98CB4D11025426DAC388B5738A3C7BAC471F667BA7E48E3D730", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711280445, "uuid": "fff9fcf7-9881-466d-aa07-98c064e12d01", "value": "49152:c8nxDgC7g9rb/TBvO90dL3BmAFd4A64nsfJ7QQzjFHWkMNRCdQqzB0dSyG2VjMQX:cqYUQuVDt0TZE0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711280445, "uuid": "2cae96f9-a4b5-46c2-9e9a-7d184a6341a6", "value": 16285696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711280445, "uuid": "89433dd9-37fb-4cd3-a30d-95e70b52f6a1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711280445, "uuid": "16f60d41-b439-41e6-8709-0cbd0c6e39fd", "value": "e241a3808e1f8c4811759e1761e2fb31ce46ad1e412d65bb1ad9e697432bd4bd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d1e1675-e974-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711239621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239621, "uuid": "b517b51b-fb4a-470d-b793-50573a7d7eba", "comment": "Malware payload (Mirai)", "value": "4ef49c8beb6f6314a5a3ee12f2384035", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239621, "uuid": "ae4c7e8a-55c3-4464-9f51-e2613ccfe9b9", "comment": "Malware payload (Mirai)", "value": "e2e93c376d19df2830e101f303cd4f22805f07b9ed7d32e024429393cec5b717", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239621, "uuid": "b0dec9f8-deb1-4b64-8cd2-62692c71376c", "comment": "Malware payload (Mirai)", "value": "d390c33dc200218095a38f9155f460e725f17dad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239621, "uuid": "2a60fc1a-7332-44fc-ab19-c3ef9d4bef24", "comment": "Malware payload (Mirai)", "value": "31f31dd2cf1831d2bf016b06fe839722c839304e05ac3f760d22f730d1a0516d72b4368967b67417d2ed2cbbbdf53dc6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239621, "uuid": "b8e228b8-e483-49a7-9223-02e8b48d9853", "value": "T1DC931A07BF610DBBC85BDF3202D70E31248F99D6676227293138DFB87A4658A1AD3D64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239621, "uuid": "e9f63ca2-0bd5-4d74-b79a-93785b1712f9", "value": "1536:JNV8gs4opZiBZ+0MC9TXGTO4VyHg0W9iForTmc5U0yM/pzt:JNV8gsPp4GZC9rGVwA0lo/mwU0X/Zt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711239621, "uuid": "f8c679ce-8119-45bb-8518-86be38f5f189", "value": 97624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711239621, "uuid": "9617fd25-4426-4654-880b-9189733499cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239621, "uuid": "6c76fd62-0e1f-4cfd-a84a-b0e90580186d", "value": "4ef49c8beb6f6314a5a3ee12f2384035", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9a82fe2-ea0e-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711305972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305972, "uuid": "c2b12c6f-0e2a-4215-b09d-7f1a723d1190", "comment": "Malware payload (Mirai)", "value": "2051ed0f6da097efee9b91cbc8fdb9b6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305972, "uuid": "d730b401-6b3c-426a-a703-a5aafdd88575", "comment": "Malware payload (Mirai)", "value": "e37f4fa0e71402767605c95f7a96c841cb0027e82e0a2815e3b4a3ac04740310", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305972, "uuid": "ca106c41-3d50-4cf9-b402-3b2d6aa81e81", "comment": "Malware payload (Mirai)", "value": "f73da0fec862bb13c319baa4195b6bab2a60290c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711305972, "uuid": "a0172340-08eb-4cf4-ad97-1770b15aaaf7", "comment": "Malware payload (Mirai)", "value": "ef312e4819f3795a4c65174c787fa5b2e42db2d1c3513e9a85eb8d5b09381cece8aa9c4fcee10b3bf76d8356eb3ac97d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305972, "uuid": "646ff823-51ed-4e2e-92ce-2f5b45799b87", "value": "T15C434AC5F643D8F5DC9305701037BB265A36F0F51218E743D3A9AB76AC92702EA16A9C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305972, "uuid": "68b29f7a-1f31-4e80-837c-97037da7a5dc", "value": "1536:1rqcMLOJpN50g6xK4GpsPKQSwNo+rWHIrqM0:1rqcMLOJtjl44mKQnNNChz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711305972, "uuid": "55c03d78-e3aa-480b-870a-3317cd77a317", "value": 59088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711305972, "uuid": "ea1b0259-7bbc-408c-a561-d551253b1dce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711305972, "uuid": "7a658a05-1f42-49b1-9529-cae5e307086b", "value": "bot.x86-20240324-1846", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83947edf-e9df-11ee-a120-42010a9c002e", "comment": "Malware payload (Vidar)", "timestamp": 1711285668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711285668, "uuid": "e46e3a15-64e6-47a3-8845-84719912833f", "comment": "Malware payload (Vidar)", "value": "53b467498a612d6aabdc787d14cb03ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711285668, "uuid": "45307005-0889-43c4-b6cd-098c8af71655", "comment": "Malware payload (Vidar)", "value": "e392ce09860656d869b34faec406646a63e75ee536999ee5ecfb23bcc23cfd2c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711285668, "uuid": "ab29f8d2-9a12-4f9b-9b28-34ae852a7925", "comment": "Malware payload (Vidar)", "value": "e2ab1207813a45ccc2357ceb8c085b75eed2bc40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711285668, "uuid": "d2cb7472-c02e-4d5f-981b-d2a24ce0030d", "comment": "Malware payload (Vidar)", "value": "4e05cebaeab719fa3d20440d87e4a385a13fdc530dc5ecae75d1800d66146eeb8990ae8cbf0c615b2a32b794734ffe58", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711285668, "uuid": "6b62bedb-e283-4a14-a57d-4000b0749617", "value": "T1A824124963BF50A2D86A867555E344C003F5C30EC5ABD99FBC8F22889613BDFE744B85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711285668, "uuid": "900b1fe5-5e40-4d40-9e89-f6bc890975ff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711285668, "uuid": "587dddb5-6ab7-4233-b7c6-421b0047ca78", "value": "6144:wlNXxcLUjkG4b8BUseuL1e6XRRe9QY/WnaI+UVV2:hUAG4b6UseuxJ1Y/0+UX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711285668, "uuid": "8b3d0284-854d-47c1-abcc-2a94d8592ba8", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711285668, "uuid": "09622d7b-95ad-49d8-a192-49d7d760676c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711285668, "uuid": "353e2bd5-3ce8-474d-8ef2-5330c53ab2d6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73ea8bd-e980-11ee-a120-42010a9c002e", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1711245033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711245033, "uuid": "e9f69103-dccd-4397-9640-a322430c893b", "comment": "Malware payload (Socks5Systemz)", "value": "c38657e4d1f8fa6d62e4d6206660617f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711245033, "uuid": "e91b698b-e190-4bfb-8499-3a583812349c", "comment": "Malware payload (Socks5Systemz)", "value": "e604beaf6d3c8bddc0c664babf465e6210f53fdf1745ad8173a34bec3d35cb11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711245033, "uuid": "53c23001-d653-4b04-9617-c482085a750d", "comment": "Malware payload (Socks5Systemz)", "value": "42b07485195e3bf7a5d67b838c8c397e531492bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711245033, "uuid": "63a547c4-5ab1-44ec-8f8a-39bffe1cff1f", "comment": "Malware payload (Socks5Systemz)", "value": "78815e9b46200b1aa8abc9d2b5e1de6f116541fae55f6453c2a81eb883a6fa9e734313adbfe97c0d59fd9b457db4907a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711245033, "uuid": "84262898-411d-4b8f-92ba-e5d0a6d0bcee", "value": "T1B3A53302E7D1F03BD195FC724E15642A9773A9B838A68199329C2DCD1FDB8B24C5E363", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711245033, "uuid": "3a072d5e-69f1-4330-849d-9f6134eee256", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711245033, "uuid": "5380f035-a964-4f47-aa4f-cef906d404d2", "value": "49152:32oYfZz5qNVwfp98z/D7P/VFPjd70xiw4F+WUM:moYfCVwfXo/33R70ElpUM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711245033, "uuid": "19d16e5c-f146-4a27-9c89-b511cf08386f", "value": 2131891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711245033, "uuid": "71316d62-2160-4cfb-85e8-4fd32dc3a5cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711245033, "uuid": "e5391083-6ebb-47c1-aff3-0a14648100a9", "value": "c38657e4d1f8fa6d62e4d6206660617f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3974889b-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265358, "uuid": "46c36af7-7d09-479e-95f7-fe6b481accda", "comment": "Malware payload (Gafgyt)", "value": "36a6d7af6b8c1502a5cd77178b29473c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265358, "uuid": "0d71c0a8-15cc-4fd0-8ce0-1d47be7bdef9", "comment": "Malware payload (Gafgyt)", "value": "e73bbef9c7fcaf610c858be52a375b517bc62fd7e05dd867f928cd353536de16", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265358, "uuid": "80b3e678-3cc6-4848-8b6a-e9076a40c0a9", "comment": "Malware payload (Gafgyt)", "value": "80c555971244e4834714628b681c0ab9b7248184", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265358, "uuid": "1e3df2e1-1056-4147-b70e-92b74ed8f620", "comment": "Malware payload (Gafgyt)", "value": "92bab22f387a27184ba1dc5e8e67d3c74219a477742b13dc30af4e3967a979a5e72495665577f5b6a5f3e26a07cc039e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265358, "uuid": "3f19c3e3-cbaa-4f61-9b3f-644824301ea2", "value": "T197C30A97F510E5B6F40AD73708D38A247270FBA14F531A2263177BAA9E362D4385BF42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265358, "uuid": "a39971cf-257d-46c2-a1ec-cefc545b73b8", "value": "3072:fprD8XOyC3WpQeqacWucW0JcWcBlyf0EbhxbqSZ93PMammmYzO0G3I4W:fprD8XPCmpQeqacWucW0JcWcBkfrbXxb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265358, "uuid": "9232518c-88ae-4c4f-b9ab-2be2ce82a434", "value": 120973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265358, "uuid": "c1715d30-a92d-45fe-a95b-d50eee624be8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265358, "uuid": "3bfc9e25-51e0-4b6f-bd23-13b6314a1b8c", "value": "36a6d7af6b8c1502a5cd77178b29473c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43437825-e9b8-11ee-a120-42010a9c002e", "comment": "Malware payload (RustyStealer)", "timestamp": 1711268810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268810, "uuid": "73dfe0cb-32b3-4798-9240-d2155d50ed46", "comment": "Malware payload (RustyStealer)", "value": "8e47e759cd2313cc63f73391a1255aa8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268810, "uuid": "ed57ce21-51b3-4b21-82d4-98e29db867e5", "comment": "Malware payload (RustyStealer)", "value": "e8ce9ca643e44391da9ebc5f27ac19cf8d0f2f893e96184a42b86dc2707c12cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268810, "uuid": "5c7d70cb-882c-4180-ad02-477af3ad7381", "comment": "Malware payload (RustyStealer)", "value": "2d2a4c6cbc3752d2d662e1e1736a25aa0c073155", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711268810, "uuid": "5c67f68f-a247-481b-929d-cbc764342295", "comment": "Malware payload (RustyStealer)", "value": "602f49c80036b6131a09ee746d4772e777aab6309a65fcb8273dd1911e392710ad6deea5965d38d1f17f4d1322020581", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RustyStealer", "colour": "#889E80", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268810, "uuid": "2434973d-2285-418b-9cb9-1992e2327b91", "value": "T182873302FE8586B7C84F0275982ED33D8737C5095719C7C7A3685C6C7DA23E12DAA26E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268810, "uuid": "445534b3-cca7-40a7-8717-2c92bb8aa04e", "value": "45a3847720d75d596d00c9736f6fe6a0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268810, "uuid": "fc1be0fe-8c0e-486c-8fdd-dee4fff79e4d", "value": "786432:V8MxjUpxXt5GerdtH5NydXdH/LWg3vY7rVk9885sY:V8cQEerHKNfLWYya9xsY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711268810, "uuid": "68b79e78-ce96-458b-8688-1f9d761306cc", "value": 38656032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711268810, "uuid": "b79a5e82-7e54-4aa6-a1c1-10e5a62f72e6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711268810, "uuid": "c3b7e5fa-4ff3-43c3-992f-176d38d842f7", "value": "SecuriteInfo.com.Win32.MalwareX-gen.28053.2801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69bae6f9-e99c-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711256849, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711256849, "uuid": "cb448d53-b94d-4a30-af14-a3950bb92cae", "comment": "Malware payload", "value": "d83c15225fbc8c0b103ff7f4e6f945d3", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711256849, "uuid": "554fda55-e1b7-4d64-89f9-b7509271a999", "comment": "Malware payload", "value": "ea5252904dd09443a92e4ce872d476dfe60d95588afda3bcf6f4e971e64a79f1", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711256849, "uuid": "d7fed697-0f6a-4409-91c4-f32b3676e873", "comment": "Malware payload", "value": "e721db4d0fe84157816be3e463a55712ca08046e", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711256849, "uuid": "9c7bd5db-d13e-4633-bc72-46bbe0a7edf9", "comment": "Malware payload", "value": "77619ccbbb5b3bc0ae29966c4e868b9cddbf938e691574aea676beddd8ecada6f803040e12cb3634a1290c93e39ad704", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711256849, "uuid": "8675e238-0767-487d-bb1e-8d5e6e038aa9", "value": "T14D7423E4EDC4EE4BC62B9972CAB780397E9143116015B36B9E5A21218B71CFC49B1C3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711256849, "uuid": "6d408b1f-271d-4c49-a72a-0d46c314cd48", "value": "6144:ZhN9CK/HmM4uJWfDZ67IKhlmVbLwPkQ/W5KToZu4qrAczZ2:ZhN4aHmM4uCY7vhsLVsUU4qMczZ2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711256849, "uuid": "f802e3db-bea6-478d-aa5e-612825c5a35f", "value": 350712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711256849, "uuid": "038be91d-f9d7-48bd-964f-4ee7ec0637cc", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711256849, "uuid": "c3ec4f39-d796-465f-b25b-46e8c1e7d8fb", "value": "2_5204327158075418602.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2fc057-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265334, "uuid": "85273197-c33f-4b6a-bf27-744e46d84046", "comment": "Malware payload (Gafgyt)", "value": "918ddc07f27b1ceec21cdc0e90e3a802", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265334, "uuid": "258d7cbc-ab2c-4e6d-ae04-c3585fe26b3e", "comment": "Malware payload (Gafgyt)", "value": "ed85c3e25bac63b7e232ac3cfd91116bf7c64f1c4c96b933d5715bbe055ffc89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265334, "uuid": "388b8656-c1b6-4e8f-8f89-dedbd15b17cc", "comment": "Malware payload (Gafgyt)", "value": "306b48c7bc12ab987ee9f9fcd5a2aae7cfb6ac00", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265334, "uuid": "a2fe0f75-b47e-4394-8c54-e878fdde8283", "comment": "Malware payload (Gafgyt)", "value": "c949b798aefd8a255c9319e1e586f3335b3dd98ac157652ca5e2459265d3213d1282783ba718349ed743968d55eb113a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265334, "uuid": "b0336ce7-72f4-4f33-8b6d-c1c7c9a937fa", "value": "T150F34A05DA408B57C1D2277AFBCF424A33239B64A7EB33155938ABF43FC27994E26116", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265334, "uuid": "87d4c465-a70c-4121-bc84-44b07cd3970f", "value": "3072:J2Y+/6kCgziZQ8a3eJfpaJowkggE8ayi+cPxVrPXWmLwSguWrpW:06vgziZQ8QeBpa+wkg9hyi+cPxVrOmL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265334, "uuid": "1c9fd965-471f-46ad-a3f3-a7598b02630b", "value": 163069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265334, "uuid": "b90118ae-9783-4b9d-91c9-1e76850f22dd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265334, "uuid": "cc92ddca-9240-4db6-b271-80fa43fd10ee", "value": "918ddc07f27b1ceec21cdc0e90e3a802", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff736767-e9a2-11ee-a120-42010a9c002e", "comment": "Malware payload (LummaStealer)", "timestamp": 1711259677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259677, "uuid": "0db81792-a365-4a73-b61b-f9f6c41dd963", "comment": "Malware payload (LummaStealer)", "value": "ea63aee1703bf8384b1d3147a88b2a2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259677, "uuid": "8ae241f5-98ed-4a72-9fd3-fb9b06c59885", "comment": "Malware payload (LummaStealer)", "value": "ef0f2ca71bcb2b40a2565f6d39b93eee204e29e39ac54a6bfe04d2cd157e4e45", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259677, "uuid": "13da7bad-163b-43c5-b140-7f409a7dbc19", "comment": "Malware payload (LummaStealer)", "value": "4bbb7e7bc037dd13c77d77b5e60344af99d98aa7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259677, "uuid": "52818762-d410-4f21-afdc-8c9293d8a11b", "comment": "Malware payload (LummaStealer)", "value": "f706ec41b0e219af9449265d1ae96dfd09ea3dd2af8aa28ca7662d7ab074c8dc88dc8d138cbe93deccfb06d034fbd8c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259677, "uuid": "9e10938b-fb47-4a67-994b-1da9524c39a7", "value": "T16974DF013AE2E471E1F647321A749AD5063FFC7399758A9B3394270E6C712C25A73BA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259677, "uuid": "eea7e45e-645c-4a23-a0e8-dcdaacb5492d", "value": "2d647858024fd9fb9c601e98afa143d2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259677, "uuid": "7c661343-21be-4b1d-b1ed-b1ee8ce4e479", "value": "6144:1MEequGqKGJWHKWB3BC2kVa51Vh6D6cqQQurhLk7t:YGqK+YBxRk451VhO6cTZQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711259677, "uuid": "3bace2ae-753f-47c7-bb4b-9220aa27c192", "value": 359936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711259677, "uuid": "98186252-636f-42cc-a939-399f905e5185", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259677, "uuid": "04f8df8c-9f3b-4859-8775-fb0b0986a69e", "value": "ea63aee1703bf8384b1d3147a88b2a2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa84c5d-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265341, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265341, "uuid": "4b407773-860d-4d00-8a53-a35db0033906", "comment": "Malware payload (Gafgyt)", "value": "f2c2ec92b3c64199555b761fedf79c4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265341, "uuid": "f9ab1ef9-19b9-466e-a353-56b2a0830330", "comment": "Malware payload (Gafgyt)", "value": "ef30bd34f8c11e042e2600c62cf702515c94290207cf72fad1ec0d277221bb70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265341, "uuid": "42d63fa3-91fa-4800-9c44-cef853864ab5", "comment": "Malware payload (Gafgyt)", "value": "6de4684a34e14d83c1a74b3617bbf27c50e708ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265341, "uuid": "ea202456-8296-477d-9d91-9ed1dd67e01d", "comment": "Malware payload (Gafgyt)", "value": "f7790c9149a56874b38bcc3d62c4d3d163a1bb4b2e5c60d69983d31c9108a0d6f1ccc1d3ab8c213795c8da5ab3699935", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265341, "uuid": "712f48da-bd11-42f7-a0cc-5ec76516df60", "value": "T17BB34B13532D0647C49B5EF02DFB27F583AEECA222A25644991EBFC05773BB06046F96", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265341, "uuid": "3077776a-b5ce-4b37-a589-d0a77999ec67", "value": "1536:aEbrnzmtcnW1MMISsfkL/VGOlA4o7I0lbgfE6A81/bTqyDIhImTE/O8tamW:akjz/WbD4ZHmFDTqAxmo/OAamW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265341, "uuid": "9b1fe5bf-e89b-43bc-8385-bc63de3ab27e", "value": 115904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265341, "uuid": "d10cd120-6912-469f-ae6e-40687171cc96", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265341, "uuid": "85ec89c3-1f7d-4877-827b-8dd2adf496e5", "value": "f2c2ec92b3c64199555b761fedf79c4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17884e6b-e9ed-11ee-a120-42010a9c002e", "comment": "Malware payload (RedLineStealer)", "timestamp": 1711291500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291500, "uuid": "8400944d-f7fa-4dd8-adf2-13d0752993ea", "comment": "Malware payload (RedLineStealer)", "value": "a8f21ffc9630c023fd163af0da7ead26", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291500, "uuid": "dc6b465e-52d6-49e0-848d-bd5808e35d23", "comment": "Malware payload (RedLineStealer)", "value": "efc1cf307c9475a3c3ffdf3fcdeac5a712c9863242a2bbb043d64c25a143d0df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291500, "uuid": "7bf1826f-1bbd-4362-bdd2-6812647aa975", "comment": "Malware payload (RedLineStealer)", "value": "a4d39a5c6fc506eddd267ed4174ff3986f168121", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291500, "uuid": "2eef20b2-5d76-4359-92e3-537140e2ac36", "comment": "Malware payload (RedLineStealer)", "value": "b469d41a6deb0eb8e84d131bc31c7b9a18acb8fdc764a573002603cae8d6b1e42660367b188d53ec1c97a8417a84f8fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291500, "uuid": "31befbb5-3a71-4c00-80a0-44d03b29a4c6", "value": "T1CA16BF12F6D4CB12C1EF9676C9F2141817B5EBA79762C31E36AC27B90F537264E83242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291500, "uuid": "e8bcf03b-6ab5-4ca0-9293-25b4d45cf657", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291500, "uuid": "56601165-cbc8-43d4-bf75-73d1d6b5aa99", "value": "49152:UZpwrL+M9T9fSRvgwJl5FQsSRWZwpx1BcRj0wRUAAV7DW1lDj66Na0BYrM4:UyL9aUsSRCw/1Bc1opVDWvfNaOyM4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291500, "uuid": "0f0a54a8-6b78-48ae-8fa0-e0e49c7c6fd3", "value": 4309408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291500, "uuid": "e33fb1a2-dc14-4c58-8ec2-49c4cbbb792f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291500, "uuid": "f0b645b9-38f2-4f08-a0bc-03c71846fcb3", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86e7801e-ea2d-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711319175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319175, "uuid": "27eafb36-a80a-41f5-9b08-56221d074814", "comment": "Malware payload", "value": "9c32d6bfff2dc20914a7f67c4b3dab5c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319175, "uuid": "550aed90-7c95-4bd0-a0b1-61370e3bf3ae", "comment": "Malware payload", "value": "f00960758e817161a35d897afdaffe12ece240e16b5315d0d9aaf7c63e7fd619", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319175, "uuid": "ba10d430-c4f3-4d1f-a149-004fadfaed20", "comment": "Malware payload", "value": "64e0ac3ed536b7401dbb4eb2ef389f5d26e8d12e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711319175, "uuid": "4f7bd8d1-d610-4310-92ac-73d5e48c6749", "comment": "Malware payload", "value": "a108f74f7419259f9681864a283e29181ba2c16be10579e5979166248ff328df82c325e4590512b21c2a4146ab9427df", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711319175, "uuid": "4702b882-d35e-4865-83c8-94f2977b01a3", "value": "T1BEB53315B31787B1C9854A35F482A61902DC93E9572BDB1EF14A0BD9C0C36DFEAC1AE3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711319175, "uuid": "902181ec-efd6-4422-aef8-7cef3c2199c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711319175, "uuid": "b5203f97-51df-42cf-a514-ca571f9ea235", "value": "49152:6UENWo8koI3hM1FI9LaMAcPmu6/XnZd5e9TXu35YOUoVE2l/nh2JqG:588GRM1FI9La1c+LvZ0TXoUJu/s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711319175, "uuid": "c8973ea9-b007-4a62-832e-ab2a6952ecc0", "value": 2439680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711319175, "uuid": "d3c245d6-f70a-4047-8d4f-7f21abec5fb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711319175, "uuid": "7abf33f9-d53b-4da4-929d-f3cd329d2317", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241bde82-e9b1-11ee-a120-42010a9c002e", "comment": "Malware payload (Gafgyt)", "timestamp": 1711265751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265751, "uuid": "dc8a2240-6d37-489e-9b6e-d388befe8b3a", "comment": "Malware payload (Gafgyt)", "value": "6afb6ce3b5eaac5a043b3c10a906deff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265751, "uuid": "281a3514-398a-4822-b1ca-3b76727ed71f", "comment": "Malware payload (Gafgyt)", "value": "f0d62aec4a2a5353a6416bbd403969fc0617d08aeb8eb9e09de4d4068a2fd9f3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265751, "uuid": "3521a5da-403f-4b2f-af54-4d2494b8b88c", "comment": "Malware payload (Gafgyt)", "value": "824cec63144c6b878f1716142001cfffc5bbaaf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265751, "uuid": "66875f51-90b3-42f1-8880-e4fbc3196c13", "comment": "Malware payload (Gafgyt)", "value": "b537d43d8a0d0a3bd1b4870ca45ca6abe684cd9067af378c8a21e5ef74f5b5ee77adf5bd0b459c8ab97bae9c59e6872a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265751, "uuid": "41ae0883-3e96-4c64-a5d3-3a73e6f87707", "value": "T199F34A05D6408B57C1D2277AFBCF424A33239B64A7EB33155938ABF43FC27A94E26115", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265751, "uuid": "75f76e64-94c1-4e5d-8940-b884f117cefa", "value": "3072:J2Y+/6kCgziZQ8a3eJfpaJowkggE8ayi4hrM/9rPXWmLwSguWrpW:06vgziZQ8QeBpa+wkg9hyi4NM/9rOmL7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265751, "uuid": "3acc6193-c425-458a-888d-bd1a9e0b1200", "value": 163069, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265751, "uuid": "348241c0-db54-4451-9f9b-df786f35c368", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265751, "uuid": "8507b91c-b0e6-4cf0-832e-c58dcd2895de", "value": "6afb6ce3b5eaac5a043b3c10a906deff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48f4afef-e974-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711239614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239614, "uuid": "25d1a899-59c4-4c29-8bb1-b277e44467a9", "comment": "Malware payload (Mirai)", "value": "4ae2ff5bbd8154e63f87c891c70fdeea", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239614, "uuid": "16439185-e032-4fda-87b5-267b7b3aaffb", "comment": "Malware payload (Mirai)", "value": "f22d7a0f934380778ed19c3b80f0e7fd8429a14a859ceaeb79edee9a1f242b01", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239614, "uuid": "7f5f7577-7842-454d-978c-556d834213b6", "comment": "Malware payload (Mirai)", "value": "5ce78142ead790b5306a3481488f00f697f9da26", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711239614, "uuid": "9c856feb-d519-4350-8c5a-8f60871b5759", "comment": "Malware payload (Mirai)", "value": "91231fc5ff536f5cc453408eee28bcbc924e2f46d9b30235d696f773ca4aeeebff24c9ef283307be0b8fd890d6cf571e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239614, "uuid": "237e3244-bc77-40a1-af4c-55728e964695", "value": "T16C632AD7F901D6B6F849D7334C57490AB671F2E00A832A7267A7327BED3A198142BDC1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239614, "uuid": "537d50ab-d703-4c8c-b332-511a595012be", "value": "1536:vKsEfRg8bq5nODQekacWVcW0JcWcBxDQxMzfYzhl4keyR4PCF45KRK:vKdq5ODQekacWVcW0JcWcBCxMzQlmJWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711239614, "uuid": "a7e9c1cf-733d-4220-95d6-8048bd5d8437", "value": 67480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711239614, "uuid": "da3a5bf1-d8e2-40c1-aa35-edb358b68bd3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711239614, "uuid": "fb2b3c71-ccb0-44a4-b5db-415731a76a29", "value": "4ae2ff5bbd8154e63f87c891c70fdeea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "adc29765-ea33-11ee-a120-42010a9c002e", "comment": "Malware payload (DCRat)", "timestamp": 1711321817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711321817, "uuid": "1e3cc5eb-5da3-48d6-a7fb-8a3e7148d26e", "comment": "Malware payload (DCRat)", "value": "2f59fef39db1a9eb8cfd055eb1d39a2e", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711321817, "uuid": "91562195-8538-4ee5-aaa9-3412e4e3fe89", "comment": "Malware payload (DCRat)", "value": "f29ac305a7d2954b82a3a25f8b23fdf7445d874039a64be6e0a044683c4c8876", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711321817, "uuid": "aaa6e69d-15f0-45fc-8b35-9655237ec6d4", "comment": "Malware payload (DCRat)", "value": "67e432431670ba8569d525d99cbe474ccdec0041", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711321817, "uuid": "06df4b10-42b6-46b6-873b-0c6b669bbcc8", "comment": "Malware payload (DCRat)", "value": "4661b8015926fea0221e0b4d147f481bc458186569b4b32046d0c952d6d4f7062283856d1aaa3b8235568e94ab6f9003", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711321817, "uuid": "3d7f0804-4ed0-469c-a34e-75228d4291be", "value": "T12D95BE06A6A25E33CBA57F3084DB016E87F0D6367522EF5F351F1495AE672308A133B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711321817, "uuid": "4f942680-bdc6-4893-8e6f-27b12ce9adf7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711321817, "uuid": "0869c930-9a1f-4e42-99b3-b8e53562074f", "value": "49152:L2w9ydaJwXon7pcH8zfC0ZnDtU4pmcjjYH+:L9IojFdDRY2b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711321817, "uuid": "e81049c9-a215-4932-90a7-02a83b068c35", "value": 1937408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711321817, "uuid": "f1a3f469-7c4d-4b50-8635-4a70a0a2b97e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711321817, "uuid": "7a3e377a-7c33-46fd-adba-7486119a704d", "value": "2f59fef39db1a9eb8cfd055eb1d39a2e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c373939f-e9ec-11ee-a120-42010a9c002e", "comment": "Malware payload (AgentTesla)", "timestamp": 1711291359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291359, "uuid": "0a618918-014a-4336-9174-5bfff38a46eb", "comment": "Malware payload (AgentTesla)", "value": "fd919aa5b7aea5c2a5c35f10fd20f513", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291359, "uuid": "3ba88b05-1bec-4dc6-9776-f8a6b826c1bd", "comment": "Malware payload (AgentTesla)", "value": "f3c4c44285b5439a4c608e38beb95ada32d34f68b83ed9795649185754d9d5bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291359, "uuid": "e7e199c0-5112-4c56-b32d-5b50a08c93d0", "comment": "Malware payload (AgentTesla)", "value": "1c83c1eaba12327c4f181395d33a5d008219c181", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291359, "uuid": "2e1c9cb4-f76f-4072-bb9d-583a3ab4e4a3", "comment": "Malware payload (AgentTesla)", "value": "1c7f7955eb829f0fe4d0c13a082d4bdb013bc99ad42a20afce446b8b856db1e42f7cd6abcf15c0b77ffde745aceb385a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291359, "uuid": "7c464b24-28cf-4633-b20a-dccaf10ea6b2", "value": "T142D4231733648037D645DABE22B484B2073E8C2F19C5D6DD8E8A485A6A73709BD3F717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291359, "uuid": "671713cd-ae9c-4ff1-bd64-2bae65c9bdbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291359, "uuid": "be00da70-55ab-48b3-b003-6ea7ae0cf5a0", "value": "12288:5Cs3/5ilX5GUEKAo561YL85U8k5vFF9CbppQxYi46+08TOeZS:kwBgpGUEBWg5UNmbppQ9JMTxZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291359, "uuid": "7531a389-5987-48d0-abe0-33e3745f1fc9", "value": 652288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291359, "uuid": "2aa89f9f-be56-42c4-85b9-1f84fe661b64", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291359, "uuid": "0cbd1dab-8812-4543-9078-e01a73293dfa", "value": "rNew_PO1783919\u202622RFQAmended.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac710fd-e9c4-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711273869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273869, "uuid": "f38806dd-34be-4f58-8d32-31fc8071ce27", "comment": "Malware payload (Mirai)", "value": "2acb58562af6b6ae87c47b6429e4805b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273869, "uuid": "4151c484-d45e-4324-a837-89955d48fbc0", "comment": "Malware payload (Mirai)", "value": "f45acaf7f1ed079fd03800f9f74a531586bf1ed7c26774ae2d3ce54226e74f67", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273869, "uuid": "6d673a15-be42-418f-9ca7-2db3b6d498dc", "comment": "Malware payload (Mirai)", "value": "4da49d0357eee8f726e72492ea902075032d212c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711273869, "uuid": "5f1671d5-8b6d-4406-9cf1-6fce60a05df9", "comment": "Malware payload (Mirai)", "value": "01748ef3b2066842f831815402dbe08948a5215e521be1959cb8498fc14d0c060b18f9da7c565a2d02c4fe3e03b62464", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273869, "uuid": "99df3e4a-88f5-4e05-ac3b-9c2cbf5c7ad3", "value": "T1CD532A49F8428A57C6D512BAB72D118D3B3493E8E2DB72039E211F6033C796F4D7BA85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273869, "uuid": "d3b74794-a8f5-4120-a364-06bbcbd25de7", "value": "1536:cFQEQKQKQYJgr1tzw9Z+ghDZ7Adz5FBizrnP:vxzzYJqzzwLxl8dz5FBizrn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711273869, "uuid": "9134e304-a780-409e-afa2-e6f93ed6d561", "value": 66708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711273869, "uuid": "8ab6ca99-0b96-48be-841a-4217f4d743f9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711273869, "uuid": "8449e775-fa02-49be-a71f-68a829e8f44d", "value": "2acb58562af6b6ae87c47b6429e4805b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a847f00b-ea08-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711303339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711303339, "uuid": "ac5b6567-de2e-4495-bb2c-9d8411f2bfac", "comment": "Malware payload", "value": "6ee526d147baebe44a3147677e839c04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mariyeltherapy.xyz", "colour": "#56046D", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711303339, "uuid": "49188a71-ce0d-4df6-bf92-184251c4f6b6", "comment": "Malware payload", "value": "f620579589b249075ada5af21c8180d904f8a914092654bf6f097b6a3fea613a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mariyeltherapy.xyz", "colour": "#56046D", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711303339, "uuid": "2c9b71ec-70fa-4125-9145-23e81f9607b4", "comment": "Malware payload", "value": "9df1b5532cda58677fd44800aac5aadfca9a7471", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mariyeltherapy.xyz", "colour": "#56046D", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711303339, "uuid": "950e3ea4-6a7e-43cb-91ea-7237f141dbca", "comment": "Malware payload", "value": "53747502817381c9e598446cf6a4cb877743dfdf293d3490c63b96366bdd39a0f00590e8aef2208c7f6806098f094d23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mariyeltherapy.xyz", "colour": "#56046D", "exportable": true, "hide_tag": false }, { "name": "SrryStealer", "colour": "#1DBC10", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711303339, "uuid": "63bdf8e7-4438-44e1-b94c-5cb0310a716d", "value": "T14308337B1759A224F8A631FC153D6AAFE524D0A0379074E33C7BB6C18C868D7AC5C4B9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711303339, "uuid": "4651fce6-c60a-491e-be29-fa0ddf23a1c4", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711303339, "uuid": "9cb7001e-a7da-4765-a0d4-27bec20ab0f2", "value": "1572864:Ln6LBYqMn+/9YQxwQBZHBFdNYZvpXuyUsA7:LeuD+/9RxfzFCHUsA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711303339, "uuid": "c9d32311-21f0-4136-84a0-d6bd91056a0e", "value": 82894599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711303339, "uuid": "31927338-10e5-45fc-958c-bb864f674430", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711303339, "uuid": "ff49c226-abed-4e96-88ef-1cfd5aae71ea", "value": "MariyelTherapyInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c89d5162-e9d6-11ee-a120-42010a9c002e", "comment": "Malware payload (OrcusRAT)", "timestamp": 1711281919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711281919, "uuid": "57332edd-3dbc-44db-acef-535750f169c8", "comment": "Malware payload (OrcusRAT)", "value": "128f9907493f02c86832e77ee1baeb50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711281919, "uuid": "5a5ae092-1889-46fb-a5eb-56a2b77faa80", "comment": "Malware payload (OrcusRAT)", "value": "f877b39e42932d1cb0bb2df1742c5fb492fdca752970e3397e733218d112be7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711281919, "uuid": "fff3cbb7-b077-4c9b-9832-e23fab8765c1", "comment": "Malware payload (OrcusRAT)", "value": "1a5f9e929ed8f3a83073156403a2cd943f29523b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711281919, "uuid": "b891ed1f-65bb-4de2-8129-9fd92710c0a5", "comment": "Malware payload (OrcusRAT)", "value": "9a9647c10a8ae9bfb3e8efdc7a769e015918e87c0f1619888b2e3bd4326e9ffebbe7af84c7cceb312b9a3fdb45639550", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OrcusRAT", "colour": "#FEFE05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711281919, "uuid": "4478d14b-414b-46c7-a3db-b1e28b5943a5", "value": "T14E2512C1D5644A33C26582BFF1F24C218F26DE76B85AC5FABD0DB27B587FB648121A01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711281919, "uuid": "ef93e163-8e44-4d62-82a0-c81606f79a4e", "value": "24576:le3veFbXAD9zWi4MxO6m6b/fYLGACf9Dtc2PyY:le/etqzXOu1Ff9DtTy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711281919, "uuid": "2f5e95f3-227b-44db-b8e8-0a38899ea386", "value": 1047040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711281919, "uuid": "3b39a20d-d6dd-42f4-abcd-0290126d3d6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711281919, "uuid": "f308ca70-bc64-4681-b686-8c6fbdaf405a", "value": "128f9907493f02c86832e77ee1baeb50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be3cd42e-e9ec-11ee-a120-42010a9c002e", "comment": "Malware payload (Formbook)", "timestamp": 1711291350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291350, "uuid": "231256b4-8c4c-41bd-8704-a6296293b938", "comment": "Malware payload (Formbook)", "value": "d8aa96993292171e8a327e2a1096a09f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291350, "uuid": "efbceec2-17dc-4276-99ae-2915719b6325", "comment": "Malware payload (Formbook)", "value": "f92f69b456e8edc8d662eb9ea23f4599ba3b9b24fd7f1a4aef00fb561a6d56f6", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291350, "uuid": "ecb4db5f-51f4-4512-bed1-7d9d19a8d930", "comment": "Malware payload (Formbook)", "value": "fc2ec0a39f75b64c7a5a14b9341820d6bd77764a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711291350, "uuid": "355b94b2-8c3d-4ebb-80ec-76a0a5a9c0d3", "comment": "Malware payload (Formbook)", "value": "d09237ea8e6a9a20b5559601e06b4789e04cb66be52405933375285131053d8756ce62d73e7803f746cea652afb38028", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291350, "uuid": "b4904780-38ff-4f22-9a1e-5050ced60306", "value": "T1E4B5337776E94D96F5B0A835F0D4A342FB29E89D611C86CA3B6C0BF007A14E6177C436", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291350, "uuid": "a4dd86f4-9599-412f-8e29-a24d4128d791", "value": "49152:mlrCArWzmK+fyI++uS/L7qaZD6zuBUdpFVUWIhEhIAxx3KqfZVr:mlrCKWzCgQH1Z+I0vUZhE95Kqj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711291350, "uuid": "e7385659-16cc-4851-91b9-6ebc230854f9", "value": 2359962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711291350, "uuid": "2cd072c6-34aa-497f-a3d0-2ef0960e371d", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711291350, "uuid": "789d6f75-06ee-445d-b35d-b7e2fef41a60", "value": "nQUOTATION_MARQTRA031244.z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f1293b-e997-11ee-a120-42010a9c002e", "comment": "Malware payload (RecordBreaker)", "timestamp": 1711254618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254618, "uuid": "3448a017-6419-413b-9d83-bec09c51cd03", "comment": "Malware payload (RecordBreaker)", "value": "e79211ac8585538e841b54c4a72af824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254618, "uuid": "60b68d25-f61d-4f9b-8671-c98ed45d8488", "comment": "Malware payload (RecordBreaker)", "value": "f9db076bd8f99c606cdae2d6eb5f4ec112a705cf285138331b33ae180c352fec", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254618, "uuid": "416e35b4-e4c8-4890-bf54-ddd818b9b829", "comment": "Malware payload (RecordBreaker)", "value": "e6136c5e0724f0c720e48b3eea0339b91f53ebfc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711254618, "uuid": "e66937fc-a1dc-4f81-8f82-d01a5867c723", "comment": "Malware payload (RecordBreaker)", "value": "a4506a03ba536bfc6bdb1c2299575d30889d7c2d1c7f31eb507a8deb9f6175e43b247a81fc9fd2e397ea4534e7a28423", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "recordbreaker", "colour": "#EFDCC0", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254618, "uuid": "345db8f6-0863-4200-b069-dd4aeca15e78", "value": "T1F877333FF2A8A53ED86E5B3145B3D320997B7B61AA1BCC0A47F4450CCF6A4502E3B585", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254618, "uuid": "0454732c-0704-4066-b6ce-9a5d3ad6953a", "value": "e569e6f445d32ba23766ad67d1e3787f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254618, "uuid": "5b1cb32d-4960-4f12-8277-4aabc2b086a0", "value": "786432:SZ1AIF3dJszFfSDUPf+VKlRSadNdUTDaRXXaNu947NV3:U7ihKDUXiK3JndyGF/94f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711254618, "uuid": "4e03d8e1-3283-426c-957d-4cbc267a78b8", "value": 33071720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711254618, "uuid": "aa2baeb2-eba5-4c9a-b4bc-d857da5390ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711254618, "uuid": "751970de-0ec6-4669-8396-fee7a842a9fb", "value": "F9DB076BD8F99C606CDAE2D6EB5F4EC112A705CF28513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ce6fe7f-ea39-11ee-a120-42010a9c002e", "comment": "Malware payload", "timestamp": 1711324178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711324178, "uuid": "d9e2498e-0557-4910-bc35-1de563d32bd8", "comment": "Malware payload", "value": "dab17173b380d237ffc141531796987d", "object_relation": "md5", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711324178, "uuid": "bd925fcf-f814-4f26-847c-1cd33a2eabfd", "comment": "Malware payload", "value": "fc72694baf8bac4382548b4782436884f4425adfe696ef6bb959bf45142863aa", "object_relation": "sha256", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711324178, "uuid": "aef35d6c-e7a9-42f1-b6fd-69c04c722ad6", "comment": "Malware payload", "value": "59adcd7b859c4965a671d733ab9f17c0e4af72cd", "object_relation": "sha1", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711324178, "uuid": "f193ca0e-404f-4b18-916a-29f326545cee", "comment": "Malware payload", "value": "ff8011ae957b609c4129aace8f3ca3159e293c22ecbffe198d70e9b62586a3a4a256c6ab6559d0072af158a1c12af0d5", "object_relation": "sha3-384", "Tag": [ { "name": "android", "colour": "#E876A5", "exportable": true, "hide_tag": false }, { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711324178, "uuid": "9a1b7c62-4d0b-43b5-93e3-775b44193323", "value": "T16806ADDAE7D4A95FC4F39332D17652A1424B4D228B83DFC37954363C29BB6D00E5AAC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711324178, "uuid": "24980f46-272a-47b6-9ce9-783868c11443", "value": "98304:L9X/bDeM7qvOLwpT2I0u/WQqoTwr5qZXuzGxBvfUemGXM:5bDeNWI0uBbxBvYGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711324178, "uuid": "aa74299a-1027-4d0f-8b53-68e0c83e97a5", "value": 3925643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711324178, "uuid": "b78bd5d7-5583-47c7-ad57-586161f220b2", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711324178, "uuid": "f2746f75-7f98-47b1-adec-bf2e9926a535", "value": "ebla.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fc4a2bb-e9b0-11ee-a120-42010a9c002e", "comment": "Malware payload (Mirai)", "timestamp": 1711265422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265422, "uuid": "be67b3f9-701f-459d-af45-2f1128d1be51", "comment": "Malware payload (Mirai)", "value": "4da7fd9e30026809655157706245d6dc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265422, "uuid": "c6cd8698-4c8e-41a7-88e5-7fb8352abd7d", "comment": "Malware payload (Mirai)", "value": "fd64b42ed9300b8c284bc7771bfd59fd9799b02f2b4af31b3c88497b6cb051b8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265422, "uuid": "2c93e13b-8012-47a1-ac4e-aa732a399566", "comment": "Malware payload (Mirai)", "value": "d2c570ed9f7640a909274d2aabfd23d47dbe8900", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711265422, "uuid": "e1b836e8-0efe-483d-a4fd-41c1166e220c", "comment": "Malware payload (Mirai)", "value": "cd6ae14f4f3b8fa4108583823d79ee0112ef7d2f0367d8668c7097d0adcb2245e3b7907aae9142ca437cf26f4205d6ae", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265422, "uuid": "ca317588-63cf-46c7-9035-bd50117f0e67", "value": "T194539EB9C4E8ED98C6684578B714C93DD723940465D33DFAEB46CAA7800BAEDF0097B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265422, "uuid": "b5f8998d-a6af-4965-9d02-41c935d27d78", "value": "1536://BMsvJvJabwtlw3bqSsH6aOIy/Cfs32j/JQZI1qhC85a:/JMSR893O6aO+f+uWZIYh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711265422, "uuid": "970eb2c5-a99c-4df1-a3ae-de77b4aca78b", "value": 66368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711265422, "uuid": "281df14d-4912-4243-8f0d-caf075548b02", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711265422, "uuid": "c232ac2e-7542-4f31-b74d-521209f9a464", "value": "4da7fd9e30026809655157706245d6dc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "024e3774-e9a3-11ee-a120-42010a9c002e", "comment": "Malware payload (Amadey)", "timestamp": 1711259682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259682, "uuid": "0b44bf10-4ed3-48d4-aadd-47573f456dea", "comment": "Malware payload (Amadey)", "value": "50d55c187abcd975629a918970b0a2f1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259682, "uuid": "48a5fc00-d292-4662-9bc7-a1272b3b67ce", "comment": "Malware payload (Amadey)", "value": "ffc320e5f95d05b9eb4b50db80a8f2f29b20bc166ed6476c570d7276ce8432db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259682, "uuid": "b71c0711-42fe-4454-a894-3fa0e0010cf2", "comment": "Malware payload (Amadey)", "value": "2c248c8f093561cc2318179ea1179fd5b172e6be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1711259682, "uuid": "31d91676-33f0-44b6-a169-329b760a5431", "comment": "Malware payload (Amadey)", "value": "02f5384fb8a349b20dc31cba3c16581503cda888040cc74da74aa50b612625411dee32f58ae5dc67f6665c3187ece56f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259682, "uuid": "ff8200ab-e46c-4af2-9b18-0e4adc306868", "value": "T1B736339577829471D93225740E7BABB14F383C501B39A9CF9708343E2B32AD1A6367B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259682, "uuid": "d062f3ca-ab7d-4ecb-a27c-cbec397afde9", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259682, "uuid": "d3759ffb-ab76-4beb-aaba-35c72f3d966f", "value": "98304:9ayPd4hW/JfMkTQmWPKql6M96BRqchrx91hDORM7seCKaZSwWyQ+kivmjw38:9FJRkm6Kql6MMBRqchrx9ktBZ78jwM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1711259682, "uuid": "7dde3f32-2602-4097-b1d5-f2499da248e7", "value": 5187501, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1711259682, "uuid": "ce6fdc5c-11b5-4d93-9dda-147e2fcfaada", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1711259682, "uuid": "240da7ca-aa43-431b-9e3f-a8f5d208d755", "value": "50d55c187abcd975629a918970b0a2f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }