{ "Event": { "published": true, "date": "2024-01-17", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2024-01-17", "timestamp": 1705536181, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "240f2505-2acb-43e7-affc-1bffa24d5030", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "675e8ae2-b50b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705477107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477107, "uuid": "61f9fb8a-ea62-4ccf-9276-f6f50bdc0617", "comment": "Malware payload (Formbook)", "value": "257dd2109a5cf8d61d6ca04c66c4de65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477107, "uuid": "322ace03-c658-40dc-93af-b8392add31a9", "comment": "Malware payload (Formbook)", "value": "006911808b7aae97354fe970ba322a17b613c958f9a9bd339fb3e0c8ff3c6277", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477107, "uuid": "8ddfa994-2728-4b82-ab6a-dde6886f7b0b", "comment": "Malware payload (Formbook)", "value": "d97fad6de20926559062fc8f330735fe5736d4cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477107, "uuid": "9b5532d0-9b41-42c5-a5d6-f3dcdb5c6ee9", "comment": "Malware payload (Formbook)", "value": "a182d784b9ecc48f75706006b81d69737cf674e77a09d1d10eb420ed8495a7dfacec5e2a5cf2abc6bf8559f66d149278", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477107, "uuid": "d68d44c4-842e-4fa7-ad99-5f80c429b5ec", "value": "T10A724B8567EC1213FDDB4F36C6E782A36B70B3631671AA0E3CE4D0896D573802915376", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477107, "uuid": "d816b67f-7188-4ad7-870f-7f74b79cdb48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477107, "uuid": "2eb4ab82-56c3-4bd6-8422-28aa6eb3be93", "value": "384:3xX54GbvvXb8be01yjcYFuYF7mCnGoGCJEF8ZpHQRqf:lvf01yjrFVF75zEFiRmqf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705477107, "uuid": "d22d6b18-eb24-4f0a-990b-e3940c86fbeb", "value": 17304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705477107, "uuid": "129187ca-36cc-47c7-b7b1-34eab1656918", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477107, "uuid": "1decb44d-47b1-405d-8a1c-d1c1ac9570d9", "value": "Quotation_7 Offer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d76b4135-b53a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kuiper)", "timestamp": 1705497482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497482, "uuid": "1d5a4993-7c6a-4849-a9da-694b8c13f795", "comment": "Malware payload (Kuiper)", "value": "0608c64c57dcc09246be00f0b2767e6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionB", "colour": "#69A58B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497482, "uuid": "cb00d1ad-ff18-4d19-9db6-111d4fe0ae6c", "comment": "Malware payload (Kuiper)", "value": "0162641163a30a2edff787eeecc733ab1de46f03e213743dc768d39eb3075985", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionB", "colour": "#69A58B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497482, "uuid": "d89d3ea8-64db-46a6-bfe3-d3218dcbc3c1", "comment": "Malware payload (Kuiper)", "value": "02642663bfc7be0c06051f4b01c9861102c71850", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionB", "colour": "#69A58B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497482, "uuid": "c2e47a33-b103-4d12-b5b2-37456d833ed1", "comment": "Malware payload (Kuiper)", "value": "1c0390b11b54defc63dd47ef8594c5fb6ab02d10fef39afc2acdcf03bcc9cc224ce1173e4ecf52e42f469cb81c1c0fa4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionB", "colour": "#69A58B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497482, "uuid": "4cc26f1f-6e70-4cf8-908a-a6cb2a9ec898", "value": "T1BAB51991FDE780B1E503193144A3A2BF67307E0A4F31DA97DA107F6AED73AE10932659", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497482, "uuid": "789ca9c3-2bca-444a-b8e0-16c3f2090931", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497482, "uuid": "ea1bb9ed-4da0-42e6-9a96-0af4c703df6f", "value": "24576:Hle0XU/NWp6jCcuYTQn095MmQdg4M/YJFweQDfj0OL2wwU+T8nQl/skT9Fs1g0jv:HiG2ekwA1e7i49vZGqsCz9/47Evz1z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705497482, "uuid": "85cb2d3d-41a2-4806-918f-329297fc49b0", "value": 2336768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705497482, "uuid": "669132f8-b040-4e2c-86dc-12a0045e46c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497482, "uuid": "93b35930-e42d-4a15-a108-ba9670507502", "value": "B.Windows", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c97a9a3e-b52e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705492304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492304, "uuid": "95fb610d-4578-4830-93bc-f2786fff844a", "comment": "Malware payload (AgentTesla)", "value": "ea90f1d2e17e48c43798ddc374b65ab8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492304, "uuid": "877d579e-bf62-4bb7-b297-c38e7bc5ea70", "comment": "Malware payload (AgentTesla)", "value": "01fe4e5642a36482537667d520fc943eabb36a6f68d9b2bf0cef33655a4636e6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492304, "uuid": "b21df2e1-b56e-43bd-80de-ebd004b3987f", "comment": "Malware payload (AgentTesla)", "value": "b79fcd7c89e9a900e9b4c0fe935da3b695c58eea", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492304, "uuid": "d328ca3c-2702-4079-b268-e201cfb1569d", "comment": "Malware payload (AgentTesla)", "value": "86f4ac2edeed4b56270866926d653c773e53517ee13bbde20b11e672d157f7f8d6f4bd2000e0ad5f7fb8b932002c5581", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705492304, "uuid": "4eb4a49f-ec72-42f7-b251-571da303ecf3", "value": "T1F805335EE24F62F5B1EDB05ACA9249886D76710B005C153BEF440F30A47DBA4F981EBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705492304, "uuid": "046943a9-c790-4516-a754-2e88b41862ac", "value": "24576:VSolD4V7vSN+K1+EhBhEr0OJvqDjrhiguoA:VTeO+E+curHJvqDRit", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705492304, "uuid": "b3838d0d-9408-410a-a7af-ed34a939defd", "value": 798738, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705492304, "uuid": "cb2d558d-0a7e-466f-84c5-942844ce0fc0", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705492304, "uuid": "c822109e-87f2-4754-8fbd-fd96815f5876", "value": "NEW ORDER--GO23B005XXXX024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ec292b4-b50f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705478757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705478757, "uuid": "629f69ef-9e78-4df3-b24a-7c651743a6eb", "comment": "Malware payload (AgentTesla)", "value": "db6b175fd5e24fed2bb79f8beee17571", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705478757, "uuid": "8821ae70-ce7e-4d73-b6a6-26496cfccf52", "comment": "Malware payload (AgentTesla)", "value": "02358bea38ba2815341c446e62392e92bfdd84b41710223fe0bd0351dd9818e8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705478757, "uuid": "6946ffd6-e897-4dd9-a761-4f390a50b5d6", "comment": "Malware payload (AgentTesla)", "value": "6441712f4f4a550ca0fca22826f0e13523ec5871", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705478757, "uuid": "2437c916-d929-4b08-985e-216748d32f61", "comment": "Malware payload (AgentTesla)", "value": "44c58f139745ab421841792622eabc305e294d7fdab1d7ad6d72bc2d5a3c6d1e3bda8392ea6b687cda7cfb267519b25b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705478757, "uuid": "ae6daf03-aee3-4c5a-81b6-510fe9f10ba3", "value": "T1DE1110A3C45FC14A54E7A2B331878704F2A9AF5247C4F1CAE760DC20E05A56883B91C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705478757, "uuid": "1c1ddcf6-197a-4075-85e7-467a3665ab4c", "value": "24:wVpisneE2umEjjiyarONLKIfMgBcDr1WEr8L:Y9nn2unHarmLKGMGc31WErC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705478757, "uuid": "133729d0-a2d4-4a90-82b4-1b05c10e3843", "value": 905, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705478757, "uuid": "b7a8ebdb-7f27-4bcf-8ba2-2c982823281d", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705478757, "uuid": "561877cd-20f8-4313-af61-154a58110a46", "value": "FAKTURA_.BAT", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6242119a-b554-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705508452, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508452, "uuid": "eada2fae-07a0-4c44-adec-df390ce5d307", "comment": "Malware payload (AgentTesla)", "value": "80168c535dab41574d50fb74a31f40ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508452, "uuid": "21d58e7b-9c24-424b-9cfe-85d9ac10afd2", "comment": "Malware payload (AgentTesla)", "value": "0355977288aa774d763a6d8a9a904be009a72ca16d72a1f1bcfd54dad6e409df", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508452, "uuid": "757722da-4707-4b47-9ce3-3681ed91b872", "comment": "Malware payload (AgentTesla)", "value": "78d290f8c8716aa91d7be8fbf9db5ff4f147c60b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508452, "uuid": "aaa6b352-567a-4cab-8fae-6659f1502cb6", "comment": "Malware payload (AgentTesla)", "value": "6fb3574a8cb796fc1608c292e3f3e95fb8e0cc14eddf232be4a2f9938c73e2c974a3da049f0abbe722257d7abf4e492e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508452, "uuid": "04bab494-9ab5-4543-be54-bd4881746ea3", "value": "T11EE42355ABACCA27DD6E977E8152060143F1A0360323F3DC95A891F925E23FE1A41FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508452, "uuid": "30006d12-e954-4c22-84d8-ba6376f6c056", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508452, "uuid": "aa298e2b-ad4d-4a94-9416-c1a1c55f6b93", "value": "12288:bSQ8sTePFLVoq3FrOuDfQUOB1R9Aw01AcJ7MC6ujawPHh660Q9ujGWrVbECj4:p8EePRVoMFrOuDfQUOB2AcOkHgC9XWx8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508452, "uuid": "57c494bd-be51-4484-8da6-d4b705323b12", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508452, "uuid": "9cecb7f6-5a78-4fa0-a1bf-ef96c269e95d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508452, "uuid": "44a20b1a-da1d-4047-8050-ef08017321ac", "value": "SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.30852.22169", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cfb0325-b539-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705496900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705496900, "uuid": "d6d7045f-5c4a-4b42-b3eb-7642e93c25da", "comment": "Malware payload", "value": "41135c4e62f8a3d4dd90395194193851", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705496900, "uuid": "0e9d5d12-213d-4f47-bfa7-fcce118b4a8e", "comment": "Malware payload", "value": "040a8cde76368c8a99eac3a519ae95a8b89540a6fa6624d1bc126296d99b9b81", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705496900, "uuid": "3e3b7a1d-4545-4a43-af0e-58eda5d245a5", "comment": "Malware payload", "value": "22bc1184200c6f02d52157489dbf399529161dbc", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705496900, "uuid": "ac4f07a3-49c4-4af0-a69d-95d4b7740b9d", "comment": "Malware payload", "value": "461fcd06ef2d30f09ecab3dbf10815952801b0ac8c0ff0ef85bcaa81bf6e31bd6828141807ca5d6b5b664d485812e427", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705496900, "uuid": "4ce1e0e4-48c1-43ec-a541-ec52723f3938", "value": "T151E22E103AFF510C72B3BF561FE5B6E94D6FB6B26529A06D2005130A4B63E41CDA3B36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705496900, "uuid": "7af2c9e1-b7ab-4a84-9f6d-e9473209b8f1", "value": "768:kDRBD3N6BHm4/iPgjN6BWPgpmI7Fml7bakSJZBkfOage:YR13N6BHB/agjN6BOgpppEBUKKe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705496900, "uuid": "e701ec7d-b073-49f4-aa17-8aa8e7142a2e", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705496900, "uuid": "62a89f8e-f65c-4dfd-b995-79ed46293ed4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705496900, "uuid": "1db4a14e-a35b-40dd-a043-3397d0e43123", "value": "Inquiry HCSG2312150835.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f90b7cf-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705502086, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502086, "uuid": "88a1a465-dab7-4c6e-96d0-655035326307", "comment": "Malware payload (AgentTesla)", "value": "7a8d8d29535be9955a27a9a546736659", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502086, "uuid": "05917fb1-120d-4c4b-a4c1-9dd7267f8e8b", "comment": "Malware payload (AgentTesla)", "value": "0465fea7d826119745d345b5cab0dde724eea8e08a4a4fb2b1148067b6f9eab0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502086, "uuid": "52b8bcf1-894e-42ef-b1e5-7191cef5fef3", "comment": "Malware payload (AgentTesla)", "value": "97a7c81a5621b114926e95ba1220a46cea58e9ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502086, "uuid": "f0d5ed2d-b487-47fa-9f31-da22780f9a95", "comment": "Malware payload (AgentTesla)", "value": "a94ac7c7988d6998318d51651d2402e7e174e4ba18c6d89d4a46c5cc2a809988fe5c56fff6191558971eaa9cab6c07cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502086, "uuid": "af8f5df2-cc0e-48bb-bd70-f8b46b9e33b0", "value": "T102148DC2588242B8F4670E3411762C59627BAFAA7D7BF549BD17B4A3CF732D23162807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502086, "uuid": "24e415ac-07d9-4636-972f-dad0af7ed9db", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502086, "uuid": "158e4012-635f-414c-9efb-9352ee61e609", "value": "3072:GYfXrZ4epJFbu/k8w70df7eNg8gTZJk0M7m4u2XTho8HwUYiVqXeXv59HR:GYWepjJ700gtTbS7i2XThZwfQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502086, "uuid": "2a20a704-e4fb-456b-94fb-385b852631d2", "value": 199168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502086, "uuid": "3c9f0737-dfd0-44e8-9a4f-01f03fcb486c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502086, "uuid": "ca0c1751-b556-4974-99b4-72630ddf3f16", "value": "Requisi\u00e7\u00e3o 2024_5058_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b9cb15-b533-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RisePro)", "timestamp": 1705494310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705494310, "uuid": "246a8e9a-0fcd-4bd9-afaa-db43f7a13202", "comment": "Malware payload (RisePro)", "value": "1c2925b0ed6476fa25965382e2995991", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705494310, "uuid": "e3e8ec2d-1bf9-4252-a0bf-9e2ed495f7c2", "comment": "Malware payload (RisePro)", "value": "047f4857c6d18d73d807abb0d6a45c1761cb15ac43cdfcbac74b2b63c9f49cab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705494310, "uuid": "6f5ac038-6bb8-4f34-9ce9-93216a3f0242", "comment": "Malware payload (RisePro)", "value": "1b8d8cf943f7c642f9aad6184c6b66bc10999bcf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705494310, "uuid": "138adce4-d158-43fb-8c7c-d789bdf61ad6", "comment": "Malware payload (RisePro)", "value": "ea9ab59c302185f3444bffcdd9e4c75871d52c39bacf9d6cbdd90fe0e0f465d487aeb9d9a890dc254a91558843c8bea6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RisePro", "colour": "#92F3D0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705494310, "uuid": "b67fc2e2-c468-4993-af50-f23748b8f344", "value": "T116653308E17B8D75C2520AB739A21E95D679E3203D9F7EF520CD5D07CC2C29D33A2A92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705494310, "uuid": "2045d2e5-4812-49eb-8804-dc2a5b542196", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705494310, "uuid": "45a20082-4d0c-46c3-8aa6-bceab49420c3", "value": "24576:h97/KpA64hrXc6yVFcBrldesMv6moDhmK1ge31al14IH8LLvKDe3XL:ea/y3cBrlIsNgQ1i4IHU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705494310, "uuid": "86d9ebd8-dac5-4b48-a44a-6fbb2b3cf85d", "value": 1529344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705494310, "uuid": "38ecc165-8655-4eb9-a13a-0dabe5e7f7c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705494310, "uuid": "7dab21fd-5211-4cc7-82e1-9ae79a591ca6", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3041972-b54c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705505259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705505259, "uuid": "aaf3a8c6-a21c-4cf3-9d05-59ed18287af8", "comment": "Malware payload (Formbook)", "value": "bee7ee5d75f9162ec7f5ce9d882fcec7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705505259, "uuid": "0bddd300-1651-4406-a7e1-f1f68d32e49a", "comment": "Malware payload (Formbook)", "value": "093c9880327e9d62375ecf97f0ad48ef14739ffb62bba7a26ec2cdfa5f18b814", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705505259, "uuid": "eb891f1d-f6f9-40b2-b0b2-0a941a2187d9", "comment": "Malware payload (Formbook)", "value": "ab241bb1cd971c6eae948f3b38b51f85432cb7a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705505259, "uuid": "88774e10-90ef-41d8-ad63-86ec90973017", "comment": "Malware payload (Formbook)", "value": "0af22287b8add871b6ac8399dd61e7ba922c62624352209fd219e7dea909e1df9d860acd02f6097ae4edb9103a13f576", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705505259, "uuid": "c346af4b-4913-4ecc-aed0-5aac6ada82c9", "value": "T1DFF412236543DCBDE1BF02F4146C35B18A02BD34D8276D6E66D7FA8687BC2A4E527381", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705505259, "uuid": "efc4ead9-4811-4d45-bd25-7cc565bf12c3", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705505259, "uuid": "e6924398-db36-4e8c-b982-cd0774824ad9", "value": "12288:bsHzOUNUSB/o5LsI1uwajJ5yvv1l2B/PNcSrxXntXvkP9uxGwtRJWk4Lb2TvjvUf:KiUmSB/o5d1ubcvmHN9BtXvk9GvtrWdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705505259, "uuid": "9b5238ec-6f78-4a92-a0c8-a1f097eda0c5", "value": 781824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705505259, "uuid": "4a49f394-edb6-4db4-94eb-e4c4a7d6e2b2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705505259, "uuid": "635ffb66-8949-4b1c-af3f-67ad6275988c", "value": "SecuriteInfo.com.Variant.Strictor.286733.21656.5618", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e42288-b50c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705477719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477719, "uuid": "41396bba-8df4-4239-8fe3-6d4eb3ae7195", "comment": "Malware payload (LummaStealer)", "value": "8418d4af92a157c0cd6f194817aa4339", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477719, "uuid": "e3751cdf-0bfa-4876-b068-c79aeba01716", "comment": "Malware payload (LummaStealer)", "value": "09ff2c6ca76721c349a8e8e055ff3036930a7173b35c594f043c89cc4f1f2c00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477719, "uuid": "7134205b-f077-4346-b12c-349b161a0535", "comment": "Malware payload (LummaStealer)", "value": "4eb558eb51d797e000a1ffa79995d2f7fc07c716", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477719, "uuid": "9f12e1d4-67bc-41ff-bea2-b44defb56fc9", "comment": "Malware payload (LummaStealer)", "value": "2065d104a2b9b3a285020823f8267a38f8e9d10449b32b3198e9277ed3f26a7cff7e37714a8e457ab1d1c412074f32f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477719, "uuid": "73bf7fa1-15a4-4e64-991e-f583d2e543db", "value": "T17F5623B323651186E5D28D32C637BDF5B1B907B98A82ECFC99965DC12A320E4F613D13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477719, "uuid": "c8a4f091-c9c4-485d-8ff4-7aa779e86c08", "value": "bd46ef3ed97ea313bc4fa50df7a2e275", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477719, "uuid": "f9ddd1b8-f635-468f-96a1-1e909a1d188f", "value": "98304:qyW30IMRdRiO2LbgHGsZGq74KDUcaWM0XKitNRmNFL2pZzNv1:nC0P5iZLbgHNZW+7n66nmvUZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705477719, "uuid": "e81fd1aa-3949-4c21-892d-e1fafa69115e", "value": 5957632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705477719, "uuid": "0dea812e-5888-4af1-a051-116b6dd1dc90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477719, "uuid": "3f51b72e-db09-4772-a57c-9b38eee7677e", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321cfc04-b50b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705477018, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477018, "uuid": "a972c678-c6fd-43bf-82ae-825c554fd4de", "comment": "Malware payload (Formbook)", "value": "d9f22551095d32fde63ec0f8a6008030", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477018, "uuid": "59ea7872-9fdb-421a-81b6-1e9da6d9ccbd", "comment": "Malware payload (Formbook)", "value": "0a1fe75257c5ca52cdd288a391c06ae1d3eec350111f17d3c86dcf4462422856", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477018, "uuid": "156a50f4-4aed-402c-ab6a-f81ad2f2dc71", "comment": "Malware payload (Formbook)", "value": "e8bf19f7b9b5b4233d0b631cb280e343f2f083bb", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477018, "uuid": "7eda70f3-782f-42c1-b50d-bf87e455f4bf", "comment": "Malware payload (Formbook)", "value": "dd04520467c7de7aba829aef336df45a85f5dd4a00fdb6b473af1151e52ba7832df9f3cbc603069eacb0fadc3094f221", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477018, "uuid": "e40cfd97-2587-418a-a3ae-941d3502a06b", "value": "T183742397664251288A185FE983F5F9B9BAECACE0F3ED2FC88901C1D54C12A941E74D4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477018, "uuid": "ef1b9b60-32f6-4001-b1e5-fb09e58eee1d", "value": "6144:7oUDQDs+4nSTu2wRoSeCTZDIr6BUsKxPkaB27yXJ21TPcnbn1A/prJgYVpB9Mw:kUA1fwWSl9Ir6YxsPY22bn1KpruapB9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705477018, "uuid": "d1144ea3-8b09-4ed5-9667-f91b465cb4d8", "value": 362901, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705477018, "uuid": "82f9bef5-6715-470f-a50c-94cf9e0e5ddf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477018, "uuid": "13c71f15-0adc-4b3d-a7d9-13998f4f248e", "value": "MKP-ASL-IN-990817.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "651daba7-b500-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705472379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705472379, "uuid": "36193311-eb70-4824-b034-c2146ee3de33", "comment": "Malware payload (RiseProStealer)", "value": "b63dc08fde7824d392db72b3685afda2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705472379, "uuid": "8066fb04-1540-4038-873f-ad8479200da5", "comment": "Malware payload (RiseProStealer)", "value": "0eb75566530da775a9497d056346a35a0d9dc7a8c5376e0040d8ed390dc33ca4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705472379, "uuid": "a64fd020-f8a9-44da-9d28-49114ffee1ed", "comment": "Malware payload (RiseProStealer)", "value": "4e0859d547e871f42163cb55e01bcf4a6562b596", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705472379, "uuid": "1a0c7c6a-e669-46e8-b95d-a6ea605d2c3e", "comment": "Malware payload (RiseProStealer)", "value": "4f11a7b9efcddacf1cddf6a10e7671e9dc978f5cbf8cf40ad6b7d63d535b4a2e491229a6901c7c52d04c7887332903bb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705472379, "uuid": "c7504bfa-ab30-400c-ac2d-abd488694be9", "value": "T1FA9523F6BBF4145DC4D003F01BB5A22042D2ADE1CF069FF1D9EB691637270CA6AA615B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705472379, "uuid": "df4c800d-cd14-468f-b844-0869f89ff61a", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705472379, "uuid": "ea049a7f-10ee-4caf-8ab6-69325c848c06", "value": "24576:KMyyCGe6ulMmcqBsUVX6hZuiWq8AWFHRfKO4h1SOz/Uo2vpiMTFhMIL/bRzGn+Os:KMy5GecqBdQYFAWFUOqHUMYTOC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705472379, "uuid": "bff82e48-24a3-406d-8031-786b007b08b4", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705472379, "uuid": "37847a88-6215-4ae6-827e-5be901501807", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705472379, "uuid": "c6e83f17-342c-4cfc-b778-093aec32feb5", "value": "SecuriteInfo.com.Win32.TrojanX-gen.21994.12744", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6026ad5-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1705502123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502123, "uuid": "b76c752f-0f38-45fa-b2bb-814ae691f775", "comment": "Malware payload (AveMariaRAT)", "value": "215834852a24fdc3fb3004d8809cd805", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502123, "uuid": "fdb557a9-7802-4605-9d7f-230f5072012a", "comment": "Malware payload (AveMariaRAT)", "value": "1228d2a5da0c294501e973a3de592eedca074276969cc53327edd667f08af002", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502123, "uuid": "502f4c80-e689-4dcf-991b-0ecff5cb96de", "comment": "Malware payload (AveMariaRAT)", "value": "02780d6f70a25456a6a9f9a9e08167bc3be29cf9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502123, "uuid": "5441f4ef-f106-4879-843b-979f2a662f68", "comment": "Malware payload (AveMariaRAT)", "value": "866f5dc9b7cd57c317b3b9a6611f37b4d5d9864f474a98386c69e527c87af4a342f8767bf90d2fc584bba541674fafe9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502123, "uuid": "3d865719-b2a4-40ea-b1b2-38a0ad737cb3", "value": "T1DDE4AE0A76B0A132ED10CB3516F2AF55D7D3DE6DABE1821A24D8B5AD1B316BD9F031C0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502123, "uuid": "d86483f3-aeb7-4922-a96b-759b6de84c58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502123, "uuid": "d8f9360a-17cc-4eec-bd6f-bc14f5f1e90b", "value": "12288:5+CxtTAOGGwFfM8nYw8tQbE3AkwoxZqqt:57xGGk38abH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502123, "uuid": "b85deff6-2ed4-49c0-b6d3-7f29d2fd5b08", "value": 667136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502123, "uuid": "11224943-a631-455a-af2c-411eb5f8a5f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502123, "uuid": "fcbb90e1-b736-4c53-b75c-983fc13f64f5", "value": "Sspwsvctq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60f56f08-b554-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705508450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508450, "uuid": "aff9de2c-c7b2-4434-b402-1e6171db111d", "comment": "Malware payload (AgentTesla)", "value": "94c8d0c534400d61ed72e05b0d774d66", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508450, "uuid": "d8f795a9-8d31-4047-aa06-fef8dd8c6c6c", "comment": "Malware payload (AgentTesla)", "value": "135a046874c7621664f5259d83120e71c426fb40d54104a27a6fd25cb5d2f9c9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508450, "uuid": "12c4e23c-330f-4c43-bfb2-f00eaf06a7c1", "comment": "Malware payload (AgentTesla)", "value": "d3b0f0c44f92f02ab4aa1f46ed6482d91a7c606b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508450, "uuid": "3ecbc2b5-020c-4fc1-bc5b-8fad341edd7a", "comment": "Malware payload (AgentTesla)", "value": "6f728461210a49c245d01ea7af899739d12a43b3eb028714d56096b2c4aeeaedba6e1f5685832fe04af186780486fb67", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508450, "uuid": "5961ff4b-045e-40ca-a129-2ef361f4cdf0", "value": "T1E9E423872B58CF23FDFE873C8277560207F1456217A5F785449AB6AE26323A509CA3D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508450, "uuid": "ff3eeec2-3a4d-4924-b9cf-acdfad12e09d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508450, "uuid": "e77256c5-677f-4fc0-8072-e63b701bc7a5", "value": "12288:7SPBbePFLVoq3F+TmemEBVtoS27XTy6OrGOrrfZ+AJn5uYOvWzcQWVHfK1W:u9ePRVoMF+TmdKtO7XJOvfn6vWznWVHp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508450, "uuid": "3b0ec7a1-17b6-4d2c-9dbd-bb3623a74988", "value": 694272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508450, "uuid": "03215314-e820-476b-afb1-3357f9e12a3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508450, "uuid": "f256d611-1ab8-40c0-8d23-cb4f15011673", "value": "SecuriteInfo.com.TrojanLoader.MSIL.DaVinci.Heur.26435.17300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "829e1e45-b4ef-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705465127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705465127, "uuid": "35a64604-491c-45ba-a853-b697db37cdc4", "comment": "Malware payload (RiseProStealer)", "value": "14fd2ec9da6c9975a2f146aa74f13616", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705465127, "uuid": "515fe7be-1e8c-4c19-9188-a577d5f74b91", "comment": "Malware payload (RiseProStealer)", "value": "137a14bc6d65e2e9523b55d601ccd4bf0a12b83de4c7207d55461e1fafefee64", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705465127, "uuid": "9606caa3-3e98-46de-8cf7-984ac8d1f254", "comment": "Malware payload (RiseProStealer)", "value": "8d24a71f816cedb7eef4877300033ff7a1dc3dd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705465127, "uuid": "32a06c37-5485-4e2f-975c-b70b2b4b9431", "comment": "Malware payload (RiseProStealer)", "value": "7cef9b3143615f79b57e90ee78114bac78ea6dd397d80e2364013f004b3f086be3fdabc4a926e08500f85883be37edeb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705465127, "uuid": "d4904005-2b49-4dbd-ab26-d6619a424955", "value": "T1089523FA3BF8091DD8C067F55BB1E762A2E0ACC6CF549EC6D5A31882774B4C09E52163", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705465127, "uuid": "7ec364b3-1aba-4dfd-bd75-7b54ceb83424", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705465127, "uuid": "a09c7782-d0cf-4042-9248-a68eecf2c43c", "value": "49152:BY+LlPbcBVml+RMOqHsoIpbY1enAGaZvzdbd:LLlIk+CdsoIpbY1eANz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705465127, "uuid": "6e2f6985-7207-439b-b505-911b0cc3b242", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705465127, "uuid": "851d4545-df4e-48bb-ab3b-bfb5bd060853", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705465127, "uuid": "9f59050d-b730-42c4-942b-1d1a3e9dfc1b", "value": "SecuriteInfo.com.Win32.TrojanX-gen.10393.17755", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b244de8-b572-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705521379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521379, "uuid": "6460664f-713d-4bd7-b06d-4228bb8688a5", "comment": "Malware payload", "value": "b94ecb35311b25f91787999263ab52ef", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521379, "uuid": "1cfe7cf3-afdf-4619-afeb-c7450111d033", "comment": "Malware payload", "value": "14611d9ba7f93fc4585668d432b17b58d8576db8939d635751276034e6057705", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521379, "uuid": "ce3bef11-5454-4cdb-a82c-6c96f5509957", "comment": "Malware payload", "value": "4b103241ef4df4f4883c5637ce12a1542b357a88", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521379, "uuid": "ce6b8d1e-798b-49d8-b79c-1315074eb2d8", "comment": "Malware payload", "value": "6ae10ac2e03f718db5fb240405147f9bc3406bc1efa5a5375dbbc0aff57bdbc576ab10f4d5e9b1f2086b5f8a303e6a56", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705521379, "uuid": "1a9bd2c7-ba74-4ee1-affd-ef11c38624ee", "value": "T1EC353A11A3E54436E1721F7B4D6AD6C46C2ABD301EB4D84E3EEC9B4C0E79B41AC357A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705521379, "uuid": "b9c2fc15-7e18-450b-9b19-bdc7f1441d11", "value": "cd25ffd704cccc621f2f75199393d659", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705521379, "uuid": "f982ae5d-31ad-4a6a-986a-94d437edc995", "value": "24576:HOa9I5oYUuI85DN4t78Zro8h+h3O3IMy7EC8p:4vU80NO4My7up", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705521379, "uuid": "1ca5c149-d16e-4799-9a1e-eb3c1546a3dc", "value": 1109760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705521379, "uuid": "99d1f93d-66b1-47c4-9d81-6f21c95f8b9c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705521379, "uuid": "9d85f134-471a-4301-b96c-6c6d79d09d5c", "value": "ProductStatistics3.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b41bd99b-b508-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705475948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705475948, "uuid": "1b8fe133-eb4b-43ff-8add-aa53a63b8b90", "comment": "Malware payload (AgentTesla)", "value": "ad7fa4ea1cef139146e276cd559e2332", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705475948, "uuid": "d5cc0ff0-c52d-4fe1-a43b-b1be8fea9416", "comment": "Malware payload (AgentTesla)", "value": "17c6ca8dd665049e6bca2a1813289ab85037f67c6ea8aad739731c818354e67a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705475948, "uuid": "af311d43-eb36-4120-90bd-e795c22f3147", "comment": "Malware payload (AgentTesla)", "value": "26f3bdacb5eece4b2220a695ad2e8f320571cb8b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705475948, "uuid": "2bcb78bf-7975-44d2-8ad7-cc827fc78657", "comment": "Malware payload (AgentTesla)", "value": "afb8d0af2676c3bea0bda9841bcebe37e62533e6e280479b9a359ee3b6877065ede212f31971b093cfb2159f83a26cd8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705475948, "uuid": "608058e6-41ff-4e0a-8a97-43c642ff0a04", "value": "T10D248C83288642B4F45B0E3891722C446277AF9ABC7BF549BD17B1638B733D775A2807", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705475948, "uuid": "294d3c18-53c3-4ee6-8c8e-967e542d0e3e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705475948, "uuid": "7f0c64a2-3c63-4eba-ad76-c14af6ac4364", "value": "3072:s9rZ4epJFbu/k8w70df7eNg8gTZJk0M7m4u2XTho8HwUYiVqXeXv59HN:s0epjJ700gtTbS7i2XThZwfQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705475948, "uuid": "18112d0b-6d74-4526-88cc-4505b8199e96", "value": 218112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705475948, "uuid": "0291dfd2-d32a-48af-90cd-ac806366c47e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705475948, "uuid": "aa991444-d8b5-4d28-9c0d-2fb198dc1aa3", "value": "Havale Referans\u0131 0230958PO541150_jpg .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e2f367a-b544-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705501573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501573, "uuid": "5a47aac4-3731-4b40-8633-288ac8a69fda", "comment": "Malware payload", "value": "35d1c207c7122f55b5ac9c15db40926c", "object_relation": "md5", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501573, "uuid": "aa81023c-3947-4a3c-91b4-cd513fe0d47e", "comment": "Malware payload", "value": "18003ac115113c3d16bfed89b8b4bfaeb36a78fc0d26e75d38e7a27668755fcc", "object_relation": "sha256", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501573, "uuid": "785117ee-4247-4a1d-89dc-8df155f6ce59", "comment": "Malware payload", "value": "48b629b98dc9484f307394d6d49be45199dfe0b9", "object_relation": "sha1", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501573, "uuid": "637cb716-668e-47dd-9ae5-10d4bc5bcbcf", "comment": "Malware payload", "value": "d2c0268e05758ecd31f39d579be38792058760b72b3e02e52395800f529692c65974dd27d429b6a04af73cf927caaaeb", "object_relation": "sha3-384", "Tag": [ { "name": "xla", "colour": "#172DED", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501573, "uuid": "0cb8c240-8e47-4ad6-9c6d-6f8d3ba67bce", "value": "T1F2842265354AC76BD697E4B20ED2C0CB2606FC21CB13953BB4DCB7AE0DB6FC08A62544", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501573, "uuid": "8bc879ea-80ef-497c-be2b-7fb80164cf67", "value": "6144:lEunjSHBMixiMK6G+ZFrTUvCp4sJgM11jrxxkm6jn6BOcJ5dlecEnG:lNjQpozwjTqCfgA5fkv6BOcJ5DJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501573, "uuid": "47faabaa-930e-4de8-96a3-b58c99973ef3", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501573, "uuid": "a6d5e644-df94-42f2-a1af-9526253012de", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501573, "uuid": "e71e4203-0332-4975-a4d3-18ddc7919e90", "value": "Enquiry No. 2427005.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9c73b02-b580-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1705527604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527604, "uuid": "883b3510-2e8d-4da5-8b49-107c4dd27bde", "comment": "Malware payload (SnakeKeylogger)", "value": "c65e4e6d369c8f998a827b4a916bb3b0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527604, "uuid": "81fd53a1-b558-43b0-b073-fb8f46aab155", "comment": "Malware payload (SnakeKeylogger)", "value": "1860fb1b0d09c48a73d706886b6454756c7532f2b9cdd61564a3f79a796784e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527604, "uuid": "b9a03f96-35b9-418c-bf7f-b0cd5351b7bd", "comment": "Malware payload (SnakeKeylogger)", "value": "fbc169f1791b48ed6a00ea8b91b2e2b32c91b0dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527604, "uuid": "5cabcf6e-9cd7-4f1d-9318-676a0a53793c", "comment": "Malware payload (SnakeKeylogger)", "value": "3f731ebd4e6a2e2e8d55cb5a40f063b8e56a2e2a3d720e03228a3dde625ff4d71bccbf205c275072eaa1fd9a5f8e1162", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527604, "uuid": "6f2e6be1-44b0-4116-8a78-38f4fc73b9d5", "value": "T1BBA4E181B7E1CA2DDCE24B71F8FD84014B35DAC99441A70FBABD15297D63B094AB3722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527604, "uuid": "798b64cc-df6e-4499-b2da-9d9b05c2ce89", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527604, "uuid": "c3b60727-cafd-4494-9403-b686a68870c8", "value": "6144:48B5BAglMXudWJNwmae2374I1AqS0rFjsEBL8QEDuz0W/IWsL6/my/XsGVvYDf:J53M+dQS4IqNEyQCuz0cxsLktOf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705527604, "uuid": "0f74c1d8-27b3-4e14-b49a-5e883cebe497", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705527604, "uuid": "4396bba8-5ae5-450a-8422-9aa05ef577f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527604, "uuid": "d63d59a3-2d40-4563-8ff0-c046ae64bbdf", "value": "Order Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecf8daa8-b511-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705479908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479908, "uuid": "b4a4155f-7c6b-47b8-8709-395b1bf350b1", "comment": "Malware payload (RiseProStealer)", "value": "55277ecc6bf439654d4d12b04228eefb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479908, "uuid": "a868d1b7-58a6-427d-981c-8c09a9f1eb7a", "comment": "Malware payload (RiseProStealer)", "value": "1a27803a7dfb0b1ea8fbdff6000c757ad3758470d68bf645efb8ece711e7d305", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479908, "uuid": "001f7fe4-0200-489c-bfe8-e829245324af", "comment": "Malware payload (RiseProStealer)", "value": "93fa01434ad46a0497390814757619e829bcdfad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479908, "uuid": "d2105563-d1a0-48df-8540-9d577427a76f", "comment": "Malware payload (RiseProStealer)", "value": "1bdca5160fabe45a9e5f510297d84808c6cfc84e5b7016a66acc223beadef508210aaa52d9aa7f1498c68e91ca2e4e44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479908, "uuid": "c72101ec-07d3-4e94-b5e6-89594b3c224a", "value": "T1F59523F573F4094DD5C413F113B5C2A212E1EEE1DF828FE2D4A729AA37279D4852A227", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479908, "uuid": "3d5deb60-9ae0-4a6f-bec4-3a4be271f916", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479908, "uuid": "4f4c9307-c787-43b4-b76a-9db2e638d49e", "value": "49152:v33OAPiYxOdyKOI7VIEYeWHoNYWUc7C0:feAaYxOo5ScnWUEC0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705479908, "uuid": "d0ac807c-14fa-459b-8c62-8f1cb7a09365", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705479908, "uuid": "f3a54571-3abf-4c82-82cb-c0d4b32d37f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479908, "uuid": "19fbe477-297b-4bf7-8ce1-a61b20489707", "value": "SecuriteInfo.com.Win32.TrojanX-gen.10294.290", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1face46-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705502143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502143, "uuid": "977b8f26-b44a-4244-9991-b77dd9fcbf0f", "comment": "Malware payload (Formbook)", "value": "1497c1abb540ab98d4291d4826de55a2", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502143, "uuid": "ecc39e1a-6aae-422d-8d69-0831d71a520d", "comment": "Malware payload (Formbook)", "value": "1b951208b98426956f29e7776b12ad30d57951adc228a248f784461e18168aaa", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502143, "uuid": "b5a36c98-8e50-4198-8bf9-76eb3deebb72", "comment": "Malware payload (Formbook)", "value": "09b068701d077a1d17145ae2532be14839571add", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502143, "uuid": "0b29375e-8ea9-4a51-80e8-3716bff64e11", "comment": "Malware payload (Formbook)", "value": "51ba18d5cbcaedb57cde27e946ed783efe4fa93cd9b5242c6c3809f49cca5e0cf8cb70acc6782f91ac289ceb682c4d2e", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502143, "uuid": "7339be82-d56d-455f-b26c-5e3f68f40df8", "value": "T15ED4235022545777481D3AF0A2C14BEAAB3AB525E09CD612FFCCEE237860FE5E890D75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502143, "uuid": "656b750f-a76d-4e4c-b622-273bcb335d00", "value": "12288:RDISBGc0IB+8ax/veSLjYX3x0OmvO07ieOo7Zj3xEQyTK7x/+5HgPv9npAaojnAd:BIknFax/veS3YX3xhsino7t3///+E9nd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502143, "uuid": "0802b7e2-dd52-4bf0-985c-6e1b481b90c4", "value": 653096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502143, "uuid": "5c1e96b1-473e-42ec-8ac3-9af294071aa3", "value": "application/x-7z-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502143, "uuid": "64653a58-7232-4dc2-8565-e6c5ef180b55", "value": "1497c1abb540ab98d4291d4826de55a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "039e57c0-b51b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1705483812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483812, "uuid": "707fc409-a1b9-4f4f-b4ed-3f0c802b92dd", "comment": "Malware payload (AsyncRAT)", "value": "e10d493ef83269834b9a7869523b0042", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483812, "uuid": "dce7cc2d-9132-4a7c-8059-d44504a45d29", "comment": "Malware payload (AsyncRAT)", "value": "1d13c5b2843bc8f170966d791efe9b3573750b987e81acdb856f89d82d55c848", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483812, "uuid": "6d8fa2ee-1841-4a18-bfa3-3cd1143e28dc", "comment": "Malware payload (AsyncRAT)", "value": "1d5dbd18ce7d9cb43b8b36c32f0777ad4d0a256c", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483812, "uuid": "6a4dd385-b56b-4a26-be07-ef41e76338d4", "comment": "Malware payload (AsyncRAT)", "value": "d1ddad0d81ff130ae35707db999acaddd2f61689f14dacf2a9f6d456da821e6c648db4784cbc8cb26c3308573286d152", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483812, "uuid": "3cc02a13-afa3-419f-a082-06e49940576e", "value": "T1D8A423009BB0C77BF977577B8523A6731B7705869C11C64C4EFEE8880A16364AFA2B16", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483812, "uuid": "519df87e-9397-46fa-8dc8-20a6f4551953", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483812, "uuid": "8be97ceb-5964-4862-a87b-485401ec60cc", "value": "6144:Cl0ePp06tQOkWoT+3FfR8+oituRlcC0xbBkabnKQ8ZjV6U+cmewo5t0uU2fZP7bT:hePFLVoq3F23itGlYlj86Hc0oBRHLL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705483812, "uuid": "bcb2a8a2-3e8a-485d-8444-7fefc5e6dde9", "value": 461312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705483812, "uuid": "81928264-1021-4d47-8938-680e13e4f03b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483812, "uuid": "7e81321b-26e8-4b26-bc62-f8cd6ac797ed", "value": "AdobeAcorbatFrontTextureInstaller.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a1e6a4a-b509-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705476092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476092, "uuid": "e4397b3b-ec76-4e9d-8b36-77ec8174a4d4", "comment": "Malware payload (AgentTesla)", "value": "98436fc2e92c928d0e5d3cd7a62b6cad", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476092, "uuid": "fffff002-59cc-4f03-b8d1-bb08e9079e51", "comment": "Malware payload (AgentTesla)", "value": "1da06dbf7432150c205edce8a852c8e6e4a6bb1140220c45dc5c659fd4050f21", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476092, "uuid": "0c00956f-e4af-4437-8cef-1c65cee7fe2d", "comment": "Malware payload (AgentTesla)", "value": "370391c01f506d0aef4d767fe12711b7d958ee22", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476092, "uuid": "736360e3-5a45-42b9-a07a-3e098696aa84", "comment": "Malware payload (AgentTesla)", "value": "6431b49aa29e7d3ab6ceb33285095f1fde9a5f0dd0ef7837fe6151fe237b469d4e52850e38f493a1c16090b1e171e3a2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476092, "uuid": "df660f67-95af-442b-8abc-39035c8fad68", "value": "T1FF45B0027782A423FF7B51368BD7F2224A7F69160573961F43681C79BD709600B7EAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476092, "uuid": "60ba7544-019e-49d9-981d-6e16ba69ffb1", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476092, "uuid": "e4cb6b62-4472-4a62-b457-7c720f0371cf", "value": "24576:lqDEvCTbMWu7rQYlBQcBiT6rprG8ad7TelNLuBqX:lTvC/MTQYxsWR7adfebEq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705476092, "uuid": "5f5c9de1-b3c9-4641-a2a2-796666e6196c", "value": 1224192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705476092, "uuid": "77ee0025-ebbb-4e6f-883a-4a3129c5e4b7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476092, "uuid": "e246229d-122d-4eae-8ab9-d07305e04fc6", "value": "Quotation Request.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bf945d7-b524-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705487718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705487718, "uuid": "0a14ad41-54ea-445d-954a-4f45fd5e3189", "comment": "Malware payload (AgentTesla)", "value": "637e1ac866d727b5924f294441db651d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705487718, "uuid": "e79c8f18-6d19-4bae-a617-8b857e7fa6c9", "comment": "Malware payload (AgentTesla)", "value": "1e6790df2471be2bc8210901b6d54045082caf912f703e5f05676cf6ebd31fed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705487718, "uuid": "1555b680-10b6-4756-98c2-9e854a3cc28b", "comment": "Malware payload (AgentTesla)", "value": "852f41b9503c9b06687ebb3e52872940f473d07a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705487718, "uuid": "2ad70c5c-3075-4263-80cc-90064164bf60", "comment": "Malware payload (AgentTesla)", "value": "0cad67f0551b700ef91f395fcf6477ed8be532a8a539d0749625b0eeaac62e6c6baaef091d682315f306d2b3fd590ee2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705487718, "uuid": "4cb7945a-d72f-4fca-9313-57d126ea4fce", "value": "T1FD15AE92F2414159FE223B75803B8C3411AB6EE9A93AF30D5A8BB7755FB33C510A7907", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705487718, "uuid": "c9b03b8c-28c4-4b18-9a72-52bccfe8f852", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705487718, "uuid": "b2bb31ff-abb3-4174-aa8d-ac13392cbc76", "value": "24576:0o5BHnVhcjVFeiOlMHNfCzlePRVoMFBJ:0oDgxFhqWNCzoUMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705487718, "uuid": "5add1298-ec83-4bbe-8ed8-1fe02c99e52a", "value": 888320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705487718, "uuid": "d6defb5d-d266-4e89-bd19-b52a0d979eda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705487718, "uuid": "97ca20f1-8a5c-4dc5-b60e-939b03a7d9a0", "value": "Dokument do zlecenia 1095_pdf .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f467d9b-b50b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705477121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477121, "uuid": "83ff9c27-27cc-4e2f-99ba-503e5a792e7c", "comment": "Malware payload (AgentTesla)", "value": "1a8751c20a763aba2b5a046623a1f7d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477121, "uuid": "1eb47ddf-110e-4965-a15f-8f6e5479dda6", "comment": "Malware payload (AgentTesla)", "value": "1ea514d4afd80ba9d580c76fb0edf0f6b06bcddc465a8a9f6a7ae6a1daecb5d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477121, "uuid": "2338d94d-de12-45f9-a73e-50dd6fd9faef", "comment": "Malware payload (AgentTesla)", "value": "9099c89e0cbc3176c83df3fc5a7ca9335f175e71", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477121, "uuid": "87771274-ed7d-47de-873c-abc0faca99b3", "comment": "Malware payload (AgentTesla)", "value": "d003694a5e713b136f33ad93aa8d26a4b8198d0ff43af3a944f4b29ecd45cc544fc773d5bafc91f68730b7e2e09b6e3a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477121, "uuid": "98ccddba-7f83-4595-89b6-53b08b3f13ce", "value": "T19B765C30D75095E5E197C030CE9A4FF4A5E2747B82365E0F1684DC1A2DFAF609EAD2B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477121, "uuid": "7e56149c-5a0d-471a-804d-aa7e981ae8f4", "value": "0f328a2f5b77da8d7bd7252a390693e5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477121, "uuid": "596d9255-d7b6-44a4-b98d-a72bc1387d2c", "value": "98304:2FRAZVUiZ9g3dTk7PMIiszVNdACmpCw0:HZWtgPj9PdACmp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705477121, "uuid": "94c9e34b-086c-4f89-ac4b-46788fa2976c", "value": 7614976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705477121, "uuid": "e34d11e1-f46c-4136-9fcd-6725c66155ae", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477121, "uuid": "a9198acb-d04e-4858-b834-7f2b98cc2ccf", "value": "INTERSAGO_AWB_160-45245045.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9086543-b519-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705483230, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483230, "uuid": "09cea2b0-937e-4704-9a65-a160a0af2417", "comment": "Malware payload (AgentTesla)", "value": "ec9c41f618ae392cc21971b139a8768d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483230, "uuid": "e8d863c8-b366-41f2-b2b3-92a39948d26e", "comment": "Malware payload (AgentTesla)", "value": "20e907712da055637397acbc5f7a8781f72f7aef3a301b01dfce3b1a09364cf2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483230, "uuid": "1d54e6ee-5402-41d2-b4c6-e19a55b87263", "comment": "Malware payload (AgentTesla)", "value": "05a98698d20f06bd17807f3195853a786d8b86e6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483230, "uuid": "bb388c83-6a54-4979-9462-3ca54946dee0", "comment": "Malware payload (AgentTesla)", "value": "751095ab2ff0a77637702dc40b28f51b71a771cbfd1859ed2ac3f993af30c686fd37a970b6a1db37386c8cce3c7fb040", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483230, "uuid": "5b4e92a6-ca06-401d-bdb3-83fb2aad4785", "value": "T134E423E173E0C7F6F4BC4BFAA9F6765117BB5C559B31E68A49A0D3284D232064AC0F60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483230, "uuid": "d162939b-e709-44ed-a525-996b6e451f5f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483230, "uuid": "c139a792-4c53-4dac-9153-d3b2ec5d7c1a", "value": "12288:RQePFLVoq3FdUD1W41kv0/JXv9K7eplRASpTh7fL1mg3LZyLAQqLS5leQh5ep:RQePRVoMFaD1B1ocvQ7ebRNTF00FOEAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705483230, "uuid": "09485a3e-4cf3-4855-8526-05122d2d5446", "value": 659968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705483230, "uuid": "a119b9c2-9962-4dec-9d79-2938809b728a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483230, "uuid": "0e999f32-abe7-4833-a8c5-95e65f90d0e6", "value": "PO1-865.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66781dbe-b55a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705511036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705511036, "uuid": "1dbdcaa3-299f-4560-a00e-a4b47d58426e", "comment": "Malware payload (AgentTesla)", "value": "1209882759dd487edf57eb9d86dbed6d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705511036, "uuid": "f4d8d072-fc90-4374-9f96-a137d9c2e812", "comment": "Malware payload (AgentTesla)", "value": "254bd549b02e951d7dba3a2ce7e3e8ab6895891c6d10aada3a23277bba7fdffb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705511036, "uuid": "d25517fe-3aed-47a8-88a6-345d94c8db99", "comment": "Malware payload (AgentTesla)", "value": "7c5d0260cd05eac0c0a1fecf75f2ac96643ec2e0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705511036, "uuid": "e5a4fd30-d792-4667-8ee6-a1e86eb51691", "comment": "Malware payload (AgentTesla)", "value": "f8bef636a48877c62cc2ca246e78ece722da29ff9846ed371077796266489309f27c0a792bdd4ffc56701558e588e686", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705511036, "uuid": "82aad270-360e-4105-b183-42d75063cbae", "value": "T18F547B83288642B4F41B0E3491722C445277AF9ABC7BF549BD1FB1638B733D275A2A07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705511036, "uuid": "e92498d6-6fe0-4f34-a103-a99e38b6f48b", "value": "3072:q9rZ4epJFbu/k8w70df7eNg8gTZJk0M7m4u2XTho8HwUYiVqXeXv59HN:q0epjJ700gtTbS7i2XThZwfQq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705511036, "uuid": "6f5ff1d9-aa2e-4f90-9bf2-e2e252518fa8", "value": 280576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705511036, "uuid": "be33d08d-735c-4ffe-a842-9ff8df287d09", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705511036, "uuid": "2b17b577-e5da-4c94-9ec7-f86d53574271", "value": "CERERE DE COMAND\u0102-61732_pdf .img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "236d3d55-b56e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705519514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519514, "uuid": "06caa8a1-560e-4c26-a371-cd98d8eab791", "comment": "Malware payload", "value": "b301dceeb0bb8db08b7ea09ba5395e36", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519514, "uuid": "bcc76e22-48df-47ba-b7c3-7acd79df3584", "comment": "Malware payload", "value": "260194332e878ff12e7eeac66ccaf0fd3f20a77ea715c6f98ff733d62d0a55c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519514, "uuid": "2b32becf-46ea-491e-9b84-a598b5d5fe18", "comment": "Malware payload", "value": "6d7534fb13f0d05dcb69ef4b4f11fe39a7ff0d5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519514, "uuid": "a7ad2404-85e9-4264-aa00-42c45e588b34", "comment": "Malware payload", "value": "73dd91d8ab2f1469ac6d6a6e4d80cf8ea2e55e3500fa576bb10b4f1ab7b60494a3e6421d016d1a699e2f625d9d07bc12", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519514, "uuid": "e22fb06c-1952-4d9c-87d3-16a89a346959", "value": "T1E465AF0ABBA69226DAB36574CF7582656E6BBD400711C7C7E2E03A094F34DD17D322A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519514, "uuid": "8a10d46d-26f4-4084-bf13-d9a2ee733fba", "value": "14c198737dea646ad253084b784990ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519514, "uuid": "972f6ebf-5cbb-4e63-9b5c-b6dbc79d68e7", "value": "24576:cwGvIBKN5VI/EtUhUN51zj1SqdAGFQZIxgC45UJoenq:pKNU/EtUuN3zjYq+ZI+L5UJoeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705519514, "uuid": "38fe4059-526e-4b7e-bcf3-45c4a12496fc", "value": 1488104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705519514, "uuid": "134c4e93-fe42-412e-ae6f-77997dbd2a7b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519514, "uuid": "6d50ecf6-6f97-4ff5-a03d-6c1fe91fdcb0", "value": "SecuriteInfo.com.Trojan.Siggen21.32984.18284.25477", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfa8c3d3-b4f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705468666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468666, "uuid": "264f697d-35c1-40d3-97c5-20e9efcc34d9", "comment": "Malware payload (RiseProStealer)", "value": "b125c17faea4e05ffb6c5af434661e9e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468666, "uuid": "44d049ee-26c3-41b1-8950-adf4771453de", "comment": "Malware payload (RiseProStealer)", "value": "269387da92236548e8bf01942252fd4cea0b8f0cf98efafb48dfd40193c8a600", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468666, "uuid": "e4f6ff42-82a8-4a46-85ad-d34bd5512a5c", "comment": "Malware payload (RiseProStealer)", "value": "ca97cac8fb421f2cd00b7b96b77202fe3220512d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468666, "uuid": "f8273b78-547f-491b-a4c1-a2ca0f55cf2a", "comment": "Malware payload (RiseProStealer)", "value": "7f5df0c43862136ae189d9ccf73e52501ccaae95027d4b1cf4885bae66de48150f09892ef7738b819bbfe30fff94c0d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468666, "uuid": "cae9860e-5867-4bc2-8864-4fa9eb197b31", "value": "T1A99523F5B2F48E4CE6C4A7F44B34922702E5ACD9CF6A4DE9C1AB968B378B5C05935007", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468666, "uuid": "4f68224d-f463-41cc-b73b-8d4e20979cd8", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468666, "uuid": "be96585e-8837-4df4-992f-60f3f5ec5c60", "value": "49152:o0LppmnIyhb0frOFChP4Zy61jrzQDR34K:o09pmx3EhwZy6tyyK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705468666, "uuid": "69264516-27fa-4c11-9119-385489273016", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705468666, "uuid": "ccec9960-065c-4d4f-b46a-e6605bd94012", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468666, "uuid": "3d4b04f7-4e7c-4056-a1d1-9ec704b4882a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.21326.21575", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a865ae9-b551-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1705507151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705507151, "uuid": "7fa94563-eebf-4ca6-9038-0e3839e12403", "comment": "Malware payload (Amadey)", "value": "d159bc77d1f18a8505ad1fd9381779eb", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705507151, "uuid": "bb17c7a7-254b-4bfd-a4a4-aa7b8abc7c80", "comment": "Malware payload (Amadey)", "value": "26a0c92061f72e6d9c0f6cbc594cd23f8812b1c2327f14667d3f45b96c327aeb", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705507151, "uuid": "3c81adb7-0f01-4f25-92e5-3427a1639536", "comment": "Malware payload (Amadey)", "value": "2c83cabecfa10151d6c1915a16e17e41802b3857", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705507151, "uuid": "e38d0eac-8013-4ff8-8e90-93123c3a09cb", "comment": "Malware payload (Amadey)", "value": "7a97ff5d5c2fff32b97763d3e88d2354b6e51d2ebc15ac61315acc10295193eb888632414b758b2d271d36bf1d4820bc", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705507151, "uuid": "e7d0c99f-4435-46d2-aa66-c83488ebbc64", "value": "T139947C53B2A17D51EA318E329E2FC6F8771EB6518E49376E6128EF1B04710B2D273B11", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705507151, "uuid": "3cbda5f1-66fe-4b04-babc-7336d854a766", "value": "477c561da1a6142caf88bf151467e274", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705507151, "uuid": "32080148-88df-4c88-ab53-c92b4b91a30d", "value": "6144:Wp2eLJOGIdAyM3t7sq6tWO1RO67PZLt5pJ/EmhLBoRAEmKSMFIdTBP:WT1O1tM6qyWIRO67ljpR192IpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705507151, "uuid": "46f9407e-4590-47a0-ba15-1614e1e2960d", "value": 438784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705507151, "uuid": "e77110d3-1119-4e10-9877-88b5c28278c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705507151, "uuid": "78aa4d0c-5a20-4b30-860b-ef28dfd9662a", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6960e130-b555-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705508893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508893, "uuid": "d2d99daa-696c-43d5-b00f-84bb30376cc2", "comment": "Malware payload (RiseProStealer)", "value": "84021558f204b76953c19d9459985c65", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508893, "uuid": "896106fd-4f88-473a-8a54-86ff725afbaa", "comment": "Malware payload (RiseProStealer)", "value": "27af974278d6e42c7a661348ad606836a6056f3f1b6fa837df031410380ff4df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508893, "uuid": "57d1d6df-a517-4658-bcfa-8d61c2860067", "comment": "Malware payload (RiseProStealer)", "value": "ae24bc2c6a160851dda701f0ff61f6506bb89c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508893, "uuid": "981d3f2c-4b20-4cda-b2e7-db6c423ffe40", "comment": "Malware payload (RiseProStealer)", "value": "9cf14fccc4a6bc25b66f4a60e1d28532f3a9a392310b3784fe4789140e4130f312f463628b6eaee4f81f688e0ee2e61c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508893, "uuid": "82684453-c49a-481d-b1b8-da28d7dea4d5", "value": "T1ED856C31A741B462F86314B5725E57E611A235302B92C8D7F7C16FAEB2A2BD39334E13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508893, "uuid": "978641f7-de3e-449d-ab2a-53df55266128", "value": "a391c991ba6330d6ddb5beaa15ef064c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508893, "uuid": "169ac83e-e9f1-46d9-a916-594185f01289", "value": "49152:80ceOGgUYYEmluRKYoFh4kGWusbQnIyDi1E1uFnTKi/OjCCNG:1XOGgUYC4RKXFhrusbaDkE1u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508893, "uuid": "8340e40f-0fec-4bb4-b09f-0d8be433b339", "value": 1714830, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508893, "uuid": "9d61ab5e-7aa4-4f6f-aa79-02568002c5dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508893, "uuid": "875282fa-f33b-4ba7-8591-3d4428c5580f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a09465b6-b544-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1705501685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501685, "uuid": "054dece6-f98e-45ff-be38-ba4b17d361b7", "comment": "Malware payload (SnakeKeylogger)", "value": "466461a5fe597e86a5d73349b4fe2c33", "object_relation": "md5", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501685, "uuid": "ffcc7deb-0d8c-4e53-afd3-9d151dba35e4", "comment": "Malware payload (SnakeKeylogger)", "value": "289bddc892160e8976bc0b7e91c76611cfcc9deb51ef25f5a4af387018820d30", "object_relation": "sha256", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501685, "uuid": "a4f7c577-1b42-43b5-ae8e-670ef219479e", "comment": "Malware payload (SnakeKeylogger)", "value": "235ce3dd7563c831e92cbdcbf02f4b59a5e82f02", "object_relation": "sha1", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501685, "uuid": "f731858a-88e4-4727-bfd2-63cf9be7a331", "comment": "Malware payload (SnakeKeylogger)", "value": "10190c6e07c203ea26a1089e5230c4efb2e6eb6105af5b950b86de82e539e226f1a35b85a68dece710c8b011d54e14f8", "object_relation": "sha3-384", "Tag": [ { "name": "cmd", "colour": "#15A458", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501685, "uuid": "4be227c1-522b-402b-836b-8926aadaee8f", "value": "T1CEA4E151B3D6CE6CE8D64735F4FD90015B36ED889052A70B7BFC152C7E92B0A8A73622", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501685, "uuid": "e22e6b7b-bf4e-4fa3-bf42-187b587db246", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501685, "uuid": "72e18e63-ac6c-40ba-968c-ff5237277122", "value": "12288:yC49w9aUuO56buMhH72uWMF8iugJy1Tf:y192//yuu72ub8iLG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501685, "uuid": "d0eb7b96-5baf-4a0b-a1e6-4a88d7d6cb44", "value": 466944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501685, "uuid": "e0fcb1fe-0dd9-4b81-a440-a330e2e7038c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501685, "uuid": "97e55df8-0af9-4ff1-bfac-fee09f8c71d6", "value": "z71FACTURA997656700000.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e6a2a36-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705502003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502003, "uuid": "cb48e3ca-bd6a-4c79-af2d-7bf0918b6208", "comment": "Malware payload (AgentTesla)", "value": "ab9456334b97a41cc5e815a3614a5527", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502003, "uuid": "edea3474-07d3-4f84-890e-45807311c910", "comment": "Malware payload (AgentTesla)", "value": "2953ea362bbd1f3f0942fa1c3db53d2943e940cd665b1b64387bb70dc7ef75b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502003, "uuid": "d1c32657-4aba-4fa8-b647-10f7b3ba979a", "comment": "Malware payload (AgentTesla)", "value": "0f0967aafc288dd08fc830d895975f36d1e2daf0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502003, "uuid": "5703fecd-70d8-4701-a767-07147bef235c", "comment": "Malware payload (AgentTesla)", "value": "bbd1870100271462edeb0cfa8478c9a40a1507a5e045d5d6173a1fad725ceed5d9a316e1029ee7f0bd8e66d6ba1ed94e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502003, "uuid": "da48a9ad-139d-4beb-8052-e3701fcf5a63", "value": "T19F24DBF76BD8C8DEDB585234F3424E1703507DEC69D6A6391BDE7B29C630A6A60F8024", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502003, "uuid": "be27378b-7e08-4c53-a549-b5d670020b48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502003, "uuid": "44206524-078f-4084-b6a2-2b0f9df19426", "value": "1536:4OzjFRO8FAe5KI1FaV0bTGAVH72yGSt3oz3hGH:4O/FTXXmKRVbFtoAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502003, "uuid": "af35fea8-b4a4-4b88-a2cd-4ea3358cf19f", "value": 220536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502003, "uuid": "4ca31e16-f641-4456-ae51-ed642195fcb1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502003, "uuid": "770d72a8-1f52-477d-989c-9636550ec608", "value": "SecuriteInfo.com.Program.Unwanted.4610.6735.4292", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f23e050-b528-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705489442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705489442, "uuid": "0c8d8018-53ab-4fcc-b8b2-5d61ad653ea1", "comment": "Malware payload (RedLineStealer)", "value": "3c478475fc29d9e90a9810b870a25b56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705489442, "uuid": "17d15d54-1cb8-4ac9-9d6b-9063cba0785c", "comment": "Malware payload (RedLineStealer)", "value": "29b72ae724bf76285d1d1501c0e386d7638ca19e34047e0fe604db4214652d4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705489442, "uuid": "8c52e7fa-1307-4efa-bb46-03a2619816f7", "comment": "Malware payload (RedLineStealer)", "value": "7553b3030a031d3e041aba552946e47e7c35f03a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705489442, "uuid": "ee97d2a2-0a5f-406b-b2ca-dbf37c62d9d2", "comment": "Malware payload (RedLineStealer)", "value": "c7f7f5011510f260e6b3e19924b49c5c3784f42341d318aca2202e3e59ed75081fa727516fd707df6ee95c176048876d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705489442, "uuid": "925fd401-b223-49a3-9584-f5f2457d7c5a", "value": "T191642311D32B557AC13D0879041397C356F4A305A2BB9AEE30D6982CCECAB4E5B7F81B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705489442, "uuid": "02706b61-40f2-4f87-af38-01d89a840855", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705489442, "uuid": "9860c065-d2ce-46a1-8f52-569189457d93", "value": "6144:ZFkpBKWpUXs2rtrAw8fJLZK8r0Hyn+bssfIgHF0/YwcH6WwnE+:ZipHZwrAw8fJdKi6b9ffHF0QwcsJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705489442, "uuid": "b6e6007c-448b-4db0-8c9f-860229b1d9df", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705489442, "uuid": "81d012ce-7f74-4a0c-a9a0-471f2074b084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705489442, "uuid": "db0be51b-2d4a-4fb5-a15a-109118db7bfb", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39cce1f3-b51d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705484762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484762, "uuid": "3b0e529a-dfa7-4915-99ba-549f0300b417", "comment": "Malware payload (AgentTesla)", "value": "9a5f1194e6ae499b384170fc85b67564", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484762, "uuid": "a573e3bb-68ff-450f-946f-a653cc05ac45", "comment": "Malware payload (AgentTesla)", "value": "2b008f0e51226d172f118e21db1905fe1039eaa791ebfc0af3066a559a660ff3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484762, "uuid": "870b98b0-5f01-4ad0-9acd-d08b680dbcfc", "comment": "Malware payload (AgentTesla)", "value": "0cd70876645b8fc5a9f60b173c8481398a087087", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484762, "uuid": "2e789968-7183-432e-9b1e-ed1e8c250ab0", "comment": "Malware payload (AgentTesla)", "value": "6e22dca9c075c966708c242d4a8ce23ee5e80a19f2dd019b635b9670143b05dd159d9a147aa537da3f46ccc3ee2583ce", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484762, "uuid": "66f79bdb-3895-4c43-86d7-caf2182f0b72", "value": "T1C7E423762BE89DAAC63807F269856A4D5737D161013AFFED5F9884C8CFE36130C59B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484762, "uuid": "7b733dcb-f04c-4306-921f-59f5927ad783", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484762, "uuid": "0a8e4ca3-fd5a-4eac-8414-0f30c537efe8", "value": "12288:kRZcd51I1+nPuDtN0qOG55d20pnkxaCMNRgynOrf+Toipdr7wXR3gl6j5VdFqvCK:4cdYcqNrJXjOKHwVglCfdFiEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705484762, "uuid": "c3246eec-58cc-4d08-b050-bb083af167cb", "value": 683008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705484762, "uuid": "b3000ca4-fc69-4b87-b46c-a1b0827b7078", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484762, "uuid": "cc9e40f0-794f-4609-8e14-0b4bea68f340", "value": "CN-Invoice-945413571-XXXXX6856-24011537357076.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1981d4-b518-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705482919, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482919, "uuid": "d575ef91-af69-4675-b628-7febeaf6b22c", "comment": "Malware payload (AgentTesla)", "value": "1ecca57478f8b0956b0aa4c7037e204b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482919, "uuid": "206a99b6-b09d-4567-a2e5-76c449b4401a", "comment": "Malware payload (AgentTesla)", "value": "2b6b6d4b6814af85d658ca6735b150cbbdc3b0a7a37939a5c6c12b6e36ee4218", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482919, "uuid": "5b43c81a-c681-48b7-8a25-7fa633709039", "comment": "Malware payload (AgentTesla)", "value": "c21cafded83178791fafefedd41cf7f803225134", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482919, "uuid": "d9c6a393-6fa4-487e-861b-8bdd9d825f06", "comment": "Malware payload (AgentTesla)", "value": "c8a300b31fc09af2f810d5f2db832757088df60acdf3fa02dac64704b14aab742b8f4ce9c8d1fdcce334ca6ed76a886c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482919, "uuid": "2a100b1c-6acf-4617-8fcf-88378da8c45b", "value": "T11BF4121A77A78D61C3EF263BC1CB94180371C9459263CB4AB9DE235D161739B3E09BCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482919, "uuid": "f6bacc5f-fdc3-4fce-8d6e-f8fbf4398752", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482919, "uuid": "2e1f44d6-5fcb-459a-915f-f0cf57f60d98", "value": "12288:CMXhc2iNhJz/IIHF3fKqHkTSgjbh2MImcnltUFUPCmR5fspKPG3I5rJ5UbY:Jc1HJz/IIHFv9HkTLTIPl2FUqafeKPii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705482919, "uuid": "02d23363-fa76-4bd5-ada7-d64d69ff93cb", "value": 762880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705482919, "uuid": "96a6c7a7-257d-4897-9dc1-edce45d638b1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482919, "uuid": "fb78c229-734d-47f6-b0f8-bac8665bcbf1", "value": "Purchase Order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "162aefdc-b51d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705484702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484702, "uuid": "e50cf9d2-b3ae-4539-af7b-4b97ced6cea0", "comment": "Malware payload (AgentTesla)", "value": "8e3d442407be73d216b122ce41f65144", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484702, "uuid": "11f0428c-928f-47bb-a54d-f0d37fe930ad", "comment": "Malware payload (AgentTesla)", "value": "2b80a1120be165ac1456b2540b36424256385f655eb51623ba4a08b400f856c1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484702, "uuid": "f5698fd9-94a9-4175-906c-be254bf1bf88", "comment": "Malware payload (AgentTesla)", "value": "88ca8ce074c647d42b06dc3b4c163077b31c2e08", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484702, "uuid": "547fcf23-d97b-4dcd-b0d5-1370a5008d24", "comment": "Malware payload (AgentTesla)", "value": "dc6f993c39fe70c1cf9f8fa35172376e7f5c433e9a41f329289351d3708eabd0693559470579353e8d02804c7bacfbd7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484702, "uuid": "f0c6a706-9e1d-4723-9e41-9546793b9ddb", "value": "T11CD423D214F494AB571BE75A028F397E9FA6A30502212D4D9DF3F45B6EA8FF005E2284", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484702, "uuid": "8ab166f9-c7d3-4d55-a377-b15218764871", "value": "12288:Jp5ocn8h/GRDKtvmQCnZYT3NqIwg6jnbBUA3qaCZue8cTCusHakB/DMw53DumIaL:lH8EQCGT9hYBvcueHQdwwsmJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705484702, "uuid": "5537edd3-0ce8-4f21-a617-cfcd496bdd80", "value": 646277, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705484702, "uuid": "144eef9a-26a4-452e-a865-d830675ecc16", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484702, "uuid": "cf0abe41-97a1-4a22-ba9e-83eaded51329", "value": "TT Swift Copy.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3c00b66-b590-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705534385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534385, "uuid": "cb8d1bd6-9c40-4013-9250-4e336d4bd3fc", "comment": "Malware payload", "value": "a0841f580ae436ccbd62259b6c3135c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534385, "uuid": "d79badf0-d0e1-4943-a832-78a4ed9ccd79", "comment": "Malware payload", "value": "2b88a08d390c4bf5af8b54a4e6ac2385ef64b1c6966571056eef1f33459a5ad9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534385, "uuid": "0ff7025b-9c57-430f-9e6f-b79a1e454fb0", "comment": "Malware payload", "value": "78133f9f189d74d0655d54c504cd89b30a4c106f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534385, "uuid": "855c0321-f1f7-4d5c-b9ff-0b8f0d0a2aa8", "comment": "Malware payload", "value": "e3ec18be3f8b5b62a6b8dfcbf127c1dfe22e4b90d33a94f557c1ae6e5ef31c1d5303ba48f7e9be37d1ec3ce5e92846ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534385, "uuid": "149d4061-3e45-4093-936e-b2c76420a5c8", "value": "T1B1758E32B2908837D5631F745C6B86E96935FF112E38AC8A3BF51E0C6F3978179252D2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534385, "uuid": "2119ea13-b2a3-47b9-b3fe-3d7a4d0b1f9d", "value": "24576:OAyA/7HE8gpa5acii7Lf+2483Jh+xWmALSzRNeTb2LxB4Gh:OATQa/v0NNeTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705534385, "uuid": "9edd01b5-7393-46b5-95cf-056af4a9abfa", "value": 1594368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705534385, "uuid": "8b37fb30-41a7-47bc-aec2-5a9dc66639bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534385, "uuid": "f3d9d4ed-ad0a-4a48-9495-26966b3e83ca", "value": "SecuriteInfo.com.W32.A-62389890.Eldorado.14312.28916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "832a6025-b564-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705515379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515379, "uuid": "f6f2b063-120a-455d-9019-8fa3bd8d36aa", "comment": "Malware payload", "value": "ab69b22f0659d51a77e9e3612a5745d9", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515379, "uuid": "92d62bfc-6272-4b54-b1a7-7e3578944e28", "comment": "Malware payload", "value": "2baa3a2f6dd94d77aa7f886d04c9550b59bc91e6e6db76de89334564cda2c346", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515379, "uuid": "0f25c94c-7fb2-4fc4-98d9-a5de7abc9efb", "comment": "Malware payload", "value": "3b7afdf562921cd30d049044fec5be52912c3b03", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515379, "uuid": "ae4f8c71-9b78-4bc4-aed1-2ca9ad28a65f", "comment": "Malware payload", "value": "c7e6a71d963c28e30469a60551c5bb7ac57245dc9b5738e50a3cd6911fb447d779e5f1ae0c2b4eb81db6168b725fa4e5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515379, "uuid": "642e4043-7394-4b14-9ea6-f50cbb10f1d7", "value": "T1B6F633FDADBCE5D5140E2F076829012C49864AF5915EB65BC6FE0EEEE40FD23A88107D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515379, "uuid": "337fc1fc-aead-4f93-8b56-375f79ae1d0d", "value": "196608:8uaQxaCE2bPKc9udZKwREFuSlwoYZTqqknNqPwB0yLspmHGC9GsNCS6GSIo:KG7bf9aqJlwoigr0yLswmC9GsQS4Io", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705515379, "uuid": "c9c2d1f1-5ce4-4c51-acef-55634f07d557", "value": 15739956, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705515379, "uuid": "2dd433b3-b0f0-4c2e-a6d6-008225254a32", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515379, "uuid": "cc35c35a-2328-4271-b920-67ce3b6e5ea6", "value": "FatTpCi7cBiv42lUCHO5C.ZIP", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec34c68a-b511-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705479907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479907, "uuid": "d8ba4e0f-cb65-4bf5-8e4c-11dcf240edc6", "comment": "Malware payload (AgentTesla)", "value": "a2e74092280ae614d2cbad4174b09bc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479907, "uuid": "61630edb-e7e3-4359-93f5-98d0f423ace0", "comment": "Malware payload (AgentTesla)", "value": "2de3d7182ff7a9ba5bb292130d66543bcfe53731c57ff16756cd56a0eedab557", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479907, "uuid": "34f740d3-5f4f-4ef0-8019-4533be6e535d", "comment": "Malware payload (AgentTesla)", "value": "50ca8245340222061e93d3b2ee7f804d6648e171", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479907, "uuid": "44ac0761-054a-4192-8cef-41fbc53510ad", "comment": "Malware payload (AgentTesla)", "value": "a9a3ff7c99098b397b05100819e36d69af141126e8ab3f6790848114c306e5ef8e01750e28b969b4e35ddc7c2f9a7cf8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479907, "uuid": "60aff789-dc4f-42b6-9cc8-0db6e038decf", "value": "T150A3E16DC34B01698F625337AB171E4542BDBA6EF38552B1306C533933EAC3DA2252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479907, "uuid": "fd7980fe-a8c4-4bef-a4d6-f9b2e941ab81", "value": "768:ewAbZSibMX9gRWjtwAbZSibMX9gRWjFEKJ9e/ermZugAHp/mGieCRzazo4UB6:ewAlRkwAlROEiQ4mysA04i6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705479907, "uuid": "b937f708-f413-447b-b0b7-bc413df5bb46", "value": 102610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705479907, "uuid": "af22e5de-63ec-44fc-82dc-e1b5f8898aa9", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479907, "uuid": "4a5f8e66-3bab-467d-ba33-99063f8bf8c2", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.25667.1376", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6020cda1-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705502006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502006, "uuid": "23349a91-e8a5-4fec-a99e-dde4fc55bbbf", "comment": "Malware payload (RiseProStealer)", "value": "2f2acbfb946b202fe77660b2a735a197", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502006, "uuid": "34dd4686-e75e-486e-9a2e-2a0bb91e7a5a", "comment": "Malware payload (RiseProStealer)", "value": "2eb564562fc5d4d4ab4efca29e542ba64da9b04a58b7c6a39ace4e53ad12273a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502006, "uuid": "19c66062-04b7-4ac0-8520-843043bafad7", "comment": "Malware payload (RiseProStealer)", "value": "fd4738c226bf7672880144aad0135576ad3c1fa4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502006, "uuid": "35523d04-831d-434c-bd93-2a93d009c233", "comment": "Malware payload (RiseProStealer)", "value": "d9994d0a93d1eb16ddad4d5eacbe634b9288aada388172a01e0d9341c252505f2201014565d988ffe75ae0b1dc12a9dc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502006, "uuid": "defe8341-6f95-4372-9395-5a6822ed7661", "value": "T1A9659E627292D079D1C113F1257D6FE1C2EC6E719BA284CBB3C01E3AA5B11D2B539E1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502006, "uuid": "5b2ea76b-ceda-450a-99cb-362700ff613f", "value": "96fa9927288c4f8325d3528d85326fb2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502006, "uuid": "7215cf45-42ea-4303-8f7c-fa6632bb1500", "value": "24576:nUalkVcJGB7FyCTEaYtT9SfVK5Y3IexDzSf3Z8MQQvTICTNiTPUXl7TP8o1Cl8:nyWJG7yUVYtT8RSPKqvTVTUs9TP8o1Cm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502006, "uuid": "258e65b0-953d-4a61-ac95-fd258a138bde", "value": 1509376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502006, "uuid": "ac4ad6c1-f9db-4e61-9cf7-8f22bcee5710", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502006, "uuid": "33802f27-746b-4675-b85a-6764bce87143", "value": "SecuriteInfo.com.Trojan.Siggen23.22903.15219.31710", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e1329a-b588-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705530705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530705, "uuid": "4930c809-4667-4685-96af-b8b9f6846062", "comment": "Malware payload", "value": "3abaa7f31fdc5096646bbd7c4471b194", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530705, "uuid": "13169851-d78b-411c-bd50-4adc187d53d3", "comment": "Malware payload", "value": "2f7ab05e201d8bfdfbb0af7bd1962394a98835b9c18ce1e262cf34f22082b75f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530705, "uuid": "239c2bc1-97b3-4227-a177-7754634def4d", "comment": "Malware payload", "value": "044ccc281c64ec2a03c96fb05c70f9364a58cd3c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530705, "uuid": "cb39ae5e-e168-4084-926c-9d1fbe53dfbd", "comment": "Malware payload", "value": "6a55c9cddf5a2a6837b8a7de6b606958196b00f7e37b93ca309b667908e55be9e5d07bf46207d59171435f7a08d81516", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530705, "uuid": "0e08e08c-0345-4548-8ba8-5afb30116257", "value": "T1DDF42341BBA46813DAD1AE322FA48FE6D7FBB78807515353FB81AF1F2C562071A67011", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530705, "uuid": "75e5885e-665c-476c-a440-c24c106cb0c1", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530705, "uuid": "9ac63cd7-9b5e-4c42-ab28-94f7810094e1", "value": "24576:P8j2/ZFn5DKoNAOLD6u97U3gSX/SWP7FrYarlxF5nQLwL:PGI3n5DLywD697prYarldQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705530705, "uuid": "be5596ea-f81a-4aaf-85e9-ebaf41627dcd", "value": 787928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705530705, "uuid": "e5fadcf1-a190-4ff8-83fc-922156d2724e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530705, "uuid": "2f58550b-03d0-4fea-b688-0ec69281978e", "value": "SecuriteInfo.com.Trojan.DownLoader46.44011.13581.29916", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7b0e8a-b566-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1705516366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705516366, "uuid": "a2abcb7d-7c88-4696-a645-d539b5279c92", "comment": "Malware payload (Amadey)", "value": "9e18426a541bc9f54ef80cba50ac6090", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705516366, "uuid": "fb52bab4-374d-42e3-8413-6ec36d2a845f", "comment": "Malware payload (Amadey)", "value": "2fbf7eee142143a7e7dc36c187da980e41d7bc1d77375fd16287173914eb3ab8", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705516366, "uuid": "b00e918e-55cd-4225-a004-6dc6f11e9f3b", "comment": "Malware payload (Amadey)", "value": "6b7ff2c4270b22ad32496c42e8cab801a7e4dd27", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705516366, "uuid": "fc8569ee-07f7-4288-bfe5-8c5472190952", "comment": "Malware payload (Amadey)", "value": "d1306e10e1a6818a635e6144dbec5d155c1fcbe68327ecd6b9e290ebd0b7fb9904a8ea4c27a29cd6d171658cc5941898", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705516366, "uuid": "ef2a4153-93fe-4095-89ca-7334edfbe70c", "value": "T1A4557C0FA36541BCD4ABE1789A135A46E775700603705EEB07E446AA3F53BF1AEBE310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705516366, "uuid": "cee5af08-bc62-4438-bf50-ec2f38d656b8", "value": "3eb70f83441fc8632e81bd6eb89f424d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705516366, "uuid": "e370bf05-eea8-4192-a744-f029bdfa273d", "value": "24576:aSn+3rwYCD+7ZLCNDPLrsfMcSpm471n2DU0tT4cp:OCD+7ANrvsfMTjJn2oop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705516366, "uuid": "a44250b2-a61a-4bab-9446-7ab567dfb784", "value": 1284608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705516366, "uuid": "725807f1-25bf-41c4-88e8-4bf8005749ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705516366, "uuid": "a3f953a2-5f77-4357-b8e4-120f10ae867f", "value": "9e18426a541bc9f54ef80cba50ac6090", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220028c3-b555-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705508774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508774, "uuid": "194ebfef-dfe1-4246-b101-2dfb6cd168db", "comment": "Malware payload (GCleaner)", "value": "e40b7d4f6f648a02c4caf853b632afcf", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508774, "uuid": "9ae61952-15a3-4f80-ba8f-d906ea1fe030", "comment": "Malware payload (GCleaner)", "value": "301bc37b82c6774e3dd5fc74a8ca87d6a81bd29a4ee2d163efbf26e42b7a9d52", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508774, "uuid": "f6b1d510-5c5c-4442-b725-2d3f09cf0147", "comment": "Malware payload (GCleaner)", "value": "6b846f8c34982b9c98b2dc859cf1e53832491faa", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508774, "uuid": "9473a57e-9e6b-44e6-b43d-afd31f493a70", "comment": "Malware payload (GCleaner)", "value": "b4c2a8cfea35262fdbee18b5ca3c9b314f5639b1b4b3e1466b74cb6d8e9ec20f319fddb22fb798cdc51f81fc9a682fbf", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508774, "uuid": "1c0c3c3c-f331-4188-a9a1-88d6e8126882", "value": "T136967C02BB45CD12C12E2737D8CF456447FCED016B13FA2A394AB76C29727A65D0A6CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508774, "uuid": "2fa4ddec-68cc-4691-adae-87cbbea911ce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508774, "uuid": "a2989245-5f60-4731-8b1e-94afdc2d07c4", "value": "98304:14Bq1/rU3NxWbGyE3DeInb6/XYADrX7jX9Xegs+s+bTZs/5L:Wv37pb36XYCXHZeos+/Zs/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508774, "uuid": "10e7df5c-ef2f-43f2-a947-23c72e8c9eab", "value": 8692736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508774, "uuid": "729d06ff-ffff-4682-9568-d153c355ed61", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508774, "uuid": "4a31261b-c41d-4362-8402-f83ddb895bd2", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "211d9292-b564-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705515215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515215, "uuid": "254ac792-d42f-4675-87b1-71c22e615cd8", "comment": "Malware payload", "value": "264827abf6df40701060984af06fedef", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515215, "uuid": "5d21ceee-f14d-4e20-905d-fc2b8dfffeec", "comment": "Malware payload", "value": "311e6bfeddbaf043b3fcaa15a2de6e1aebc702669c619000cfff9ca3585ec761", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515215, "uuid": "da31dfa2-1c50-4b68-b384-2867714bc6b5", "comment": "Malware payload", "value": "93f2b0f1a3a63a46f9cba34b1c33c28e41c1484a", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515215, "uuid": "c0684413-ed5c-41c5-abd5-f240d6ddf849", "comment": "Malware payload", "value": "5db82f085d0678b2c250ef2ef297b9057b0e55b11d4d0d0a4aecad9148e8c3c9391d9ad7ad40b8cda4501e61fc4357f3", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515215, "uuid": "fbe6f4f0-41d5-483d-9c67-09525271657d", "value": "T140F02D53D9280467CD0E503BBA491380A2DFA3A684042B881CAC9242E8099D235A15EC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515215, "uuid": "597906de-6c8a-4b93-82b8-c109c3e718e1", "value": "12:5jkwV3hDqR7PpiH7r4tmPQs3EptZWbwBQAdR0nnLP/DpfnwVGhXta1n:9kG39ws7r0W0xWbwBQAdR0DZnGGwn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705515215, "uuid": "a54b987a-6e9d-4075-9cd0-d3caa8261b15", "value": 631, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705515215, "uuid": "6fcde98e-7220-47f8-bdb4-06aa5562f7f5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515215, "uuid": "fe538ab9-6e08-4f23-b818-5e9ff4dab9c2", "value": "CB_Assinado_363670.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e61868-b500-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705472380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705472380, "uuid": "7a67c521-84a2-40ea-937b-0f1cae42bccc", "comment": "Malware payload (RiseProStealer)", "value": "ad7eff03663516af69b09d1695d0b9ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705472380, "uuid": "e9a69054-1b26-41eb-bef9-c4051eae0902", "comment": "Malware payload (RiseProStealer)", "value": "314299481d85bdb61efe20f20ddf8900640532df2a4342d8f20f851661016917", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705472380, "uuid": "c06c968b-5001-4313-b606-5785e1616f78", "comment": "Malware payload (RiseProStealer)", "value": "1447e83478e963a137a8b9b0a067fcf711c15f7b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705472380, "uuid": "15c58b05-8d62-4b07-9cbb-64c571de4061", "comment": "Malware payload (RiseProStealer)", "value": "69311e6c959f25b78d6b162c4dfa1782df8af1190e9d91ab01d29ac536c004ca51ac65fb42427fc74c07d18827d3e0ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705472380, "uuid": "803b0e33-c914-45d5-a8cc-b575550dabce", "value": "T10B9523F97AF4980EE0D453F2573082A146E59ED1DF628EE3E4B3181A374F5C24B6291B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705472380, "uuid": "a9b88326-de36-4703-b615-25eabc6c6dbf", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705472380, "uuid": "90ba6343-909a-4d7d-9f93-0abc7872c136", "value": "49152:tUeUMelt2/K8Fic3GZp+tv69pqQuXyO5tZI:ae24/ZR3GoXyO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705472380, "uuid": "8155709c-37a2-4394-a33c-8a62d1e6e414", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705472380, "uuid": "0b37dda0-9b51-4856-9948-1f4023940e51", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705472380, "uuid": "cf080711-9f27-4f19-babb-088a9e7fa0a1", "value": "SecuriteInfo.com.Win32.TrojanX-gen.30739.915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "932f24f4-b58a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1705531727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705531727, "uuid": "dc518b79-fb4f-4fad-8528-ffdbd3f10f40", "comment": "Malware payload (IRATA)", "value": "3d20e5e7cb079aa88b7ebfe71da974f7", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta", "colour": "#F5ACFE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705531727, "uuid": "78f6d9fa-8fbf-43de-9919-83822327fb91", "comment": "Malware payload (IRATA)", "value": "32564a43edfff57e9f847be207efbc75694fce4660584345f2e24b31d0926f3c", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta", "colour": "#F5ACFE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705531727, "uuid": "bb5a4bdf-4887-403e-b60c-4650fd0ee691", "comment": "Malware payload (IRATA)", "value": "c0a0ec7d1e20cbd13a2e356dcf0f798521adabe8", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta", "colour": "#F5ACFE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705531727, "uuid": "9ef3b38a-5494-4b0a-93e3-54d6a0a62857", "comment": "Malware payload (IRATA)", "value": "ce008a553f54b8244c8a49b7540ac72f414a7f6926d0451eef98183a6cb936972ac7b53b295ed0d2317a8a56c84cf771", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pwd-beta", "colour": "#F5ACFE", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705531727, "uuid": "7a791e4f-7eee-4b7a-a214-50a481a9ca50", "value": "T184E733AC546DC38FED87A607DCBABB4AF1CCCD05D4DC5724C2135C49E96DAA0926238B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705531727, "uuid": "e272e174-4895-448a-872a-305027341c00", "value": "1572864:VcgmXF2rDHy4SnYhPSKGIDm4x1ozdVHMnsP/MPp8RFQHAO:VcgmXizy5YtTmGozzMsPuuzkb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705531727, "uuid": "542a89b9-080b-4f9a-9efd-8ea3c0bdf005", "value": 69789102, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705531727, "uuid": "5f35f458-01f2-4236-9859-76118f72d43d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705531727, "uuid": "8217a63d-cfd8-4789-bc71-6b7e22d73e54", "value": "EpsilonSpaceWorld.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61e55321-b50b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705477098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477098, "uuid": "19985a26-720d-48dc-85d9-78d71290b916", "comment": "Malware payload (Formbook)", "value": "6a2bd13cc6899bc03c9343763f0a97b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477098, "uuid": "c74a274c-2c10-4a46-bc88-d58ba491bd53", "comment": "Malware payload (Formbook)", "value": "336cf34d2aa06efac3dbf65e742c9947ce39f6f5388047c47a6b71542e36929d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477098, "uuid": "080ae22c-dc8d-4b19-ba89-28ce6c543b33", "comment": "Malware payload (Formbook)", "value": "76579fbd9185d8e040a9f8ee1ee580061b837aa2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477098, "uuid": "23237258-52e8-4875-910b-81530e176980", "comment": "Malware payload (Formbook)", "value": "4e9424c74fbbb565ab73b58fd8523134a9dd1cca47cb9763e134adcb90e249b6a5bfbd500914dc268b11d4420bc8ba08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477098, "uuid": "2bf62fd1-261b-4f1c-906a-efd14225eb92", "value": "T170366D06979406D5D06ACA30CD6BD732E2B1FC290A36C74F5511E38A6D73AA1DFAB331", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477098, "uuid": "4aeddf26-7dcf-4c1e-bd64-7b96c0f2bede", "value": "c1bd85c47a3d2c5743df7292e01168a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477098, "uuid": "9b12b385-a971-47c3-a667-ea4eb2ea4820", "value": "49152:H/l7AwNXqzQU6g3ZrZE4LYwuFcndXjeAifQc/iucNWurN:Q24LwAifth4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705477098, "uuid": "d7301dea-c86e-4b3a-b7bd-a29683742d8b", "value": 4923904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705477098, "uuid": "e990ffbb-21f7-4f83-877c-c1a3ad21eb36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477098, "uuid": "ef91d478-aa27-44d4-9786-fbb6eb6ff7f1", "value": "Le Champ Pte Ltd#KTR2011941109.xlsx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "753d156d-b560-11ee-b7ea-42010a9c0006", "comment": "Malware payload (T34loader)", "timestamp": 1705513638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705513638, "uuid": "098d92fe-128b-4451-9992-f5464b0b2cae", "comment": "Malware payload (T34loader)", "value": "c864bd504ab2b113b5e59f420747c9c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "T34loader", "colour": "#888C9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705513638, "uuid": "1176303c-c3a0-446e-a958-8da95c7e0017", "comment": "Malware payload (T34loader)", "value": "341882c3f5243349bd9ff16e14f3b040db779d23603d910e38006f4201e9a89c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "T34loader", "colour": "#888C9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705513638, "uuid": "19899efa-3ad8-4c68-9c02-653f06eebc04", "comment": "Malware payload (T34loader)", "value": "315ce31f17a74169c6198d8391a1f45f9d9c7a62", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "T34loader", "colour": "#888C9D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705513638, "uuid": "ccafdf94-8df7-4550-b88e-4bd0b8b71e4e", "comment": "Malware payload (T34loader)", "value": "a1086e47c7b00f02329039977c6a8788143d7fbaca8497fcdc59901f72dfa2108b59d765587a698d3b147739b1bd461e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "T34loader", "colour": "#888C9D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705513638, "uuid": "db926b9a-02e1-4877-9467-5099b672c6c8", "value": "T1386633A53DD0CE64C6792E3608B5963AEB7EF7401B2089FBF7E40AD44A25BE0253D11D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705513638, "uuid": "e47ae89f-0218-4118-b3e4-efcf170458ab", "value": "fa2936ff523bbe01bb11c81e10c9ad2d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705513638, "uuid": "cc6136a8-80dc-4c2a-a4bd-06d5fc0aff53", "value": "98304:ieTVd6kTq9esjC27fEp4F5McwoPllMWHuMXkTZONq0d6NlPf9/iPUA+5NmNTz0:lVL+DCgEpNoP1HdXfZ8bntiAzMH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705513638, "uuid": "67b36bc6-3aa0-4548-a2d7-01e386962180", "value": 6780902, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705513638, "uuid": "d391dfa2-dd9a-4146-b8d7-c1794b4078e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705513638, "uuid": "94733f99-a2c0-4e19-a73a-5374c238edc5", "value": "c864bd504ab2b113b5e59f420747c9c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79254b25-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705502048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502048, "uuid": "f8642a59-5e91-4b80-a9d6-f9ec889e3b41", "comment": "Malware payload (AgentTesla)", "value": "3c928c05160c57cb8bf89feac1c7cef8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502048, "uuid": "b3f1acf4-6163-45d6-b5b8-72be8926d275", "comment": "Malware payload (AgentTesla)", "value": "34a4ba069cfa639dc62e1ffc9a069a87393bb8ce4e57f45991f3f8dbbe13ad09", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502048, "uuid": "bde1120a-682c-4f1d-a6ed-5aa98540e070", "comment": "Malware payload (AgentTesla)", "value": "f4e6186ded4c9151a15f7fb3b87ed58e895d51de", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502048, "uuid": "8eb82274-0b99-4c76-9b3b-7dabcebc0ddb", "comment": "Malware payload (AgentTesla)", "value": "a057ec9b5b2509ff772cf746d27480d8ebcd5782e71e6ebe46e9753ab6d7d7fc8bb566a114a477e5b49f3aec047bf19d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502048, "uuid": "19036470-f70f-4657-ab9b-7c18c0931eb5", "value": "T1DDE4230136BCCA3BD4AD42B9A0938AE607B91D3506BAEECC9DF6579E54F37D50280D13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502048, "uuid": "cdc524bc-7343-41e1-864b-6f088ac0ed77", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502048, "uuid": "5a36f6b5-8b63-41f3-a3fb-c2b8319ae1cf", "value": "12288:7eePFLVoq3FHzJCCVUHg7VWbz9+pCNoKLjmi9N8hgWktaKEt4SUjMlQRzFZl:7eePRVoMFHzJH7SLL6WC1bKEGNjMlOz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502048, "uuid": "b3e9b548-bfe1-4581-ac0e-668443645864", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502048, "uuid": "c8052a96-b118-44fe-8ddf-739f29b8fa24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502048, "uuid": "1de393ff-2346-464d-96d5-3a94d18d84b2", "value": "New POs# ST-2312180 to ST-2312182.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e0c925c-b50b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1705477038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477038, "uuid": "5889830a-37da-479a-865f-f4d403364ded", "comment": "Malware payload (Vidar)", "value": "74c47fe2548fcbaf9c745e277324d667", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477038, "uuid": "b53ed9b7-ccb5-4244-a0e9-db771d978819", "comment": "Malware payload (Vidar)", "value": "3672fb8af2d9c0ba5928eea29081a8289e9c1e472777e6743006066b2810bee1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477038, "uuid": "a40ed7b1-5559-4af1-8af5-fa26bcd256cf", "comment": "Malware payload (Vidar)", "value": "e8e2fd518729c379380f12a8fbe2d09d426081ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477038, "uuid": "8ee9c61b-78fb-4bcb-9738-1f81af47692e", "comment": "Malware payload (Vidar)", "value": "6376f7668a71012e86ffe38298c8506211907229628f8cd7a9c8261b09f68b011a3db4399fc4176c311beab35956d827", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477038, "uuid": "5c98c1d6-2e7f-4d60-9df7-309e5374765b", "value": "T11944ADBE3A84483BD6BC24F89354DA7556A2E4557E3472973BA0CD2DED323F38C46680", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477038, "uuid": "fb9dffbe-a46e-444e-a4c5-689cb3d6c2d3", "value": "ea195bf8c93901cc0697df8bcbd3b755", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477038, "uuid": "597c5f7c-82e3-4e79-b427-d7fde1bcd718", "value": "3072:CyyhzelkS4QWsT4axJPJH+kQlLsGbMoPOjOXiFx2szueT4njbJC5Dq7c:WOUQd0aRiJXiFx2sXeJCd3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705477038, "uuid": "69781095-b637-43fa-a3f2-ac4423616bae", "value": 276633, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705477038, "uuid": "78c0d199-49a0-4935-9e5a-423da51c30c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477038, "uuid": "60225b5a-6447-414b-b0f5-f4e41dcbeee5", "value": "74c47fe2548fcbaf9c745e277324d667.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9e2dab-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705502029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502029, "uuid": "fd171c1f-c020-4010-af25-1202593fa9fe", "comment": "Malware payload (Formbook)", "value": "6975f1f27e4016368f71dabba716ca6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502029, "uuid": "4d1eb834-c615-4376-9e82-9d6a5b623424", "comment": "Malware payload (Formbook)", "value": "36ca307d291dd056c62947b445d527b4a84c42d2d669382abb78413185d3a6a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502029, "uuid": "9236a62b-50d7-4830-9732-d230fbed52e0", "comment": "Malware payload (Formbook)", "value": "3225deb13c647b26a52c59a328b3432cff5e8871", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502029, "uuid": "0e7c23b9-c899-4ab0-a53f-85f2dce3ca63", "comment": "Malware payload (Formbook)", "value": "38b0ae2a9927f0bd467f00dd999cf1be6f964e302e3ae6edd1c734b1d1f0e48a9a0a5d03373e4e6a20180f18f908abda", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502029, "uuid": "26e1f1c4-94a3-4719-aebb-2258794998a9", "value": "T138D4220772F81B66C2FE27F25D80609A83F6A116A0E6DB584CD730CB55E57900B74FAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502029, "uuid": "d1cc8ba4-0b49-4f14-9a37-bf3041e76eb3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502029, "uuid": "c10a35ec-360c-40ed-a944-44325dedf518", "value": "12288:n9d2iNjJz/IIHF3fKqHqWLr66AEWzP0S0iHjl8KqUitqfZqb2V2M31VgCnoe:nn1NJz/IIHFv9HtLW6AEWz/0SitAgmLP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502029, "uuid": "93418155-d845-4ea3-874c-562536006dcf", "value": 653824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502029, "uuid": "c4b42ffc-40e4-4b36-8f7d-a6f93c5fd250", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502029, "uuid": "fe4ea9b5-5e6c-4bae-b7eb-0c4c3ed30243", "value": "z46PEDIDODECOTIZA\u00c7\u00c3Opdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "273884ef-b555-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1705508782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508782, "uuid": "cf3563b4-e61f-4d64-8657-405549edcd8f", "comment": "Malware payload (Amadey)", "value": "239eb6c56f0d54c11ddf2a826e4d6b73", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508782, "uuid": "a4398698-15e4-4074-b5af-1994c311ad7d", "comment": "Malware payload (Amadey)", "value": "37be0861185e25e87d406031c55583d99260be44b6fe929a912aca4573d5ac5a", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508782, "uuid": "e805aa07-c4ef-40a1-9bad-c39cef86f277", "comment": "Malware payload (Amadey)", "value": "f70361be6a6e18001b3186d34f1cf30257884326", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508782, "uuid": "a3ff280a-e8db-4e41-b435-3ce00910a76c", "comment": "Malware payload (Amadey)", "value": "ccb024ee77bf299a9b7daafc4535e4d99942d6385e670038ed3a011eb40336a783f58328a3733cadb387d0367833991c", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508782, "uuid": "d1192322-edc9-4203-97d3-812320d13e80", "value": "T127668C027B45DE22C16E6337C8DF540487FCE8926723EB6A7D9A739C19423665D0E2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508782, "uuid": "549536b8-82dd-4eab-9502-543000fa97d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508782, "uuid": "17372ae6-fe02-42fa-9f7b-f48e246a1cc2", "value": "98304:c61tVQE4+ReJIRFBqq+LqHaSvSYtaw6I1z22IHmA0hIaH7:h1fQIRFAq+u1vva6xVwgIq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508782, "uuid": "2f4a19dc-5dbf-478a-a6e4-b637da7045e7", "value": 7059968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508782, "uuid": "41b9f53b-1050-49c5-8ebd-77dd0c418fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508782, "uuid": "dfc1fefb-f900-404b-a474-4826670de52f", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d01714a-b555-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Adware.Neoreklami)", "timestamp": 1705508792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508792, "uuid": "14fc35ac-9a10-460d-9b2b-0514aafbd2df", "comment": "Malware payload (Adware.Neoreklami)", "value": "f5f9f68d65a2790d43056ba034d37255", "object_relation": "md5", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508792, "uuid": "d10fec9e-0f0b-4a4a-8c31-f175e6064f1d", "comment": "Malware payload (Adware.Neoreklami)", "value": "38340e16ee0e75c52d61f5b3aebcb10d434bbe7fd746f1751943fa911f7b3cfc", "object_relation": "sha256", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508792, "uuid": "ced3bf6e-eddc-40ef-b29d-9ffa48f10ec5", "comment": "Malware payload (Adware.Neoreklami)", "value": "ab7d1ba6998138268f0b9f8c818f024695f3c4c3", "object_relation": "sha1", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508792, "uuid": "393c811f-3fc8-417c-800d-77b7f8f196fc", "comment": "Malware payload (Adware.Neoreklami)", "value": "759fcb3e1b9b930f75e9eb9398b926b5c57dc53a19835678cc5c76ffea17679a5f673241559753ea9d1c725030f0ff4e", "object_relation": "sha3-384", "Tag": [ { "name": "Adware.Neoreklami", "colour": "#5DC9D2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508792, "uuid": "2f12c546-e7c8-4a52-b0ab-e4cad2711134", "value": "T1467633B2B0F5CCBDF9048833E3594B94F0F1925B8A255DBB6389158C3F381EA9B67944", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508792, "uuid": "5d3e2d51-2223-4788-9cbc-d54024e86386", "value": "3786a4cf8bfee8b4821db03449141df4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508792, "uuid": "c26fa7ac-d647-4b0e-b369-97a0b2db43cc", "value": "196608:91ODKum4Sr96iEwM5cxTRx0LqNa2G+6vL:3OeumL6aMy970LzVD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508792, "uuid": "4c1194cc-0170-46bc-9e12-8a47f045b102", "value": 7588244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508792, "uuid": "c5b855d1-9af5-4d91-9f54-c8d37149edaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508792, "uuid": "7292d259-8a26-40cd-ab81-fc2a85af0b23", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc615816-b4de-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705457976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705457976, "uuid": "8b5d9426-86c3-4f19-90ab-ace26c2fb1e6", "comment": "Malware payload (RiseProStealer)", "value": "bb92d03599ccd6ad982b778e0d76e19f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705457976, "uuid": "1cbbaafc-0d02-42cf-8526-064e1c704598", "comment": "Malware payload (RiseProStealer)", "value": "38d2c58c7197f6fb36c0b28974c72f6e8e191168090f100e5d348293380f636a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705457976, "uuid": "c8f6db09-f8a6-44dd-aca4-3aefcc441a89", "comment": "Malware payload (RiseProStealer)", "value": "60c1a40b6112fe3b5fd2cebfae592d265f63df14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705457976, "uuid": "c1da8dfa-7f08-4252-9984-c8ab1caf7d4a", "comment": "Malware payload (RiseProStealer)", "value": "a7fcfc7d169b13b35953eafe3de0b1d9311f7ec94805f4e06ca82ecaf62cc0b631b5db37309602b8b6dae62d3679563a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705457976, "uuid": "52307f64-1e10-4e05-9323-87bdf0d4010e", "value": "T1209523F17EF9001CC4D203F56774E52522D99CEACF018FEAC8AB915A378B9D16E0529B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705457976, "uuid": "ec3615b2-878b-4bb2-a6c8-0a0f413a38ea", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705457976, "uuid": "5756336b-aa24-4399-a634-65c172804e35", "value": "49152:7rMmqrYjFGmOM4Zkt9SINgQpOhmIHwrXdlUb:qYRxTtDgrnwrw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705457976, "uuid": "854f6ae1-dbc7-4a68-b14d-bcb52b116535", "value": 1876992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705457976, "uuid": "64eba5fc-d1d8-4db1-adef-190ba483e4bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705457976, "uuid": "1546e108-2161-4b78-92ab-402b173d4406", "value": "SecuriteInfo.com.Win32.TrojanX-gen.8185.13660", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0cbe8db3-b4e7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705461493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461493, "uuid": "786f3513-9ed8-4d52-a1bc-1afb33e960aa", "comment": "Malware payload (RiseProStealer)", "value": "e344b4383cb57af780ef557afb7b9d50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461493, "uuid": "3f15d4c2-1405-4b66-a23f-842779983e08", "comment": "Malware payload (RiseProStealer)", "value": "39229696e2b854c0c05dea330503076ddafe9db76d88254e2dab45c6ce12a52e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461493, "uuid": "040966c8-b636-4dae-97d6-046a2513224f", "comment": "Malware payload (RiseProStealer)", "value": "b72144be1584bc2a48f8c2b6b59aaa9613427657", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461493, "uuid": "accaa3ed-6d13-4174-aa31-be7c32e4f8d1", "comment": "Malware payload (RiseProStealer)", "value": "2bf9dec79759f5142f02cf84faeecbec3c7c7d50589840fadb63aa39a63e103eebc559bd8ccc61ce5c5ab17e790ad430", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461493, "uuid": "a2af2f4f-a206-4ed2-be75-bf01ff6bac8f", "value": "T1969522F536FA9A0EC8D4A3F95BB0AAB542D09EC5CF148ED2D4F36501738B2C4AB16417", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461493, "uuid": "7518beaa-0501-46c4-9efd-44563b0c0ada", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461493, "uuid": "5ba7a909-f13f-4209-80be-4e32ff01af0e", "value": "49152:xuhSY/zN1CYKWcHAMTRzGTCo0VtjBOnevEpsQL2PafL7wLDkLD:KSY51oWV8RyTCfVeSEtL0dL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705461493, "uuid": "e8e843cb-eb5f-4c61-850e-bbf12ce59b56", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705461493, "uuid": "3117a4b9-108f-4222-8473-e7126ee6f2c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461493, "uuid": "89c9faae-55c2-4e05-9fe6-fc7384e58ab4", "value": "SecuriteInfo.com.Win32.TrojanX-gen.28663.23790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74816f3a-b511-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AsyncRAT)", "timestamp": 1705479706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479706, "uuid": "0a30c009-662b-4205-8b20-7ebebedb9dcb", "comment": "Malware payload (AsyncRAT)", "value": "4d91bc1c70f6c131c43987d2c316a258", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479706, "uuid": "b6dbb22c-1d09-41e4-a8d7-e8d9f96b831d", "comment": "Malware payload (AsyncRAT)", "value": "3a6ee3577f34cc11e75fe96feea3a63b50990c0e34772e598217fcee0b144122", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479706, "uuid": "85943466-bafa-48fe-8e80-e9f69fa6d4ec", "comment": "Malware payload (AsyncRAT)", "value": "b955a8ffe2444a9bb4cbe59255b5ec7ffaaecba5", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479706, "uuid": "466c8906-07c7-4e97-9bc5-522e14b3dcef", "comment": "Malware payload (AsyncRAT)", "value": "408d41c7518eeec7dcb03a95791d3f5537a12cd5a8b41330bf35c941cde9ad4e3ef75f6be9e8dbbe0fc20a5207f520e7", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "wsf", "colour": "#256B39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479706, "uuid": "57053475-409b-4504-9dea-5703ef7b7316", "value": "T1CF922969C96785270927A3D076144283FC9AF541C3ECE2F07E894F4578E2CA86E9DEF1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479706, "uuid": "e2900046-3469-4f9e-a87b-516dddb60e0f", "value": "384:F5+Rdb946L9IMvrOahQrLMFEtl5+Rdb946L9IMvrOahQrLMFEtw:D4dh4MtvrOahQrLMFAj4dh4MtvrOahQa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705479706, "uuid": "2e7803dc-af4e-412a-9c89-69b55317f713", "value": 19836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705479706, "uuid": "66dc2516-eb6c-4883-95d7-221839652bce", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479706, "uuid": "79a48263-15a1-473e-901a-e592eba79128", "value": "1.wsf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69287b0-b530-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705493239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705493239, "uuid": "486bc410-d090-4eb7-a7b1-f33bb94772be", "comment": "Malware payload (AgentTesla)", "value": "d0a01c89eb4ca2d77666fb43edada76e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705493239, "uuid": "74ce76d9-156f-451a-8741-f99015c3209c", "comment": "Malware payload (AgentTesla)", "value": "3cb25cea86d8c19256baf88d612122bb926e4d1f06943cc32cb18607d115dbcc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705493239, "uuid": "995abf55-6447-4168-b642-71a602bbb7d9", "comment": "Malware payload (AgentTesla)", "value": "92f3d9e0c806974d1ec991e32764b51ca687c851", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705493239, "uuid": "fcff17eb-0b4e-4f4d-bbfa-9fabbae499a1", "comment": "Malware payload (AgentTesla)", "value": "de0b84eb601aa682ff09993812b90c11fba10a214a098e1a05b5d125ed8e1edd1f368ef24d9df4296d5f880befb430f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705493239, "uuid": "84ee07fa-ce81-44d5-8e62-d0fd6047fd78", "value": "T1E4D423CD72D90223D63D90BDA002F966686B3EE58939A59033F9FC67DE075FE8C64490", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705493239, "uuid": "b36c5ac0-82a6-4ee7-ae0a-864102aa85d3", "value": "12288:Jv8QmRhod3qb/HEKjpQ0ixnI2xcjcBJ82zfIhRkzVn5B4XnAIj3o2Np9IBg0L:ijoI/FjpQ3xI7QXQrkzCzj3TNn0L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705493239, "uuid": "a6267b49-a84d-4d75-b537-f80c76314ed1", "value": 654599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705493239, "uuid": "d83d97da-5eb1-4d78-969e-2542bba1cdc1", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705493239, "uuid": "58ae6a40-c6cd-4a2c-b1ac-27ca4764da2b", "value": "Payment Advice Note from 17.01.2024.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd46e3fc-b4dc-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705457065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705457065, "uuid": "ab6143c8-75f4-4b26-a937-72b9e103bd7e", "comment": "Malware payload (RedLineStealer)", "value": "5c64061fc61be18a3a0db12352c239ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705457065, "uuid": "bb1af7ee-9f01-4d70-86dd-cce1fe2d2bcc", "comment": "Malware payload (RedLineStealer)", "value": "3dc83aff2cf9f992aff84e7a8078578d30101e317509653d993afdb3058e5864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705457065, "uuid": "58802c23-1994-4cca-bb86-efb58e817c82", "comment": "Malware payload (RedLineStealer)", "value": "3505d6af91c145d114858a0b667aba9502aa480e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705457065, "uuid": "220d8bb1-9944-48ad-bfd1-541e49b830cb", "comment": "Malware payload (RedLineStealer)", "value": "e6d9371507325a6e803c628a01016b9bb8713acb98d2aafdd1d68edf054a4de684e49693beeeb4ae1f043ade9c3edd70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705457065, "uuid": "a0e3980e-6a8b-4721-b501-13d0f736b036", "value": "T11C94F11677D58795C66806F5C2E7593603F2A5832E73CE4D3E4486E20E42BE09FCA7E8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705457065, "uuid": "a7c7f5a8-a3e7-444b-8bc3-31d521af850d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705457065, "uuid": "21a52907-43af-44aa-a355-7017344ce784", "value": "12288:lZXYWVoH2ZfYvVT14Mgw1CU6ngy42fFVeFh/SDV:lZXYWw2qvVpknUHy42/ebCV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705457065, "uuid": "33a5d1e9-77e2-41e8-8c3d-1c3ce46a261f", "value": 422368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705457065, "uuid": "37bc9c86-4fa8-46f5-be9e-ce969447737a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705457065, "uuid": "528e1e23-0cbf-492c-ad37-8c6338fe8396", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a06d98fa-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705502114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502114, "uuid": "d8ba6f37-1a6f-47fa-b3be-010482f968fd", "comment": "Malware payload (AgentTesla)", "value": "15246f0bd4f9a349c8bbafc377627a3d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502114, "uuid": "8a407b66-40e1-4f8d-b7f6-d66a9308489f", "comment": "Malware payload (AgentTesla)", "value": "3dcc139c1a11646a7e6d78d89c1503f02e4a7f46d4331c8881bd68ae3fc22e39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502114, "uuid": "e8dc5519-9029-4b24-a7d1-1117895c779a", "comment": "Malware payload (AgentTesla)", "value": "5f6dbd7db9747bfc8862f854c388d5db1e8f44dd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502114, "uuid": "fb9cfc74-7cb9-426e-9d35-c9fb73cecd48", "comment": "Malware payload (AgentTesla)", "value": "ee8520a3261b0de91c03fb5e1d1ec1ff891a98e774d4b5a48c211dc8beb46503d855b99dafae6a9182d3e4d11589afc1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502114, "uuid": "ebf7f20b-a4cb-4c1e-9c61-1ba645ab14b9", "value": "T1FC037C0D7B9C6313C36C657E94E6B54513F8A3F36A23F3566D84116B1A83FD29906B03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502114, "uuid": "bfc74222-2df9-44f5-a56a-227fcef49258", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502114, "uuid": "2a2ec13e-9f35-4c06-8fb8-aa678188a35f", "value": "768:h+ZMvt2Ve0Wn9ldy4huxciaOo3rXDB7xjKn+230bqoBOPP:h++vtge0Yyo3Oo3rzB7dKnX3E8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502114, "uuid": "aed6502f-c377-4e01-b5ab-a2595fae890e", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502114, "uuid": "f0609fba-464a-4b0a-b2d2-71f987654372", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502114, "uuid": "33c14f14-28b3-4888-8ef3-50dba790d058", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65cb6be1-b555-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1705508887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508887, "uuid": "eea5e704-8124-4673-873d-44cf8d619d29", "comment": "Malware payload (GuLoader)", "value": "c7edf6f8590ba65efa9cc120ddca3c73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508887, "uuid": "cfac49cd-8c98-4596-87a6-2dea277241ec", "comment": "Malware payload (GuLoader)", "value": "3dcdcc384f2bdef132a219c4a1480ae1e55c24e2e0d25b777eeb2777c4af8e11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508887, "uuid": "5d64c344-6591-40cc-96dd-4edf3e1e9b02", "comment": "Malware payload (GuLoader)", "value": "f30e6e1b67996c9e5200ae7b5d416ba477b9dca6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508887, "uuid": "65cf0a19-e720-49d1-9789-bae5a812fe18", "comment": "Malware payload (GuLoader)", "value": "541305190600aa184dcdaade02c799dfcb678db7534f10f9521542dd02aee61e4d8a5d8e7e68c93c71bdb9ecb4e2ee6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508887, "uuid": "ab1eac4c-f75b-42ba-88b6-58e815d487ed", "value": "T1EC2633037E24FFA7C919D9320EB952C82653BE2121704D59FA693EAC3DB67475802B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508887, "uuid": "5d16669e-82b4-4a5d-a089-52c0a0e2e3c7", "value": "671f2a1f8aee14d336bab98fea93d734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508887, "uuid": "89a2e837-ce3d-4d97-8865-d25d4061c695", "value": "98304:BfAEHbwOGz5ytu/scOoYOQh3guj4GhPL2t:Bo6wOGz5ytwsRoYdNzj9A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508887, "uuid": "c8c94a33-f411-4088-a394-a309c60678cd", "value": 4544121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508887, "uuid": "1c4af8cf-d0f1-417e-9e14-4b54239bd3cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508887, "uuid": "e950571f-4bf4-45fd-a9ff-f39c256c7910", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bd365c3-b519-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705483101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483101, "uuid": "2f8cf40c-0726-4dc4-8288-af0c8fbcfc0b", "comment": "Malware payload (RiseProStealer)", "value": "bc94459e0220b2808a7c3c605ddefa88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483101, "uuid": "6855a0e5-17e9-4113-8b82-9b1c56aa41ed", "comment": "Malware payload (RiseProStealer)", "value": "3f08b59699faf7e6379d3210b928baccf90f88a951b3514e66df91934b2d6f4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483101, "uuid": "0a5c772e-0297-4720-930a-18e1eecb6c5b", "comment": "Malware payload (RiseProStealer)", "value": "39976ca1d79331e6b09a1b035e5172d5a5175014", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483101, "uuid": "b0c0365e-bf9f-4633-a1cc-7218d57ccb6c", "comment": "Malware payload (RiseProStealer)", "value": "8e1fa73135c73bd5f7b7abc1a52d790cd10c3e5b72035dd7b2cbfab79115da5fb89ecb93f98a75b4ac347309afa4b24c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483101, "uuid": "5edb019d-f110-4072-9bd7-09ee875b0086", "value": "T1BE9522F63AF58A4CD9C0A7FAD771D66402D62DE8DF269EF2D0AB540A7B632C01E05017", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483101, "uuid": "3d19e200-d16e-4fd8-8d7c-8a600f9048af", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483101, "uuid": "1555bea8-9c72-4b87-8401-3487d13727f2", "value": "49152:DeQVLlpkYrlOsRIhJ9nBT0a6BNntRbQpdhsk2:CCBp9rlOYIhJ9nBd6RyIk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705483101, "uuid": "5c897920-1d62-41f1-9922-5f0e4ac0535c", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705483101, "uuid": "c682f015-4740-4c54-ab86-52a2ac4eccce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483101, "uuid": "7f0aca5c-332a-4e3b-abeb-af5314d8e870", "value": "SecuriteInfo.com.Win32.TrojanX-gen.5728.27687", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb7199f-b52c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705491320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705491320, "uuid": "db68babb-e14c-4ff7-ab11-f3ec6f0c3373", "comment": "Malware payload (GCleaner)", "value": "10f27452a7c9dbd5dbf96558183fb55f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705491320, "uuid": "48be1daa-76c6-4bcc-8f3d-ed15a8902595", "comment": "Malware payload (GCleaner)", "value": "430e5b457a8150a336bd1a6159e777367e61363680ac944f2334a1ebff2f7e09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705491320, "uuid": "03032978-2d1e-4b42-b7ea-68e5508846f6", "comment": "Malware payload (GCleaner)", "value": "50168b81e270d502f2d529d83eaf7af157ee3c45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705491320, "uuid": "d4d88515-a34d-4b61-bb0d-b9ae3135f030", "comment": "Malware payload (GCleaner)", "value": "31ab026f9958ebf7690a7fcd11c3ab74069f32cf66715787cfcababe2f0b9d479a748743f5d92816b522b0e73a9aafdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705491320, "uuid": "c4959c71-0f97-4d18-8a0f-45f59b700a8f", "value": "T1F7641843B2A07C51EA364EB28E2ED3E8771EF5518E49776E2128EF1B14721B2D173B50", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705491320, "uuid": "49844023-d163-4430-98fb-2640ba916144", "value": "477c561da1a6142caf88bf151467e274", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705491320, "uuid": "453bae79-07fb-42e9-aa2e-e0b9e15740a7", "value": "6144:HMULEMbEBPn9HBtwOExJAG+nf+mr8XdTBP:xAyEBVBt9EtG+MqpJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705491320, "uuid": "2b7e46aa-5533-4bb5-b82e-95cd6e5dde87", "value": 316416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705491320, "uuid": "e4bbda25-2974-47b6-8a9b-b445f0f481cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705491320, "uuid": "df8a48cb-808c-45e3-9b7e-da1086df1d3b", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d772a5-b56e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705519516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519516, "uuid": "5f18e325-059b-4d4a-ae5a-7b0fad2458be", "comment": "Malware payload", "value": "0af0403435aa81cb0066833a493bb2bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519516, "uuid": "d3ca2c26-f276-49d9-a2c8-3e93f08dc44b", "comment": "Malware payload", "value": "4419415dffa5c427d65cf8d0367d07303c5d932823fdf6c62f60929d6d35eb72", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519516, "uuid": "1d15cca9-b38d-4e43-897d-2276c38f8753", "comment": "Malware payload", "value": "bbe32b64576652959d511ebb91ab8078a2481c0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519516, "uuid": "f9e46864-d68b-4f33-8e11-18cffc812472", "comment": "Malware payload", "value": "6c55f6e0924591b70cf5cf95674ed5729abadc326184e5bb8ed67cd21b2ca9bb067adadfb2d7bede9346c29724dd1b6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519516, "uuid": "52fa48cf-a3a4-448c-993f-5ff99022daef", "value": "T15FC40291B3E98617DDAA17B405A25DD043B1D6122663DFDD5CAC279F2BA33404E03B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519516, "uuid": "00fc9eea-4916-431a-b18c-094a6a441cbb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519516, "uuid": "743a637f-831a-4cbd-8e2d-ed876119c2ce", "value": "12288:Oz/mbW5bWKISUKyDXlzeJSBjpfMkwwfwD52n:+ubW5bWKIFLX5ewC52n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705519516, "uuid": "bffbeb03-02ec-401e-ae42-25c01652dbff", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705519516, "uuid": "645689d1-6460-4ff4-bbfb-133839c019eb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519516, "uuid": "9fb22608-6eeb-4e44-8762-fd3b288caf26", "value": "SecuriteInfo.com.Trojan.DownLoader46.33731.126.1178", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a8e4567-b520-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705486078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486078, "uuid": "7b17cdb0-e71c-4bce-8b30-ce81dc0edf5b", "comment": "Malware payload (Socks5Systemz)", "value": "3b28f0993bffc88401414218d443af7c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486078, "uuid": "e74a632a-5145-4264-828b-5c671d9db6cd", "comment": "Malware payload (Socks5Systemz)", "value": "4681dc1aa40cca6a2ae8afba33654149d2946eeba6bbcb07f1e689df33c72283", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486078, "uuid": "f7795406-7e09-4631-a369-a39e6f8837d1", "comment": "Malware payload (Socks5Systemz)", "value": "9ca6cbb9e7aeee3b76dcf01575a0b107f84ff2cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486078, "uuid": "e4fcf06b-c84d-4e8d-ab31-84c0bef7c160", "comment": "Malware payload (Socks5Systemz)", "value": "dc3ab48e107872d87e7ee0800e871e2a17100751be63185387536a7203326bee1d09e8a5c5fd6d2f1f43c8017bc454e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486078, "uuid": "ee1b2cce-7a51-4484-acea-cfcd3957af57", "value": "T19D5633A15D2005B6C8D1AF704E529C437A767C603029768E780B851ABBE7C37FFDE692", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486078, "uuid": "17342dee-91a7-49a8-af7a-bfbf059cf6b4", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486078, "uuid": "ec0bb8a5-e63b-4d84-9d8a-b988b535acba", "value": "98304:N/cwsQwFwj7Vcs7tfkOv1oFeA50kMenum8tv/I8g9y8FI66X7jWPxJgma+d358:ZZmKBn7tfxvWFfuenx89/pF6+KpJ8+k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705486078, "uuid": "76933d55-27d2-4293-960a-c2a79e87c3fc", "value": 6416610, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705486078, "uuid": "9fd77b2b-54e2-4dcb-90bd-f55c1e16ea28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486078, "uuid": "b99d3e2c-1422-43de-9a4d-ebed6f46f390", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7828f26e-b50b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705477136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477136, "uuid": "508e4760-9e0e-4529-9b55-928b69a54821", "comment": "Malware payload (Formbook)", "value": "3ac9fbfb164de0492d9f177d608989bf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477136, "uuid": "54ec7bbb-3dcb-4cc9-a161-6623a7b9530f", "comment": "Malware payload (Formbook)", "value": "46b67ebc0ed5ee0927ef4eb647218b7a78c49cc9a19f0fca652ccd6f8f208bcc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477136, "uuid": "956ef9b1-9855-4ffc-a174-35b617eaf2d5", "comment": "Malware payload (Formbook)", "value": "dd02d53f622c370e5fb0c97bcb721871d151a3ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477136, "uuid": "2b3c2666-408a-419b-8ab2-31f0aa833a2f", "comment": "Malware payload (Formbook)", "value": "47b2add10150f8b54342160d73f2ccc0a855136eaf47b3a68e54e2556fc60d47e8b99aaa0778c916926b0eece5359d65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477136, "uuid": "abf54070-115e-4223-9375-9ae25586140a", "value": "T1F692F85C6EED9A33D5BB8A3085F241D3BAB0760337216D2F28E414951D13BC91D92EBE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477136, "uuid": "c653425e-365e-4ebc-ba56-b2ea8859d14f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477136, "uuid": "96c669d1-009b-4d84-9014-83728b7d12b2", "value": "384:3RL/REhw8W4T8iIshpKhkWoTaLQwKV58wWEYOGoGCJEF8ZpHDc4bF:3NRQw8fssKhkWE/58/uEFiRDt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705477136, "uuid": "ce4bbfda-239b-4d7a-a91e-18ce25049563", "value": 20376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705477136, "uuid": "59b3750f-b9ba-445f-9f3f-c3259162c077", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477136, "uuid": "5bb47897-64a2-46a7-b169-1ba03147db9d", "value": "SOA MAY-NOV 23.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280c5f00-b551-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705507066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705507066, "uuid": "e74d9633-149f-4cff-96d4-792255aef442", "comment": "Malware payload", "value": "27b6f3b8e8bdce591e5164edba28584d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705507066, "uuid": "af6d0511-c2ee-4951-be3e-cd0707f068d1", "comment": "Malware payload", "value": "46d06d06984466e0e8082f8bba8d274c37145ec71f26da0904dd93ea2e7f3087", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705507066, "uuid": "bc940e90-dc3c-4f4c-a1f6-5ea17e28dc7f", "comment": "Malware payload", "value": "3a150c9db17a94feddec8268073336d030b97dad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705507066, "uuid": "8db84a22-3b25-4880-86ce-5fb5da85d964", "comment": "Malware payload", "value": "bbf528cce2e4dc6798df7e4e4ceda4dd73899e96b8dd71234de917f2ab4cafca944fb46b76a49b997cd043924f2f43da", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705507066, "uuid": "deec1a7d-c507-4117-9ebc-76e769c184ac", "value": "T104066C23F345A43BD0671A3A987793A0983FBB316956AC577EF41C4C4F39A81293B607", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705507066, "uuid": "7ae2dc1c-dddd-4ec0-bedd-18ce8ae4fc24", "value": "d616587ce45db3428d976ab19d1f3438", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705507066, "uuid": "8a356f91-cba5-4115-bc65-73ac8f9e27d2", "value": "49152:QDdgK6jyazbFza8IBn2cpi7cSgWVh07Z2GBc024xF6QKRTTzLAUd+JOugbW:+OK62azbMB2kZ2rUF6QKR3Vd+JAb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705507066, "uuid": "99999b5e-0be1-4451-9b15-fa94726a8252", "value": 3955760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705507066, "uuid": "33499174-8c88-4dad-9502-c158854e901c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705507066, "uuid": "fc526bd3-5975-483b-8efb-ce28751897e4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7efdbc6f-b542-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705500769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705500769, "uuid": "fde6c231-d57e-4a21-8f8e-bdf6ce8d400d", "comment": "Malware payload (Formbook)", "value": "ea4d51289540e3f418cff48fc0f8396e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705500769, "uuid": "dd95c6eb-2840-4a2d-8625-8b7d0842216b", "comment": "Malware payload (Formbook)", "value": "47a05b7efdfad238172f1e804fb8a681b88281fae68e9a6efabe9b175c1572f7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705500769, "uuid": "5d22b29f-59bb-4c5e-8751-e0451f38974e", "comment": "Malware payload (Formbook)", "value": "0a753425bd0b51897295ad85af3be6713f3c4cd7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705500769, "uuid": "f2132cf1-ee39-4d7d-949b-c50519f3468c", "comment": "Malware payload (Formbook)", "value": "fcfa20362d76cf0f58d1e57d4bce33b1a047ae410d9c88d8f2236dca24f5a005503ee0eaa5022024a51dc2adf0c8c1eb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705500769, "uuid": "d4178323-b440-4eac-9a3e-838534768468", "value": "T148F40245B3A04BABD567477048D3A77E7476EE392A03CB1316843E6E2C317F12962DB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705500769, "uuid": "42b9714b-ad0d-4b48-9e92-c55bcec6f062", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705500769, "uuid": "e9a2a3f3-03bf-47e3-a4c1-68862356120f", "value": "12288:ybSh1Au/reSjYYp3w1l3zO07iZBo7ZjqxE7iMK7x/n5HbbvC1pAFofnA9zEGG9Qj:ybS3Au/reSsYp3wasiro7tq4a/n1C1qL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705500769, "uuid": "107ede96-1b1f-4711-8bd0-de4582ca9587", "value": 757128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705500769, "uuid": "b207ca94-22e3-4dce-b16e-22b22a52f03c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705500769, "uuid": "f4e41a56-3c05-4909-a2b9-71c3839e9daa", "value": "Adobe-Reader-v8.0-latest-installer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6c846e-b4d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705452774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452774, "uuid": "8ffddc6d-2a5b-4ef0-8d3b-7ca5e3c23389", "comment": "Malware payload", "value": "ffb72f98676269aeb972299b91a2d26c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452774, "uuid": "c319aef6-3970-40ca-b79c-1fb10915eba3", "comment": "Malware payload", "value": "4ae91b898d4a5dd1299f140b4d4a0a4a4b127f46a3e34ce2031df50824019b4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452774, "uuid": "0c0859aa-0107-4fa2-9b75-10932e1dbeb6", "comment": "Malware payload", "value": "7be406f6b6988eddab1a595c72359fd48ac642e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452774, "uuid": "d1fec70d-1bed-4b0d-ac17-4a7d4ebf2c58", "comment": "Malware payload", "value": "27a7e867dc8124e1cf36caf5eab6f86d8ec465cdc29f38f19e78f93287056b7e97bdd2b89c35d591f7bdf32f527f98e2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452774, "uuid": "7ad8940c-0044-47d4-96eb-8e57c3045fa8", "value": "T1F2D68D07FD9554D9C0A9D530C9A342A77A31BC041B376BDB2A54B3383EB6BD8AE79340", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452774, "uuid": "9e6e77db-4b0f-4d88-8056-310d7a85ca55", "value": "0e7a5b474e1fad7747d6a9464be0e2b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452774, "uuid": "6d129360-bf62-420f-86bd-515ec5b0a071", "value": "196608:UK8p3hcRMb4oYI4XH3nXHqXctS7PACX0/zqAfhZLTXCjw:UK8phcRTs7ICXYqA5ZLTXCjw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705452774, "uuid": "d1853bd1-cb27-4c07-8d20-226308dc240d", "value": 13552932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705452774, "uuid": "b0cdd1f5-e0b5-4bb9-a6a9-eb1784c8bf14", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452774, "uuid": "2f1828a1-b7ef-4afc-af43-ba0614929741", "value": "SecuriteInfo.com.Trojan-PSW.Agent.22802.21075", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b99a27e5-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (UACModuleSmokeLoader)", "timestamp": 1705502156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502156, "uuid": "5622f42c-01c6-4db8-aac0-1d54a3270f9f", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "5124bf85c42044091d0cb30d9e58ae22", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502156, "uuid": "416c636a-5385-415c-afb7-4e61d1e7346f", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "4b29c2b29a00d8186de68b21df1b5d8aafcaf42850b52e07aad7cac7ad762953", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502156, "uuid": "6da07aff-9fd9-4a16-8d52-0675930d23c8", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "034d7ee2ca6697ea64ef31ab3cf844022bdaed52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502156, "uuid": "73be477a-09c3-4c59-b1f5-c02ba52d38ca", "comment": "Malware payload (UACModuleSmokeLoader)", "value": "b695ed19da14334220df06e9fe4531dd9943cea8d6c69cbedd05e0f7348e0a6fae130bc3c677cfc09bb58c60d7dc0afa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "UACModuleSmokeLoader", "colour": "#8170F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502156, "uuid": "0fba4276-0548-4bbb-a6b5-f445b7f57e24", "value": "T148C4BF4393E17C41EA368A72DFAFD2E8764EF6608E093B696518AF1F1474072C16FB14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502156, "uuid": "4a0768fe-2d34-41ed-9a5e-3afa66fb12b6", "value": "71b0f0cb2cb6c557a1ff35b75a3ccbcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502156, "uuid": "66a4c7ab-9b4c-46d9-a8db-01156621c7c5", "value": "12288:/cpt/W4qSZUFe8B7Woh0QhICmaCxmnvTiARd9yjEAOrL+0LGrOD:ETO4qSZfaZJvV4jEHnzL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502156, "uuid": "5f155e72-9ac0-4efd-8e12-419d3ac7a03a", "value": 588800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502156, "uuid": "fbd7dbb9-680d-4c49-aaa1-85947c78e785", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502156, "uuid": "a643862a-3bc3-4a1d-910f-9d88f8d5c118", "value": "5124bf85c42044091d0cb30d9e58ae22", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e82ba3-b51c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705484515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484515, "uuid": "f0c8b571-a196-496e-bc77-d7b5befbc649", "comment": "Malware payload (Formbook)", "value": "050adcf786c8914f5d0690daae6af655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484515, "uuid": "dff318f5-2bce-4968-9177-7e3c51607a3c", "comment": "Malware payload (Formbook)", "value": "4e097257864c0549bebc86d9d7438b660c12d745e53d6fad6ef5dad4075bd90f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484515, "uuid": "d65a8cb9-c75f-4f45-8792-99b0c9456c58", "comment": "Malware payload (Formbook)", "value": "726ed08042d380fa80eccbc885eecaf0149c0ca8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484515, "uuid": "6181c26a-b5d5-40a8-b87c-d483b1416ebf", "comment": "Malware payload (Formbook)", "value": "244293016ebb32f90565680e877b47566d437e1b4a614ee6fac83e1d1caffea9186e34f2464feef2c8b93e98769c8f5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484515, "uuid": "f71f4f65-a35f-423d-a708-32cff73d96a3", "value": "T1AF92185C7FECCA23D9BB8430C5F343A2BA70721366215E1F24E819992D13BD51D52EAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484515, "uuid": "530de7e6-6039-468c-be48-9cf0c071a8b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484515, "uuid": "be2eb23a-4ad6-45de-b396-cf4159c51833", "value": "384:KRL/RE4QOBnk6JEURxg9+0KrL5LCTGoGCJEF8ZpH5Zibg:KNR/QfgRxP1VOnEFiRHibg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705484515, "uuid": "b99ef2f4-3799-4c79-8e4d-28fe8bc144f4", "value": 19864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705484515, "uuid": "f73754e3-38bb-47a0-8b8c-20eb5b6f2d24", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484515, "uuid": "a0e837f4-3da1-4d57-931a-88b6b9bdcbe0", "value": "Order #45-09SDS576.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68de6506-b53b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kuiper)", "timestamp": 1705497726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497726, "uuid": "a73bf899-4a02-4b20-92fc-a208bf49b6f8", "comment": "Malware payload (Kuiper)", "value": "56cabcf95add39a6feb09391ccc40dcd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionC", "colour": "#D4039E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497726, "uuid": "a1565635-0441-4107-9028-147ec11edfd8", "comment": "Malware payload (Kuiper)", "value": "4e153342189a55ffed34a91f2a3f4440af1acbf7dc58135a165a06b4e657556a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionC", "colour": "#D4039E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497726, "uuid": "b85292fe-c5f7-4d66-8ded-55ddb81fd339", "comment": "Malware payload (Kuiper)", "value": "84c8921f18a6d7861e842e4edb9c0c96142b5f75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionC", "colour": "#D4039E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497726, "uuid": "cc55c645-5e13-4199-adfd-fbc1bb38334c", "comment": "Malware payload (Kuiper)", "value": "24e9c9c935e3625ceb7e82f03090b2b57cc0f6cfc9bfe85d61297af66aca3df4ea9c8d236aa4927bafab86d131a8d11a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionC", "colour": "#D4039E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497726, "uuid": "10498fd8-4308-447a-9e5f-a71bbd43af10", "value": "T19DB52A51FECB90B6E5031E3144ABA2AF5B356D094F31EB87EA107F1AED37691193620C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497726, "uuid": "94477b90-e965-4863-99d9-55506707e4c9", "value": "49152:mNGaixLBzuog6dUWed4u0HPH94C05PxgeZq1:mN1idhu6dUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705497726, "uuid": "fbd883e8-68b1-46cc-9b69-397790a203ee", "value": 2314240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705497726, "uuid": "b776e1e3-00bf-400d-934d-d021b4e5187c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497726, "uuid": "b714a83e-969c-4e35-b3af-b1d5277a60b1", "value": "C.Linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dd78660-b544-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705501680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501680, "uuid": "c8c9c9ff-86cb-4c3f-8126-a36dc4fea7c9", "comment": "Malware payload (AgentTesla)", "value": "0e9365d2d09e90105be80bf19ce6910d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501680, "uuid": "e92dd0ba-e2c1-40a4-ab13-30cfe39a4eb8", "comment": "Malware payload (AgentTesla)", "value": "4ee9ecf9c52b7077900ff2c7f8967f137935be21601cc4b4fba700b11f420cb3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501680, "uuid": "db826ad9-d0ba-40f5-8ce3-9f96edc9ad09", "comment": "Malware payload (AgentTesla)", "value": "4591dc2b7c9d003329e14ca71038a43ec09db61f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501680, "uuid": "f13dda2d-ff39-4e5e-a747-8d0aa781d0db", "comment": "Malware payload (AgentTesla)", "value": "dd74c5f4c8bb995d27082b77a166a0a6969da3824ce60f6d5b8bf771ddf519501472bd956f7469c14ebe35bef947908d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501680, "uuid": "c8418436-af7b-475a-b6d5-affedf45017a", "value": "T16CF4122AB7E6DC62C3ED2A36D1D754284331C9466573C34A3DDE632605037EB2E2639B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501680, "uuid": "1d2ff9ba-4f77-456e-85f0-c0bb187b58cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501680, "uuid": "99202875-7fb4-4f8f-b5cf-15ab44c1a86d", "value": "12288:Jo+J6Sv2iNhJz/IIHF3fKqH36glTOr3G81RBwp3r1cWl6M80az3JQMd0y0/IEg0N:JoxSv1HJz/IIHFv9HZ239SbB6M8rsQFa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501680, "uuid": "93d3c564-6260-4304-b2ba-b0e901b3a1d6", "value": 761344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501680, "uuid": "185656bf-28be-4f04-87fa-a5608ae8ec6b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501680, "uuid": "8f953cc5-be13-44b7-a9c1-ef6bf862cea8", "value": "rORDERENQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bb94ced-b55e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705512682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705512682, "uuid": "8ada21f6-d802-4dd5-9fbb-ee2ab19fefd3", "comment": "Malware payload (AgentTesla)", "value": "fc100ba1a33c46efbb371a0733087ddb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705512682, "uuid": "670794ca-37b7-4047-acf1-5fef4572028e", "comment": "Malware payload (AgentTesla)", "value": "529119370421ca0a83e5d217440610015f5a68405d4ac3af788056f3059bba50", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705512682, "uuid": "28841a7b-9c99-4554-912a-25616afd7e4d", "comment": "Malware payload (AgentTesla)", "value": "bc129d5fd71d23320e4d11cb5c17e5b403683cbf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705512682, "uuid": "cffd06fa-6925-474a-b62a-f076adbd0957", "comment": "Malware payload (AgentTesla)", "value": "ff919477aad1ff278661e3ba22f8340e24f1fb3e7061539e83e5208aaa239818f514f9aeb8f56169485da08c60ec4052", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705512682, "uuid": "ba3e567d-64e8-4b23-95c1-693650d9538c", "value": "T18AE42242B7984A71FC6E17F8D4AB111123F1EC2A5833E30D4EE6B4BA29F33960952757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705512682, "uuid": "ff1b2381-c135-4532-8948-fb2900acd6a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705512682, "uuid": "5070df1b-dc28-4576-b941-ec163e925174", "value": "12288:QST5BWePFLVoq3FmQwJBck0zVZy6orrv3juunLw3zGjLnIzVhGL8QP2QvJ0lLnV:h0ePRVoMFMJ2PHyRRnLtvchG/v2lLV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705512682, "uuid": "7a2bb4c3-f1bc-49bf-85ed-417dc5e11bf2", "value": 715264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705512682, "uuid": "a4a59194-6af7-41db-83d2-10034aafa527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705512682, "uuid": "807aad60-6081-450e-9138-b2d4ebe27d17", "value": "SecuriteInfo.com.Win32.MalwareX-gen.20318.13977", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c195f79a-b4d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705452777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452777, "uuid": "f56e253f-93e0-4835-a685-8f0661d6f56f", "comment": "Malware payload (RiseProStealer)", "value": "221958f2bb0be630db8d58f583a537f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452777, "uuid": "449b7f17-c064-4315-990f-a9c81c988ad9", "comment": "Malware payload (RiseProStealer)", "value": "55b54c798b60398f1b0390619911a38f3af7f6059c12fb12bff6b167174a277e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452777, "uuid": "fd88de38-bec3-4343-a4c8-76ce41fe043f", "comment": "Malware payload (RiseProStealer)", "value": "586687abcfe595cc1519ee4f326a9f2e228fcec1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452777, "uuid": "1bebfd36-c63e-473a-90ad-6f83a8f786cc", "comment": "Malware payload (RiseProStealer)", "value": "f4ab4c1862c82afb5325c1900b838b9827db2509f2c15d19ba638800ea646261663dd573e364ef00735bcc6cefa14867", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452777, "uuid": "2fcd78b9-a7b7-4e25-a66e-97b4b8eec4b9", "value": "T1519523F135FC590ED8E61BF04770EA2903E04CD5DF525EDEC0A706AA3B172C5AA6225B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452777, "uuid": "3aff5a51-a891-42b3-a341-b814a0b3a1d7", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452777, "uuid": "15d905df-27fd-46ad-9c36-d22b2fc786fe", "value": "24576:5U3xBlNwcXlwzGWvkQbpRfRjCLKgUbTdjLo7KEhum0WADFCxl+ZYUv8H/lhSeCkS:i3XktzGxETlGkDFC/+Z18t1CkKodRQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705452777, "uuid": "a1188c5c-60be-4af5-b1b5-d5845e0678e2", "value": 1877504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705452777, "uuid": "54c00414-862e-4aed-b60f-a7e53f90ee26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452777, "uuid": "10f82f41-a6d6-4985-aa7a-bd64c4eb0e67", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26359.516", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e5ea566-b53e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705499050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499050, "uuid": "6c5f5e8b-0c8e-4d7c-a7d3-f1342f68b57f", "comment": "Malware payload", "value": "5d5186bf203e43181dd6bbd4ae040bce", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499050, "uuid": "d63586c7-2780-4486-b736-30c8f562dc61", "comment": "Malware payload", "value": "569534849e76a187676e2a61fd05322ec99df1414023e4ad8e4193acee1fd01f", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499050, "uuid": "050d5c1d-dfe0-4522-9cb3-177d086e8067", "comment": "Malware payload", "value": "2fd97ec14a799e719f3f2ad4ca06b7d09816ab08", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499050, "uuid": "af09c085-f799-4936-aa01-76abb16f1e6e", "comment": "Malware payload", "value": "68d9fd8ad4ba43a23eef04cabdb06b52be07026bc43779989ce584590666fd0a9ee5de9576ead7ad244a647be98f2641", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705499050, "uuid": "cd9e15b8-cd99-4849-a952-af6c1ee6ea56", "value": "T198F733FD7BDE3C177832ED5CE506A99C6D98A0B0BFBDD729022D94605D86DC203A522C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705499050, "uuid": "ba5b120b-802c-4035-ab52-aa1c3307047a", "value": "1572864:W+hOLc6W/7gAk+YXOaFD+XkSNtR0dpW0KxEp0bss4wZKTJ:HhOLc6hOj+6U0+dpWPOp0h4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705499050, "uuid": "fadcf50c-c314-42b5-a0b1-4fbd957833cd", "value": 74942210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705499050, "uuid": "c641ac19-6c87-4f2b-9421-fd75835a4714", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705499050, "uuid": "2eb554dd-938b-4cf2-b8f3-073cdc231687", "value": "PlanetsBeta.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0d1b2fb-b4d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705452776, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452776, "uuid": "6c28106f-c117-4e5e-a616-3558d0c83302", "comment": "Malware payload (RiseProStealer)", "value": "9af4b5782dd2c11e9b5ac22f4d8c19b8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452776, "uuid": "f8c856c6-aa9a-4469-8c37-624eeae412f9", "comment": "Malware payload (RiseProStealer)", "value": "56e5c4d7a6090663702fe3ba31901683aaa7fc350f6e01416ab9fb00e8971a43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452776, "uuid": "fe95adb4-7189-4804-a592-b4e2322be5ea", "comment": "Malware payload (RiseProStealer)", "value": "d3aa43472a67bd853e35aedc5772949d2ba5e3ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452776, "uuid": "31732c04-e96b-489a-b968-7d75333ab362", "comment": "Malware payload (RiseProStealer)", "value": "69ca7695dcefed72965f38501d8a831e61bf3a3a4a6e7d063a971c9d392802007bf2edebd06786aadb62bcf690c4753f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452776, "uuid": "e40da6a7-5ba6-4b45-a086-cb0c5dfad135", "value": "T1239523F036FCB98EF6D653F743B9A61051C0ADC9CF414EE6C5A3482A374B4C58A82697", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452776, "uuid": "8c545c67-88cc-4fa2-9f71-da61183718af", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452776, "uuid": "adf6b862-8537-42c4-8217-a577e5cb524e", "value": "49152:B36zCx5CO2HVg0w4rXGAPOgoHBXAQBLSsDSqz:BKznB1/AUOgoRv9DT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705452776, "uuid": "007f396f-381b-4d97-b370-f94ec1dc1565", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705452776, "uuid": "4b19abf5-ff49-4987-a5c5-47891b582224", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452776, "uuid": "6dd49801-5939-4dee-898d-4dc7ebad33db", "value": "SecuriteInfo.com.Win32.TrojanX-gen.4604.6726", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d31e218-b51d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705484714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484714, "uuid": "aa3ecc59-7ffe-46b6-b5bf-3e49b85f6052", "comment": "Malware payload (AgentTesla)", "value": "42087a55f15769fedae2b1ab4cb463df", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484714, "uuid": "59d574c4-5259-4d8d-8029-fb2bfd4835d2", "comment": "Malware payload (AgentTesla)", "value": "57bf60dae149215611af79b1ebeb1cfdd1d3a73d32e48035894971eb4a69566d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484714, "uuid": "1a632226-0305-4ec5-b692-21a06d84f08e", "comment": "Malware payload (AgentTesla)", "value": "0f3ed728fbdaccc26e781489f8f9df2ae76dc8a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484714, "uuid": "ef102681-8ab4-492d-b61b-b288c8714086", "comment": "Malware payload (AgentTesla)", "value": "5f159cb39a1c4f27cb1b7b5d3a8b0b15b7484b8b2296ab7e6618bdb44b440896aa3d1f06496a5a3500caec97a3b346fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484714, "uuid": "0dc767c3-7e54-4872-b501-cff3d5349560", "value": "T199E4122673B6DE12C39F263BC1C750280334DA425163DB0A3DCABB5659173E72D4ABCA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484714, "uuid": "3dba745f-878a-4555-808e-dad568d21440", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484714, "uuid": "785d648e-9425-4197-9a13-ff0a2ed91e63", "value": "12288:40w43uJTzk2iNhJz/IIHF3fKqH1AzjtyP34N6jnrBUQ3qacrEe81ZpOZVx2ah7yu:R3uJTzk1HJz/IIHFv9H4tyf4NGBZ2Eer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705484714, "uuid": "7cfdfb60-99ec-4083-acfb-7198dfbbbbc2", "value": 707072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705484714, "uuid": "09eb2568-5e67-45ff-b7b0-cb481c760201", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484714, "uuid": "f0bdf4da-bebf-4766-94bc-6dfbc5dd0f7d", "value": "TT Swift Copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd8aa850-b4f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705468662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468662, "uuid": "f234ddb0-01e0-4ab3-b1f2-d464e9a50c46", "comment": "Malware payload (RiseProStealer)", "value": "64af46ba64192c9104e70202971a714d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468662, "uuid": "7d0b6cf9-7273-4bf1-9264-ef152dea3ee1", "comment": "Malware payload (RiseProStealer)", "value": "58a13eb25febc6bff201c61222bd31752a4cb71f0a5af0bcc38c5a5f303e99ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468662, "uuid": "1845bb11-9f4e-462d-bd24-1af2c7349c8b", "comment": "Malware payload (RiseProStealer)", "value": "c6b4e94c1e4376e936a1ddf300fb3bb6eca705cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468662, "uuid": "957aac28-adc3-4e96-a6fd-b6b36c564fd4", "comment": "Malware payload (RiseProStealer)", "value": "d9ca0f8052b7d4be1174601b457eb973a3eda60a8a6e695bd176816d776af7745dd47eb7d224ce9e1e24371a0c82c9b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468662, "uuid": "057b5448-1f14-49d1-87cb-86c4b1cc1023", "value": "T1499523F93BF9528ED5C4A7F10372A6706AD46DE2CF158EE2D4E3452AB3871C08E1A147", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468662, "uuid": "4b11a6cb-6a1e-4c8d-9fa2-fc070f2e5f9a", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468662, "uuid": "c3fa37bf-ed37-4f44-a03e-77afa269e6d5", "value": "49152:yBguTNbCdpRIhtjWC1Nw516OI1TBll095:ymuJORAtl1+5pI1TBlM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705468662, "uuid": "48530440-3002-483d-9bd4-a5ed92666f4b", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705468662, "uuid": "ac25aded-e930-4e0e-b148-27808056cfb5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468662, "uuid": "13e36907-12ef-4059-af5f-0fd5fa839dcc", "value": "SecuriteInfo.com.Win32.TrojanX-gen.1714.4025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b25a882d-b508-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705475945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705475945, "uuid": "500985cd-b367-42cf-aea9-d0ad59905ce4", "comment": "Malware payload (RiseProStealer)", "value": "52ef39bf1d879c6137a1ebc7db3a81e2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705475945, "uuid": "0269bb1d-cb81-43e0-9850-6f9e60248097", "comment": "Malware payload (RiseProStealer)", "value": "598e27557648ec2360a73e9a0522082adc52ea5bd1f3baa9fd3f3f897a2e0506", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705475945, "uuid": "abd37adc-140b-4adc-a162-d63aa7551f8f", "comment": "Malware payload (RiseProStealer)", "value": "8f91c670328e6c0b335fcfa4504af79b7844648e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705475945, "uuid": "562bd047-4f15-44fb-b5ae-02f0c5ded9b6", "comment": "Malware payload (RiseProStealer)", "value": "d6c3b261033b5eb9c46bfe55a99dc277e83472051d017034cf0eaba2f3ae6b3800ff961864775cd1e004ea68b27ae347", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705475945, "uuid": "241acad0-7ac3-4183-a105-ce652cb253d2", "value": "T1B39522F573F84A0CC5E253F64B31D22267D04ECACF624FEAD6A7A196731B0C45A6601B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705475945, "uuid": "9acc3c52-4ce5-4f0c-8299-5facae89baf6", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705475945, "uuid": "5047cf30-dbeb-4c7c-9975-a1a0b1841e34", "value": "49152:sGc2kxXmpJCRplFyxn2/ZmzfufzozZhFTfnJO0:slhUCRp6hzUzwfnJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705475945, "uuid": "9a1aa385-f783-4871-9dde-28ca554f6cb3", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705475945, "uuid": "c994ee2c-94e7-40ad-8727-00652548fd09", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705475945, "uuid": "cb36c774-2266-4fb3-a81c-558c563ef046", "value": "SecuriteInfo.com.Win32.TrojanX-gen.26081.3725", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8730f252-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705502072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502072, "uuid": "9bf05740-373a-4d42-822b-24fc4e820200", "comment": "Malware payload (AZORult)", "value": "541b03ee03c86fb9898a7b9a3fce1877", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502072, "uuid": "aedadafe-0cef-4ea3-b9b7-76a91202f8bb", "comment": "Malware payload (AZORult)", "value": "5aa549f5aff79d452ec5e187221176ef09baeef818c490b4bbc3793c5cb7298c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502072, "uuid": "22daf65c-db12-4e25-acf2-f084d39ae126", "comment": "Malware payload (AZORult)", "value": "8e00390087cd5bca52e1b5d25115560b60e9ba85", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502072, "uuid": "1bd6a288-5859-4740-95ea-c11d10ceb1f3", "comment": "Malware payload (AZORult)", "value": "c3439928f63bd90d49d83bd16405adbbdcc43999ebfbc94d6ff1c538949736d2ec73ffadb825d4a987a2e1d581205021", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502072, "uuid": "f0e83502-edfd-4323-a91b-965fdff8424b", "value": "T1F7A412265B72D9A7F85189B5C9DAD73E8775ED414388BB07BF802A1AFC234A34F1D012", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502072, "uuid": "e467d43c-166a-4bcd-8e1f-af23da5b7f94", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502072, "uuid": "3927d2c5-4aa5-4aca-ba52-f37a6e97dbb6", "value": "12288:ZHuGxNa/9j1oggP15skZQ+uwypDxfXikgqKeS:ZH9N4pVksg7XYDlykge", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502072, "uuid": "b6cc95fe-b658-40f1-a419-a263154258dd", "value": 477272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502072, "uuid": "bfe1e6e3-d74c-4044-8e5a-4517827fc0a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502072, "uuid": "35f1dbf6-edc2-4bb1-a553-311b27199e50", "value": "New order#109907.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bec2e3-b521-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705486681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486681, "uuid": "354b8f28-d16c-4b4a-8e8d-8e851a33456e", "comment": "Malware payload", "value": "05456e53df2b70291cd6ec44e9bebd04", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486681, "uuid": "e756f934-1f81-4aee-bc15-6390c9a54eff", "comment": "Malware payload", "value": "5ad873cd5ef94414bd3faacae839c3dd9097201ada963cdf15f0d52481129f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486681, "uuid": "1b3b191d-8cdc-4ff0-a08c-91bf90f57e98", "comment": "Malware payload", "value": "fca29a6cf87ce70c960c024f7d3077278c993b8b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486681, "uuid": "bdfbb058-abd4-4bda-acf9-5ab85dc62894", "comment": "Malware payload", "value": "7182b19fc25339b2cdbd479c8a3da8b5239b54f2828aca9fcff2c115f8bfb654a5528e97b76fc7997667f1c70f746db8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486681, "uuid": "cc0cf5f2-2f44-4a4a-a6d7-ea01eb2b20a3", "value": "T11A553383780DED6BF7350D760884F794B6F027B374EA0DD5BA846449B7825ABAD12CE0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486681, "uuid": "fa32127c-74e9-4e20-9d9e-4d0d82a28b91", "value": "fc5d3d653af3c3decf6e755f0007c4f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486681, "uuid": "e46b4ed6-122f-4724-bd54-cda55bb769a4", "value": "24576:4qzcat1YsPxy/QqUPVQPBKQTGSL06WBhvOoCkN6G:4qz11YsPk/QqWVQcQySIpZOBK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705486681, "uuid": "91232c0e-76af-403c-92b2-cb75b6b1670b", "value": 1391616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705486681, "uuid": "b3886880-41a9-4543-92d9-c0de0d96641a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486681, "uuid": "e618ff6c-93b4-4afa-8a97-2c9d3147d184", "value": "SecuriteInfo.com.Win32.PWSX-gen.8984.3407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32338f9d-b517-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705482172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482172, "uuid": "9ecb77fb-229b-4af4-854d-46d4963515d6", "comment": "Malware payload", "value": "2dde3abecfdfa818f50286639acde440", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482172, "uuid": "5ffea073-ea68-47ff-b672-31d3eb9ab3b3", "comment": "Malware payload", "value": "5fa4fce40c56a9075896b80d7c77c69858deb2fe7ba1367f4476bd7964aff516", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482172, "uuid": "0955b097-c2e1-4457-82e9-80aecf7fcf0a", "comment": "Malware payload", "value": "1a51cba5239f2582c891b2d898586806dd7816c6", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482172, "uuid": "8a897c90-bf56-4060-ac57-3f4afd8fcc35", "comment": "Malware payload", "value": "5b078aa36e1b84a07529ef368dadc137348055e2b8ddb3cf233c59b4737717258add9cbbcf93c899d0d55c1061efc880", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482172, "uuid": "b863e964-2899-49dc-87f9-281da629607e", "value": "T12145293A5B008807E35D1332E6879100F9BC69173193DE477B8D27176F9AD84AF7A98E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482172, "uuid": "8b5f499b-04b6-4acd-bc07-63d601074cde", "value": "96:55IiGLRw9rUXXxUMh2mwcDYxiJjlyNE7j3rxdWW3GCTgP8:nIiawaPhRwtijlz7rKSgP8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705482172, "uuid": "96d3a82a-8eae-4846-a07e-07c7f1dad658", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705482172, "uuid": "95df5f6c-86ff-4373-a6cb-4bbf7e97a12a", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482172, "uuid": "1db4e722-6cff-4b52-9cbf-f549eec77979", "value": "R34567976543234567_D45678.IMG", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098ecc6f-b549-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705503579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503579, "uuid": "4ab9d4ce-d67c-4e1b-9e9b-c132f95d9d03", "comment": "Malware payload", "value": "da84f7b6a8aa403adca4f0f95979251d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503579, "uuid": "79c0e09f-10fc-4857-8d73-600049d3181e", "comment": "Malware payload", "value": "60537e2da153c76f0d29875ea8207bb02242e494d1e75b78ea0fc6da725a84b8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503579, "uuid": "12e40624-8c66-47f1-815e-8dd0a7de31b4", "comment": "Malware payload", "value": "e83414d8edade85c1d5ff93b97cdb5a4ff8fb067", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503579, "uuid": "f4128081-ac36-4305-81a2-01d196b87a94", "comment": "Malware payload", "value": "c007f0eb021ca830e9a6ccae1cf27c83bd0cbc4c6571dd6b563ea57ff1a69537b6dcea648de05b0fb22ffc8cff78f224", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705503579, "uuid": "c121e79f-ad5c-4836-b0d0-3c2fcad5b84c", "value": "T10891E76992702E4738E284CD677FE052193D4853D0256B2238F267C265CF18A7B2C8E2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705503579, "uuid": "c771d078-022d-4227-9929-7435176d78ea", "value": "96:uw+8u9iNnHJ2Nz52hT9cuz6ZSB9LL0NHXMt:uCOCHJ2N9yT9LrL8Mt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705503579, "uuid": "e7e74370-a3ae-43d3-85c2-1a313e7c477f", "value": 4347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705503579, "uuid": "f0de810f-a599-4446-b87a-cf883e27a321", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705503579, "uuid": "cd3e2b9b-d3c9-48b0-94be-966c91f17907", "value": "01_17_2024_Invoice.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b555c181-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705502149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502149, "uuid": "2d984083-330b-4a3c-897c-b0a996fcd4b3", "comment": "Malware payload", "value": "c704ff080a6c86f05e8085f7d1547a0c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502149, "uuid": "fa7c4aa4-d9ef-43b4-accc-54b40d53a9f0", "comment": "Malware payload", "value": "6097441ee8fa1c29c0651eef696aa02dad806cfe59f40a1eefe06d2cbbd1702d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502149, "uuid": "22de1610-4341-4976-8e51-d1e17e3b0062", "comment": "Malware payload", "value": "1b55651f2a80f3ffc1f58c9d4fb82244b8081afd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502149, "uuid": "d86eb1d4-ce1f-4672-b02c-b0d20b6e278a", "comment": "Malware payload", "value": "5d49259de2f144dd5077fe34e90e6bf62c60acc0d484370956961f094f85cf19bab8810d8496cb20480388b2ccde3514", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502149, "uuid": "ee16af96-df50-47e8-bd3a-922021bbda86", "value": "T1C8D41854DA99CAF0C6E81732D8A12811217ADDDCFD62FA1A1C4EB0EB79367C7218741F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502149, "uuid": "1e139f31-9a40-413e-9f67-97d9f9578e8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502149, "uuid": "b1e65834-e9ff-47c1-9f38-a3e8b6191df4", "value": "12288:4NJ+kHRYTEa4Mm60UpKDTsy0/f6JDiRgRaVHvyxhkCxNS8S2Iw:An2j4MmTUBVf6JDiRSaVPUh5lMw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502149, "uuid": "af98fe68-03b3-42aa-8eeb-81d397a1bfdc", "value": 605696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502149, "uuid": "2e76cd8c-b66f-4ea1-8457-1f5804beba3e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502149, "uuid": "fb1b3394-bb99-44d1-a848-d9c6ce6f981b", "value": "c704ff080a6c86f05e8085f7d1547a0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b108238-b544-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1705501675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501675, "uuid": "64f7c0ae-450b-4d9e-bf9d-3adacf248c6b", "comment": "Malware payload (SnakeKeylogger)", "value": "db86dde9d57e4515d835a79062ccd488", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501675, "uuid": "77556afa-956a-446b-a50f-feae3e2911a3", "comment": "Malware payload (SnakeKeylogger)", "value": "60b278a34e9fae474c690ef8745378c636abf96b2bc41f91c0052aa58bcf07c0", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501675, "uuid": "f31e8179-d6d7-47bc-89a9-fe3d30dde2af", "comment": "Malware payload (SnakeKeylogger)", "value": "a46666c82dc496c970707575a10dfe6616835eb6", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501675, "uuid": "099daf77-fd6d-4fe0-b51c-ea7e9ac97d89", "comment": "Malware payload (SnakeKeylogger)", "value": "bb49d9596b6b30daa944ee7039aefe6877392966c42522cfe8d5b80958fcd70585f5c3ccc3d53387a5d5be8bd85c30b6", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501675, "uuid": "3f03bfba-48a4-4ee5-8561-cb4dac4194c5", "value": "T129742328FBC2924540573E9ADC756697B7D7F488578D5037D70809AFE200AB1334AB7E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501675, "uuid": "46b8a5a2-4d71-4da3-b615-6fdb71e10029", "value": "6144:mVoz0hyZALiFveEi2ElqEkQNp1buMnnHqeI3LEkEOKMFLv3ORfaN+p4pVwg:x6GeEK/JbuMnHqeopEOK8LvOR6+p4qg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501675, "uuid": "ddeabae0-5859-45f9-bfca-d42fdec9bf1a", "value": 351264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501675, "uuid": "71ada5cb-ed40-431d-9c02-a9e4e9f24180", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501675, "uuid": "290ef6f5-df73-4d5c-8863-2dd8301888b5", "value": "nFACTURA997656700000.pdf..z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8590140e-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705502069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502069, "uuid": "2bdf1d06-95ad-4b02-8212-0938c1b1919f", "comment": "Malware payload (zgRAT)", "value": "8fc227ce346405f934e67a52f6f7532d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502069, "uuid": "bb1ea4b3-4add-41fb-b9fe-d04916d455d8", "comment": "Malware payload (zgRAT)", "value": "60e7d495e14577490e67715e6c3cce3a587227b4c551d07c324e40ac1076cd35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502069, "uuid": "00e7b542-28bb-4d81-a3b7-c917b7c1b9a0", "comment": "Malware payload (zgRAT)", "value": "f064102195cf5117c526957e27b7e440cd4e4066", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502069, "uuid": "f48faa84-8198-4eeb-9233-8b026f7f330e", "comment": "Malware payload (zgRAT)", "value": "2a4f7bce9357190ddeadaf533a4b70d152c8063e0b7de7fcd2991ae9dfe33c578ba5de6a23d860db0a343016961b1bfb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502069, "uuid": "90834287-45df-41ce-9388-5c4c43fecbec", "value": "T1B455BF0273818022FF9B91334B56F21DD6BC692E0123E51FD3A83D79BA701A156FE762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502069, "uuid": "192d1035-c7a4-4ecb-ab3e-611161d1a79e", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502069, "uuid": "c3ca75fb-8773-458d-bb5e-0800b993cfcd", "value": "24576:UqDEvCTbMWu7rQYlBQcBiT6rprG8avFlAqjaX+zpFa:UTvC/MTQYxsWR7avFlV+6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502069, "uuid": "53ba9781-9e37-4f90-bb6d-bc0210aa8bee", "value": 1322496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502069, "uuid": "bc5d2ff4-b481-40eb-9c3f-c92088ae43d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502069, "uuid": "6be378ea-f8fd-46f1-99c5-491885cabd1e", "value": "pago FE04712.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92df646f-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705502091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502091, "uuid": "b17c5497-6f9f-400a-801a-2bac46c8b897", "comment": "Malware payload (AgentTesla)", "value": "b7fd0a67d62eddb8df18ece038f178ee", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502091, "uuid": "0a6f4f3b-78ca-444c-8ca5-28cc71821fe2", "comment": "Malware payload (AgentTesla)", "value": "62315e8686b4d2dcd0d034d37c5ada691276f1a9a1227de10029e69b5f2aa800", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502091, "uuid": "47e555fd-31db-4dd5-9e09-81d98a2fda44", "comment": "Malware payload (AgentTesla)", "value": "7269f7c71ba1833857ed4d8135183ccf8ba89502", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502091, "uuid": "311f1e2f-bf42-422d-9311-f98a8e9d73d5", "comment": "Malware payload (AgentTesla)", "value": "bcef457661705567cc519b1ca207332aee23c153f09874a9dfc724d55946423b91fd37f667237b27168ab9b0af573348", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502091, "uuid": "8da98f95-02de-4cc4-b894-5a1111e64652", "value": "T11725BE5977301933CE1AE3309AF3AB014297FDAA56E6824B52C4B53D66335FE0F53A81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502091, "uuid": "a0fe31b6-7845-40ca-a67d-4cc3172952f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502091, "uuid": "7d5f8e53-e757-4a47-99b5-f00b1e5c4219", "value": "12288:pbw93Fe2yKe2ML5QvHRVbRBodONc/eI6t6J9ByULHIymw:dwdHL4+vxpdGsU9Byf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502091, "uuid": "3a25ef4f-cbe3-4c06-b637-e09b6b83f470", "value": 1044480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502091, "uuid": "b9acc1d1-5659-4cc2-bcc7-bfcc62e72361", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502091, "uuid": "c2172058-3c72-450f-8570-bab6295b2fb0", "value": "Quote OAU_JANQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dff68ebe-b51c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705484611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484611, "uuid": "ecebb533-3cb1-4b15-8ade-5524694e913a", "comment": "Malware payload (AgentTesla)", "value": "d63b86a0a204577085e96b49e8642654", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484611, "uuid": "776fc049-c5c2-4d64-a396-b62382c2a7d8", "comment": "Malware payload (AgentTesla)", "value": "64464548284c044ba744e22c3fd25109579997bd21a21c33e387c3122dfce3f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484611, "uuid": "398bb9b2-c24e-49b2-8bc3-741d68f493bc", "comment": "Malware payload (AgentTesla)", "value": "d48aab7a3853a4bab4bca96c207bb94d9574ecf6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484611, "uuid": "ba0e306c-11a4-4568-b8a5-dbdd8e580207", "comment": "Malware payload (AgentTesla)", "value": "98af2a2d33fe90e071d8203c2799c90638dd2700a2f429cfe8c06ee99fc2d37b3f2a51e89f7f10c76a2250c2fe15ba59", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484611, "uuid": "2f96a400-96ac-4c85-8d2d-ae8a0f2dc535", "value": "T103F4121037F8572AC0B94BF85271952063B9675A2026E76DEEC625CC2E36FC2C70A777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484611, "uuid": "588a48e5-8243-4559-a171-021f87ea903d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484611, "uuid": "049dfe2c-d3a9-480d-96f2-b8359da96365", "value": "24576:FwmW6SUZaIsrJpPOACVozxijykeWqlXFLJBF:kIsrJ9/bIek6LB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705484611, "uuid": "3e74284c-adc9-43b1-8c87-e69b0f3c05ba", "value": 787968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705484611, "uuid": "a799e765-e223-40d9-8314-d3c8b4e151e1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484611, "uuid": "2c8728c2-2bbe-4b3a-9c24-e69ff6a270b5", "value": "New Orders, DT 150124 KLB210568 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e00d795-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RevengeRAT)", "timestamp": 1705501976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501976, "uuid": "8c1fe5c4-9f8a-41aa-8fbd-bb1f224e660c", "comment": "Malware payload (RevengeRAT)", "value": "234504f9fcb3c9515f8034afdbee8571", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501976, "uuid": "07327654-fd14-40f3-8f39-e1e9624c78a6", "comment": "Malware payload (RevengeRAT)", "value": "649d8fac10370a8922779669c5bbe8e93d4df493991ed8fa98a66de7b7d89560", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501976, "uuid": "97ae0bdb-d145-4aa0-94f9-8dce0ec378ee", "comment": "Malware payload (RevengeRAT)", "value": "44bd1cb504fb04bc06eda1b4119b37cd7263f559", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501976, "uuid": "7770c172-0e72-4cbb-a2c4-13d99557379d", "comment": "Malware payload (RevengeRAT)", "value": "630ef8975e3d9ac2a49d6ca1686028066186a49633116838cbe0cecb56c856ff545313cec05d18d64cc3d051fbba9270", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501976, "uuid": "afb71d9f-b739-4763-9eba-efdef4156f41", "value": "T1F3229E84EE836557EF7BA3BFC90A5AFF8B26B40679983E97504567E82146107110F10B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501976, "uuid": "0f90e606-afdf-4caa-b693-ce7dadf8de4b", "value": "192:xrXP/D4F6LgKM0wiLB9tZxWut0GkSskv/+KpOjN9nswlDDrCCDNHCtBq9p:dXPI60xsB9tZxWaPAKWNO+CCJf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501976, "uuid": "bc3e7cc5-d2d1-451b-a1e7-83e57692f618", "value": 10855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501976, "uuid": "fde65604-3036-426e-818c-edeeb50e9205", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501976, "uuid": "f2293b6f-55ce-4b35-9ae7-727fa729b251", "value": "Detalhes Reserva.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed2f7522-b587-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1705530589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530589, "uuid": "7088fa61-e366-4e95-b37a-b4da55f559ff", "comment": "Malware payload (VenomRAT)", "value": "a042db8045036de713193f079fe61d6f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530589, "uuid": "c228661a-d5bd-4c71-ac64-f81fb493ba40", "comment": "Malware payload (VenomRAT)", "value": "658d8cc670cfd05ce62ccfbde1885db5e5581a658c2fae67b96c01f4fdf6957a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530589, "uuid": "fd07504f-5153-455f-97db-4389d061e8e2", "comment": "Malware payload (VenomRAT)", "value": "10cbda77553e4d1441c0d7d81c838dd41307c751", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530589, "uuid": "17f8f759-a35d-448e-bc68-f6b94eee0fff", "comment": "Malware payload (VenomRAT)", "value": "9c5e3fe995535cad84befabd79c56e16664f04b05770d8cbc91c5f8af35602b6037e7eb2e45334caf334cbc0fa98e11b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530589, "uuid": "90b2a2d9-4239-473d-8d9a-7e3e4f7741b0", "value": "T17F734A003BD88D26F2AD47B9BCB162070EF4D55B2416CE9E3CC454DE5A67BC58A036EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530589, "uuid": "f03a743b-9c7a-4c13-9180-4804fa67393e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530589, "uuid": "a6815c19-4266-4947-b96f-e26fbe8c0ebc", "value": "1536:aKUUPcx9FbKHoPCdLR33s3qbQSM0ThEPMwS/eqmmRhdWVH1bfbXyebhSwzUobVcD:aKUmcx9FbKHo6dLR33s3qbQSM0NEPMwk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705530589, "uuid": "f154af6d-56a2-4268-ad68-ff957dc8e7b2", "value": 75264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705530589, "uuid": "83d2fcf9-be0a-4fb8-a324-d18180089294", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530589, "uuid": "fddae971-856e-4dee-ab21-2e5b6629a873", "value": "a042db8045036de713193f079fe61d6f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28c95eb-b521-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705486682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486682, "uuid": "1e205b42-5e60-4cab-a8e9-3d996b36df95", "comment": "Malware payload (RiseProStealer)", "value": "6c43476919f11e172d71130fe7e00211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486682, "uuid": "f1ff9358-6e66-44e6-92f0-61d46f369b80", "comment": "Malware payload (RiseProStealer)", "value": "65a3bad83753f055c2a33ebbb980bfcdb134283885d7e5e584b52927a44685d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486682, "uuid": "2c6641a8-7f12-4abe-bdef-82dd904a480a", "comment": "Malware payload (RiseProStealer)", "value": "82abbb2800b951efffb915d68467091839f93322", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486682, "uuid": "cbb7f6d6-e796-40fa-b947-11f7ebf14bc4", "comment": "Malware payload (RiseProStealer)", "value": "09f6130709d30371ac812a3cfe5cc9e629cb4e59410dd8e2616fe8aaa9eaa8a668cc43b9f97519c60c45ab8a13a2bfe2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486682, "uuid": "623010cc-5169-47f1-898a-a48528016f53", "value": "T1B09522F0B2F8595CCAD183F51BB8922182E0DDC1EF0A8FEBC5E38552B34B4C44A9559B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486682, "uuid": "f5cf8b29-9120-46bb-b726-3ab937e0a0d2", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486682, "uuid": "9088eb16-5519-47ea-8098-ea69ea204803", "value": "49152:TjXeWCLih6MpCX+yKpjJmT/YT2Sf3Nnqmc7B5sU:/XeWCLFICuyKpjJm7YbfZqmQB5sU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705486682, "uuid": "51a0f952-3441-413d-96fa-ba0dda638064", "value": 1879040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705486682, "uuid": "cc3d9d06-1042-4aa3-a11a-15b36fc2a660", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486682, "uuid": "d163de4a-93b7-4714-944b-76b4cc827d1b", "value": "SecuriteInfo.com.Win32.TrojanX-gen.3528.21522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a90cb6f-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705501997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501997, "uuid": "26f004c3-6a0c-45bb-9667-7bd807172916", "comment": "Malware payload (AgentTesla)", "value": "74dfcae8bbdfa11d4dbb24214ce125b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501997, "uuid": "b773ee6e-c811-446c-8b6d-959dc34f0f4a", "comment": "Malware payload (AgentTesla)", "value": "68a08a444393bd9381e5364456f130ae72af84618621faf74fc019f605a210fd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501997, "uuid": "1a470425-bf91-424e-81b6-42351759d9bf", "comment": "Malware payload (AgentTesla)", "value": "d126d4a52a7bb4234717dc07731ec9656f414a96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501997, "uuid": "f968a912-6fda-4f07-b85f-2170d551ae69", "comment": "Malware payload (AgentTesla)", "value": "fa59faafe9d3281ee19b9eda6fc8eed72c56851b4b9789ec0a74b37e68bffae75b1fc14e56e6e8524cd9ec226fedce7c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501997, "uuid": "d6ebd70c-ff83-4b97-8ca9-298b060ece4d", "value": "T13AE423743A584673DC3912F426A3637127B666663A11E5E4FCC7348FC7E13140B6AAB3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501997, "uuid": "cd8580d7-4e7a-48a8-b9e9-f431c666374c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501997, "uuid": "54ceafed-aac7-494b-b114-a387a5f85eba", "value": "12288:LePFLVoq3FimOaihpmVBVRmMOLmiySCeT5butfROCTc8:LePRVoMFpiO/MryjeF8fRw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501997, "uuid": "4e325aa7-0d87-40d5-81f9-d807be801f47", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501997, "uuid": "fe806523-c3d4-4415-84f0-063a0fd0949f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501997, "uuid": "1b2270dc-d340-405c-9158-099663ed5f69", "value": "FedEx Receipt_AWB#883053232014374654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14d054c-b565-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705515913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515913, "uuid": "42bc0af9-384b-4c56-b3ae-ad4a5ed1f842", "comment": "Malware payload", "value": "2d905f50524ed62ed2de53aa8aa9dbae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515913, "uuid": "8862e2a8-79bf-4b52-aa32-cc3a1f900659", "comment": "Malware payload", "value": "68cbbc8dcbd0cd730ec5da4ce7343838a860de10c30f33f229cd58c697efb723", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515913, "uuid": "814822a5-98ff-4493-9ee3-95d092b9d96b", "comment": "Malware payload", "value": "3f2a20f0c307e64852a776f4cf82168c2c6bdae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515913, "uuid": "6e732cf8-e7bc-47b1-b8e0-5b5f3179bd30", "comment": "Malware payload", "value": "79d1f8afe499d8ca60dc65e93e8a0288ff5178e13c764e0324a4dd5ff282c32ca396f88cc24a657c6fa5abbba2c79b6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515913, "uuid": "d3a6c00f-ee23-4cf7-ad42-00533e8bb257", "value": "T12786332D33A0DCE9D6F45078C0958B48C7F6FC924756DACA07B836415EBBBD16E36A02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515913, "uuid": "a4c91651-b2de-4d76-a93f-6f68f4004ef7", "value": "0b5552dccd9d0a834cea55c0c8fc05be", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515913, "uuid": "356eafff-5aa0-4b6a-a40d-c012be9ead15", "value": "196608:GRygNcGjl3gZEujDW8Z8IbEF9onJ5hrZEce9tGPqKmTb7cl:yydqtgZEuu28Ii9c5hlEiPNm3o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705515913, "uuid": "014c172a-2832-4483-b7ef-5755af460ea4", "value": 8178612, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705515913, "uuid": "8b8aab99-611d-4d84-a099-0b893c808e68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515913, "uuid": "384a69d3-f0e9-4eb3-b69a-ac3e6217870a", "value": "cleanhelper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd8d6828-b52b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705491023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705491023, "uuid": "4dd61c40-e17d-4782-b26a-33eb2005dcf9", "comment": "Malware payload", "value": "806c1f4591b37f88b8db45e0a4dbd567", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705491023, "uuid": "c680a0b7-f306-4864-94ee-b3aff6effaa8", "comment": "Malware payload", "value": "69151169c71cdb9e4fa41e8081b13d3d0dc079e304f7fdcbded8dc4cfb80eba1", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705491023, "uuid": "8768d7c9-35fa-4d52-a8a1-6b8be6addd00", "comment": "Malware payload", "value": "86d3873cf50357eb52f97e26d7fa0f8caf73593b", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705491023, "uuid": "17f86639-6efc-4a30-8de9-15db048db60a", "comment": "Malware payload", "value": "5352283b2edb2bb962045cb78a64485389fd6b72c5c562c6c50c25209682b2afafdc23405295f523ec598adcdc45c501", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705491023, "uuid": "e0657176-075d-474c-aae9-a0721a2a8c83", "value": "T19456AE36C157FDDA2BA91EC4D4083FD11C982D6792A4D358FE4CB6A316DA610DF2C8AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705491023, "uuid": "57749518-1a04-40ba-9e85-95113d4ded89", "value": "49152:iOaytoXtpilE3pWvPW9K+0o+6rcTYvtvn5cyi/FSG4UTUO4MREQxHj8l2vObpGIR:e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705491023, "uuid": "efee998d-603e-41e7-8349-e6471ee610c5", "value": 6289408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705491023, "uuid": "a442f244-ee99-4242-a584-f49df982ad9f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705491023, "uuid": "ce547e16-be1f-499f-b6ab-d55bf72c77c8", "value": "script", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0121bd3-b4d2-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705452775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452775, "uuid": "3568a899-02ea-46a6-9d12-b01c4b99d056", "comment": "Malware payload", "value": "78298161f76b7c0c0ef264d7c49f964a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452775, "uuid": "21190d72-7a51-4a86-8bb5-70c07d249437", "comment": "Malware payload", "value": "69521a027b62c0ee36f1d5d3cac9b846efc82115b8e13cdae3e1223b6822328a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452775, "uuid": "7dcf9809-8228-4328-9d75-ee2328ba7c4f", "comment": "Malware payload", "value": "a25ab6e7249020f2e2f0d0a6d53ded809101ddf8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705452775, "uuid": "aaf979eb-efa2-445c-b362-88ea0ae72ae5", "comment": "Malware payload", "value": "74aee2ba0bd56908a6e4c07e7e7c9c38783cdc01f2ceb7105ce6300a5ba567cf9deee6dda0dbbf243f847a62b146660d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452775, "uuid": "8b60729a-4b2f-4203-8e34-33dccf63f5ff", "value": "T11F13F2024298BD9FD9BCE6FE3227610DC212D5654DEE07312A63376DC502AB3D968AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452775, "uuid": "97b95a28-e223-4341-952a-098521b40205", "value": "768:IYlLBaA9CeBteITtfs4kiywZSbzgXUwDuljh0uukbdMlHOffGncGrCwLiAfAZsLu:IYVXTTm4R3YfgXJaxGksHfciMORs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705452775, "uuid": "66aaba8a-6169-434a-babb-a47623e8a163", "value": 44568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705452775, "uuid": "4c5caa54-9db2-49a3-8b09-2e41ac900c47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705452775, "uuid": "8c2483a6-e640-43ae-92bb-e76c77799acf", "value": "SecuriteInfo.com.Trojan.Linux.GenericKDZ.367.30240.491", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8dc478c5-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705502083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502083, "uuid": "3c2817b3-22dc-4f4d-a3be-e54328a7510b", "comment": "Malware payload (AgentTesla)", "value": "da8b178b2f11d5a0e08c08395dbe484b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502083, "uuid": "8478a0b5-d4e3-4c23-bfcf-0f06baf75287", "comment": "Malware payload (AgentTesla)", "value": "69ffd7a475c64517c9c1c0282fd90c47597e3d4650320158cfb8c189d591db8c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502083, "uuid": "cd58398f-b57f-4cb7-a0e5-17a425bc71ee", "comment": "Malware payload (AgentTesla)", "value": "420de07fa1a999789d6da89e26fe7bb1fd122d12", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502083, "uuid": "a11435e3-92ed-4ca4-9e50-8f08d9596e77", "comment": "Malware payload (AgentTesla)", "value": "2cc980a81a4a8e6d8e3ee3439e7d5c5c21f61d0a6fdfc312c44310dc586052f41da07e7ebbdcbc664caf513ce645b77c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "xlam", "colour": "#94C3F2", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502083, "uuid": "d54baefd-7141-4d90-8c8e-8ce9d77f388e", "value": "T16DC533CAC1A8B3CEF9C984B44284B88C83D8E4C56611A31FD159E9E58ED3DC7369F671", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502083, "uuid": "f7147bd2-dfa9-49f7-9e9d-583f131c2f0a", "value": "24576:UvFkQJ9EUjXzNC+VmAqaN4hFnEYVIFO10DdMEqxPOuHN4NjYpwl+KqfEf7ipXzIC:tQ3EqJTSrEY+FODmr3l+KqMf7QUYyq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502083, "uuid": "4252e2b2-66ae-460f-9234-cb2a56f1c893", "value": 2513613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502083, "uuid": "0b06d8e1-882a-44f5-b237-63416c3fb644", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502083, "uuid": "2ba3d204-80ce-4dd8-9747-4d397376aabf", "value": "factura 00005111, 005114, 005115.pdf.xlam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "242c4ce2-b56e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705519515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519515, "uuid": "f406ddc1-9ab6-43e8-9a1e-a1b1377d1f7b", "comment": "Malware payload", "value": "84dea6ab99a9145e8371f826e9d8e0a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519515, "uuid": "c8ad5dd4-fcc0-4112-a2d5-0971905f01f0", "comment": "Malware payload", "value": "6baef377f56b22359bd6ab309f3a36f79290b2bcfeafd6cd37475f795ba18b2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519515, "uuid": "60588760-75cd-4453-921a-daab941a8cee", "comment": "Malware payload", "value": "fb889c76db362c8ea61abbeaa129ef7ef8b83968", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519515, "uuid": "8d8ea028-4237-4b37-96b3-4381edb187ab", "comment": "Malware payload", "value": "5fcd6c796c30687247ea10c892f5ca29bc8fa03a37677aebfeba7a69be4364ad4777da539ed8866d2f5eb652cd53a22f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519515, "uuid": "adbd8cb7-a11d-4f28-989b-2ddd6590538c", "value": "T145852224A7E8AF63DAEC537F98620D752B70B902E041FBD37444B25A9B5F35CE62104E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519515, "uuid": "b20b1df4-4c50-4f5e-a36c-a14c8b6e7523", "value": "49152:c5+Y+EoteIyJbDvVLDhu6NkRfZd3aCuOrk4d:c5h+GIyJfJDA8kRfZdDup4d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705519515, "uuid": "c020e5fe-893f-40fd-befc-9f6c1bc65874", "value": 1819080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705519515, "uuid": "24ad07f3-ac9a-4a73-8d29-0f2d96b631d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519515, "uuid": "633400f6-4bb5-49a8-bf6f-753ecf503835", "value": "SecuriteInfo.com.Trojan.MSIL.Krypt.11295.2757", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fffe495-b543-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1705501254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501254, "uuid": "b956b1f3-ead7-4405-9255-2cb432fb307b", "comment": "Malware payload (SnakeKeylogger)", "value": "3f1e87cd3c3310b42cb8787ea8a89056", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501254, "uuid": "7370e11f-6f95-453e-a1cc-6fcb81a5be8c", "comment": "Malware payload (SnakeKeylogger)", "value": "6c7b0d0545f5d55e896d26d244a411024cabbdb26c96744839e22c16a4495659", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501254, "uuid": "49421434-4e35-4545-b309-b6ef7643e4ab", "comment": "Malware payload (SnakeKeylogger)", "value": "06769fb29ef98f2cfb6a93929d3da8cb1ef7c193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501254, "uuid": "05b82cf2-e8a9-4da2-b87f-2315c4a66040", "comment": "Malware payload (SnakeKeylogger)", "value": "da0ac6d4687527b6b4659863bfbf9f244095563ad6f3dc5bdfc202bf444f78e94bd407171664e48383533d9bfa0e09ac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501254, "uuid": "31177ad4-6f41-4639-a9d2-7d4dd4fde60d", "value": "T189A4D08173D1CA2CDCE54B71F8FD94014B31EAC99442A70FBAFD15297E62B094AB7722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501254, "uuid": "ce9e2368-8c3b-48e2-87cf-5597faf6cc37", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501254, "uuid": "954709e9-501c-4035-94d0-f978071a3d46", "value": "12288:J53M+dQj4IqNEyQCuz0cxsLirSH678+9tf:HM+KjPyQCuzVyLi2ByB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501254, "uuid": "aebe3f1a-9d60-4b10-92af-ceb6511bffd3", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501254, "uuid": "d24afd48-3e07-4ab4-94e7-a65b3062be18", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501254, "uuid": "0b273951-3167-474e-a748-b3c50b405bf3", "value": "Marine Tiger Details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93d9a34c-b52f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SchoolBoy)", "timestamp": 1705492644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492644, "uuid": "d6c70edd-5b6f-4f6f-b5d0-fd349f5c6312", "comment": "Malware payload (SchoolBoy)", "value": "64c6b120813cd1fdf0dbab2fedd40910", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492644, "uuid": "47aaa249-46e6-4ffe-baaa-ecb82cf71cb9", "comment": "Malware payload (SchoolBoy)", "value": "6d43e2133946987aa0607822fd7b7e2254bda06c01eac930bfc90b3a00b8d28b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492644, "uuid": "f8641f52-dede-4c25-aaa6-a05e471cafa2", "comment": "Malware payload (SchoolBoy)", "value": "44524bfda51f6c884d8dbecdd42b38b40eb0afba", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492644, "uuid": "82782db6-9e1a-4f7e-8b77-a71021b7d330", "comment": "Malware payload (SchoolBoy)", "value": "abf372667621d21109a2c02cc027a8362cf346f8b563d93b7853aa8880ea61c27afa3566652b9a8289922f0c5ad9c918", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "SchoolBoy", "colour": "#609074", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705492644, "uuid": "ca04d4e2-8bf3-415c-bb19-2a63cc3c6f5a", "value": "T17346C026B284B53DC4AA0A3A4877E9485C7F7B727912CC4B57F4598C8F395C06B3E60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705492644, "uuid": "415a0fac-afa4-4e08-8c35-239aec05767f", "value": "141259af66c1280b7ceca3f2f2405ae0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705492644, "uuid": "12a45b68-4782-4fa0-b58d-f9d00ba2987b", "value": "98304:JBfb3hIwU/mFhFkpuYwUkPuPzr+Y7s/+XIWvQE/x:JBfbxIwUeFhukNuPzr+7/+XIWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705492644, "uuid": "770deae3-a836-46ae-9738-a8021417e79c", "value": 5459456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705492644, "uuid": "1a191a8b-96a5-4854-b803-39e67df7fab8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705492644, "uuid": "11a1e52a-5c80-47d4-a268-96e0df28f947", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a8617e7-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705502077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502077, "uuid": "a4329acf-ea9e-46e5-8579-67bcc11f8c1b", "comment": "Malware payload (RemcosRAT)", "value": "2ee77980498a2d11c7fd122f5104ea7d", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502077, "uuid": "58b021dd-e2ce-40cc-854c-b3f5ec2c2ae7", "comment": "Malware payload (RemcosRAT)", "value": "6dc70b0f41774c0a54daf73b2250f57cab43490b8e760d1f5d9416dc3a911679", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502077, "uuid": "08086d12-4314-4239-b1c2-ba8caa3c931f", "comment": "Malware payload (RemcosRAT)", "value": "56b3e35536de11c44e2bd810097127fad427b37d", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502077, "uuid": "10358304-a7eb-4ced-a461-12b5b25baa5f", "comment": "Malware payload (RemcosRAT)", "value": "3b145d0d8a85bfc59d9a6e6d03819bc7acf43cd046cde97313068769a29875e95ae1b2d994be587319f264cef792d888", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502077, "uuid": "6170a744-4d02-45da-9a7e-679b1d09b560", "value": "T16565C00273918022FF9B91330B96F61DD6BC692E0523E51FD3983D79BA701A116FE762", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502077, "uuid": "955c629e-f697-4bce-8265-24ecaf02a1d9", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502077, "uuid": "7538c806-73ee-4d2a-b372-096ddba067a4", "value": "24576:sqDEvCTbMWu7rQYlBQcBiT6rprG8aclDjYFD0dg2EPUN7mcNKGrw:sTvC/MTQYxsWR7aclwFodgLPUNftr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502077, "uuid": "a311b5b9-4a7e-4e3a-9a75-96d0d7d8e183", "value": 1474560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502077, "uuid": "6d535489-97ed-4b8d-b7d1-ad12ef074969", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502077, "uuid": "ebf386b8-a0da-4173-81a9-946e738fce1c", "value": "FACTUR.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a36f397-b519-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705483098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483098, "uuid": "f2775f33-3e21-48b4-afcb-05ad2a062de6", "comment": "Malware payload (RiseProStealer)", "value": "39be89943cf43a04bd3ab9347aa9299c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483098, "uuid": "3eb05830-bb6b-45ec-a5b8-2dc945d2e4ee", "comment": "Malware payload (RiseProStealer)", "value": "6e3ae06915555c89cf25a3f2fc09903d7c4d60cdc32be407049c336074ca6731", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483098, "uuid": "20122deb-32b4-484d-9ef3-5606c6a8c9e1", "comment": "Malware payload (RiseProStealer)", "value": "679055d65df3e2535152a929c8750a52da4624df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483098, "uuid": "1a9bc8aa-ec09-4088-9e4d-ce0e297a828f", "comment": "Malware payload (RiseProStealer)", "value": "9fb1fcf800937cc027f761e242f446d7db71c111f55985c12a2eb0ba86844a94c98eeeae2387df7fdfb51fc1f2db8453", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483098, "uuid": "a3eeeb1b-d56a-46b6-8fe4-39c5ebc65507", "value": "T10F9523F533F94A4CE4C467F02BB093A652D58CE9CF19CFE2D9A758523B471C02A62663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483098, "uuid": "235809f0-5fe8-437f-871f-3fdaecad9835", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483098, "uuid": "0d7436cd-2c4e-4bba-a263-b4a6a0f128f5", "value": "49152:+hOtgpSPMx9ZNq4LdsXIFm1HiomwLnQ8YB2Mj5fSF:+uNPQZNBOX0m1HiomwLI7jN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705483098, "uuid": "c784b4a4-25ad-48d0-8301-60854428b384", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705483098, "uuid": "3da9e3c9-0074-41e4-a6a4-23dd10920bb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483098, "uuid": "bf83dfa1-787f-4fcc-93c4-104d7cc906f6", "value": "SecuriteInfo.com.Win32.TrojanX-gen.24099.8107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba9401fe-b57f-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705527069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527069, "uuid": "9be884ef-0ae9-4350-99cc-53749b4ee377", "comment": "Malware payload", "value": "34cfbe3ff70461820ccc31a1afeec0b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527069, "uuid": "4046abfe-1717-4f17-80c9-895745756960", "comment": "Malware payload", "value": "6ebcc6896b243c761da4fc28a26249b0c146ae17aff7697c09bc447008e831df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527069, "uuid": "a3c99589-7723-45cb-b5e7-7afacded735c", "comment": "Malware payload", "value": "5d32e91c039c9a6f723ba3c04c1179d02e6a0ce9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527069, "uuid": "8183039b-e527-40f4-9d7c-14629c723149", "comment": "Malware payload", "value": "bf7816b6feabb76bcc93f4eae1f02f45bfd48fc7d8059ca5002b3ce52c65647bb066769a03af269c179863106194816c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527069, "uuid": "d5af9bf8-c6d2-4e73-b730-5fe654b36fed", "value": "T144D34B5763A910A8E2B7E2BC9AB24652E7B17C050774D7CF0350817A0F63BD16E3EB61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527069, "uuid": "60b23a13-79a1-46e0-b909-0432fc79d027", "value": "afc1f930b16856804326528e39e42dd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527069, "uuid": "6df01b04-10d6-471b-ae5c-cc19b254e396", "value": "3072:rOUDtpXnRNEvhxNyatnKl9rGmJTQSaMm5/6TYfEBjgQ:rOUDDXnRNEv7wEo9WlTfYjg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705527069, "uuid": "e34a9b62-fee7-4ddc-b1a0-8a95de2ba2d6", "value": 137728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705527069, "uuid": "d655ed0a-6154-4c66-8c10-bfdb11df7aa0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527069, "uuid": "92066ef8-c79a-4833-8c10-7289bfebebe4", "value": "SecuriteInfo.com.Application.GameHack.DK.9795.6461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee539bd3-b511-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705479911, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479911, "uuid": "6b4832b6-f085-402a-be5e-8ad29a5a8b3f", "comment": "Malware payload (AgentTesla)", "value": "5d65d852acee61e41ab1bbf37cebb3e2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479911, "uuid": "ba6cb016-91de-433e-9575-b1aa2fd1b56c", "comment": "Malware payload (AgentTesla)", "value": "73aca4e9d147804101f8a1ddf9835ebc0952c2b8b05e10d4350db07b4a712d5f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479911, "uuid": "97f080dc-9d1e-472d-a3e9-c710d74f4fab", "comment": "Malware payload (AgentTesla)", "value": "6c6a529348b3ee5b6dbaa53be414ff4b0ada6ad3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479911, "uuid": "b476be62-bea4-49a9-8d35-0916ab6ff9af", "comment": "Malware payload (AgentTesla)", "value": "b838fd9b02d9dc03ca3cbb1586a7b56e89b55a540b129d3ec111c7cbe8763754d1b301233fe8fa1c4fa079e9f2d317d2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479911, "uuid": "9feb2e2c-36b8-49a4-95a5-8ebd90aedd9d", "value": "T1B083F36DD34B02998F624336AB1B1E5541BDBA7EF38552B1306C433533EEC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479911, "uuid": "30f00b63-d639-436d-8c66-ecbe9fed28b8", "value": "768:n+wAbZSibMX9gRWjtwAbZSibMX9gRWjUSNBSljzJw8s+tS6J:+wAlRkwAlRZSNBSljzJw8jw6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705479911, "uuid": "b044673a-1f23-4335-92a8-7e25d8ec6651", "value": 83505, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705479911, "uuid": "e61f9829-9b7f-4315-8a05-20ea424d7cf6", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479911, "uuid": "53d95f0c-1af1-493d-a97d-2407a16d29f4", "value": "SecuriteInfo.com.Exploit.CVE-2018-0798.4.7852.18914", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9ece05-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AZORult)", "timestamp": 1705502005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502005, "uuid": "6a0feda8-2b01-42fa-8459-e604f3f4f867", "comment": "Malware payload (AZORult)", "value": "9b5dc9e48b3f6222c69a65be1d49d13b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502005, "uuid": "560caba5-cc7f-4efe-a1e3-692d600a2e91", "comment": "Malware payload (AZORult)", "value": "763d73647ce03b99fdc5a43badfe0f4571e86998395d30f8f68d8042b8c83ace", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502005, "uuid": "e167945a-c1f8-4311-9bbd-060fde330346", "comment": "Malware payload (AZORult)", "value": "129164230683a8302d42d384053aa75cea78c5eb", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502005, "uuid": "1c3c1c19-fcfd-4d07-a088-2f912c015a11", "comment": "Malware payload (AZORult)", "value": "6fb334af6f0f02059d03a174ef6822f978fa7b7edda6089b46a6580dc8dfcd295ee334dd1480a4f6a708c3288f62d4e8", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502005, "uuid": "adae34a1-e6c8-4dce-a0d8-281261a7ae98", "value": "T1D7A4122717A2DEA6E0464671C9EACB3A47765D451398BB07BF807A1AFD364F34E3C102", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502005, "uuid": "0604b110-eb21-4005-aeab-0816962e22b3", "value": "b78ecf47c0a3e24a6f4af114e2d1f5de", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502005, "uuid": "30b6ce2f-b4e6-4c71-a6db-435ef58e067e", "value": "12288:IAdpuFL7Am5SBXJHTkZQ+uwypDxfXikgqKeSs+:IAdpKLMmIZJzg7XYDlykge8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502005, "uuid": "644c17d2-d9fb-4cfc-82b0-5629933a90a3", "value": 473952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502005, "uuid": "d3af6239-ae9e-4fd3-a7ac-69c42661a050", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502005, "uuid": "5474c6d2-2f4b-4292-9b18-98cd8b4d663f", "value": "e-dekont.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8954d33-b50a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1705476841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476841, "uuid": "2a8436c0-4b3e-4b88-a783-c33efbe4d80c", "comment": "Malware payload (GuLoader)", "value": "63e6fe1920747cd2ad9e175b26e82008", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476841, "uuid": "797c4806-6646-44a6-b5fd-dd08fed0d462", "comment": "Malware payload (GuLoader)", "value": "79972cb9236ce16ca687d781ad427950e449f31af96ec83d23e14d0e4b6ac844", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476841, "uuid": "28c8b517-7940-4ab5-beab-eb96bf19cce1", "comment": "Malware payload (GuLoader)", "value": "4a20aca405f642c73e6f6e849bc8f2f59543b4a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476841, "uuid": "13561084-1173-4781-89e0-e5a645d2272c", "comment": "Malware payload (GuLoader)", "value": "4ef29504f2cd40d7f30ef14675c3f8b1080b948c5d3e41c342a1d217bb82e7a408cb8b10f6db969e974b5de0a3cbe15a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476841, "uuid": "3593a780-f20b-4666-98e9-bc595afe65e9", "value": "T17E35E1133980899CCE6A55F7B21B8594739ECCBED64CA71C6BC873934EE1BE10826717", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476841, "uuid": "44841350-1ac4-45e2-85ad-f98fa1cefa4c", "value": "21371b611d91188d602926b15db6bd48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476841, "uuid": "b2b6c058-be1b-49e9-8c09-9765280d4623", "value": "24576:niUmSB/o5d1ubcvvlAEHnqKs31lHJ7MTPDgsY02nt3rE3oR:n/mU/ohubcvtxHnqKs31lHJ7MLF2ntI4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705476841, "uuid": "0051d1ec-67da-4b00-82df-411405debdc4", "value": 1108480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705476841, "uuid": "c531a7ee-1072-45e3-99e2-0e6c620668a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476841, "uuid": "0fcbbc6b-1e5f-4e2f-a276-4c31e6c33b4a", "value": "doc2009988876370093845_1601202400.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef669ea-b50a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705476771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476771, "uuid": "20a1613c-d226-49c7-a90b-40bf4b85c8bc", "comment": "Malware payload (AgentTesla)", "value": "275e078bf1ba558ea5e37ce123e54bc4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476771, "uuid": "77449998-0082-404b-a478-59f8998ccaa9", "comment": "Malware payload (AgentTesla)", "value": "7a35fc0e7785f7cfe3998aa2e0ab8a4fc2958ccafc2da33be2adb3c63fe8443a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476771, "uuid": "b238945d-ecdd-447c-8340-5805db2e568b", "comment": "Malware payload (AgentTesla)", "value": "0bbfa60e00bdf0f2aca0115d99206454eed6a651", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476771, "uuid": "f40834b2-3a08-46b6-b786-eba1f04699fc", "comment": "Malware payload (AgentTesla)", "value": "1e4e48e7f77611b7d9203fbc55aadeaa792271615ec17c373f6061189ecfbe96bf0ad3f86e35a187a35e003cd79bcc69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476771, "uuid": "d2cb95f7-8b3d-4f9c-9616-09b03ef332a6", "value": "T146F4232033AC877BC7BD15F7E098262647B6981D3257EFDD8E44B0DD1E87B42962122B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476771, "uuid": "2411919a-6cbd-4d49-9fab-a759fb97f86d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476771, "uuid": "9f11b662-1215-442e-b7d9-656bb6a24837", "value": "12288:F+vJz/IIHF3fKqHCD+XJ/92cdUyAnTjYvf1BBphmj8HidvMaZcbGZcQ/:0vJz/IIHFv9H3dgnYlBBp+8HEUGcbGZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705476771, "uuid": "5f70349e-cece-4627-b1f1-e4bbcaf9a92e", "value": 724480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705476771, "uuid": "10d63651-b587-463a-9922-935b86bc464d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476771, "uuid": "0a48664d-7358-4700-a5f4-9fa209391844", "value": "DHL_2045760982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ba975e7-b573-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1705521782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521782, "uuid": "3ee7084f-5dc0-41b0-a578-d011cd604028", "comment": "Malware payload (BlankGrabber)", "value": "2a7ca62ab3dcc82582ecde744dc92cab", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521782, "uuid": "517c5f30-43d9-438b-999d-84d576107ca7", "comment": "Malware payload (BlankGrabber)", "value": "7b8eb83b50c69e286307d04e3fa86221ad0c9e04ce9be3a4c35dbfa6d08f1280", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521782, "uuid": "b9b00a27-4cf4-494e-8731-1ae2f79f17d0", "comment": "Malware payload (BlankGrabber)", "value": "3cd2e619418ea61da3a0c073656375f14becbddb", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521782, "uuid": "72a12c42-7c24-49eb-982e-f594a3f1d0f3", "comment": "Malware payload (BlankGrabber)", "value": "9acab885156366d6af877c389e75c407286d157ca06855850b1fc26f1f8941002b4834a0cdabedcb0e42c480d0d7e701", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705521782, "uuid": "fdcab54b-7107-4b87-a7fb-22d285ffa324", "value": "T1AF9633AD893557EEA178E33996482D511730D374E2FC7FA0B2C792693F046829BB3712", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705521782, "uuid": "bc357a23-630a-4407-b990-c341f9cdeec2", "value": "196608:mo6RpVn+NDGZ/StfbNZ3UJyed5tHHpkTG3YgiLsDQZwLHDxTsF:m1+kMfEJJd5tHO2HiwDQo5sF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705521782, "uuid": "5f6f7f63-e973-4cf6-b709-537af58789db", "value": 9414128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705521782, "uuid": "598bb869-513c-447f-a325-02b77d8f4db1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705521782, "uuid": "281e2ffa-d2ec-4687-b1f8-a3334664a63d", "value": "Token_Joiner-Zarduax.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2076277c-b51d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705484719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484719, "uuid": "e7004764-b042-4cd4-a50c-310dc81a4e73", "comment": "Malware payload (Formbook)", "value": "adce9ab8247be2087a3c8c897e6cfd97", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484719, "uuid": "cc22c3ed-3af7-435d-8359-d17a2479e0d8", "comment": "Malware payload (Formbook)", "value": "7ccd7791942d7fb2a511b0841af3669d365aba20dd73739808c3666352fa9dea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484719, "uuid": "0a9f950e-bcab-47d4-9f0e-e99319bea978", "comment": "Malware payload (Formbook)", "value": "27ac60c8d23d4c93d65a1981db54a1a1d94359a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484719, "uuid": "59744d03-a2e3-4f0a-8795-769fd41ef869", "comment": "Malware payload (Formbook)", "value": "02be11e2361b8ac80ffdef02aa880e3c91d22623ee407e3056b8db3909ea34f36b1d242882dd5c3799454f81176fe8e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484719, "uuid": "5bc9bb85-691f-43b7-83c2-54a086ebaecc", "value": "T16C358ED1F190899AEC6B4AF16D3AA43025E3BE9D54A4C10C59997B5B36F3342209FF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484719, "uuid": "e3beb4f5-89fd-4c2e-ad0d-87d263e51dc7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484719, "uuid": "a64e8202-cc93-4ee3-952d-fd08aac9d161", "value": "12288:uz5Y1MN62qZaSjVObADlonESN4A0wr35ZSAhqnAPwMbjRKhzJ2ShvkBx9XZXbIG:uzGSUZaITo4A0wrbSA0APwW8eSmr9Bn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705484719, "uuid": "877a725b-a2be-43c7-8642-ceef04d6f694", "value": 1090560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705484719, "uuid": "8588f138-f37f-466f-9b05-328a07ad57fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484719, "uuid": "2434978d-2453-4e81-8885-01da2578b6fa", "value": "Revised documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7652dea7-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705502043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502043, "uuid": "dd584ee7-3771-406b-909b-67ee14296379", "comment": "Malware payload (AgentTesla)", "value": "26c24eb64d452bbd137b625abac84f1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502043, "uuid": "11ba2771-5cfe-4eef-ad9a-520a704a4c9c", "comment": "Malware payload (AgentTesla)", "value": "7d7f8991bdda56c641c41d4f326dc37385fad751e90ca5b849dcc55085f66d1d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502043, "uuid": "c9ac108f-d010-48c4-97a0-f98242888129", "comment": "Malware payload (AgentTesla)", "value": "596ce54aadc989375799d7a85220aa878bcba3fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502043, "uuid": "42526c30-866f-4665-8250-5ad430710e72", "comment": "Malware payload (AgentTesla)", "value": "f5a83d86e3d1ff5a63f7a520d42dbcc86be583a79b886b19028a82f09e5bc1cb1bf53d6e9c098ed8bad150c24d40d261", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502043, "uuid": "52699ccb-3f0c-4143-a31f-a3c8826da51b", "value": "T18FE423527614C923E1EF73F200A36B3707F2253565BCEA148C9AB95FB7D2B180899A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502043, "uuid": "a34418f2-fdce-4f90-ad7a-d27dc7eff858", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502043, "uuid": "ee13b503-319f-4b87-bd52-59a879ccad18", "value": "12288:xePFLVoq3FUEEsk/ihJEeNXx9I8D5N7e643dDYSYEC:xePRVoMFU8m6Jp9I8NN7wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502043, "uuid": "788c6569-be40-4fe9-84a4-6e2a6ec19a38", "value": 692224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502043, "uuid": "631eafd6-4143-41de-a3f3-4fd4123cf4de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502043, "uuid": "d8383cda-d426-4a11-b134-b7a14e323fbe", "value": "HBL_JSLIBA14010160.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf0819be-b52e-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705492314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492314, "uuid": "5d990ccb-3419-4e24-b4e8-010000c4ccc8", "comment": "Malware payload (AgentTesla)", "value": "6e203b9a327171830ff7881aca49aa3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492314, "uuid": "63937109-3110-4a1e-afe4-03935609f1d9", "comment": "Malware payload (AgentTesla)", "value": "7e7108371097d95434419307f999d9dc6e6ea49fed948be6f92e2f64cdfcefd9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492314, "uuid": "7da53b85-9697-4219-8cea-430bcb356a6d", "comment": "Malware payload (AgentTesla)", "value": "f435600540e3281d55f959b52b9b0609ee6a478d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705492314, "uuid": "1754d523-f6a5-4cbd-916d-fc6f515a5e29", "comment": "Malware payload (AgentTesla)", "value": "f71f35f945a30dfaf1ed6c10bf2116e60b063512342b00e72f233b62374ef55866be50e0dcda2093cc1394e3ebd343f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705492314, "uuid": "550fbe41-f2fb-40e9-9235-591a6326dbaf", "value": "T1662523911D272CEB8188D7F6723F5F5C5722CFE2C225E1BB856134C180DEA969A3BA50", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705492314, "uuid": "be8f4d97-0993-4c63-8e25-cc5caab01ed7", "value": "24576:wrL8C7fvVXieEpBj8/U0/P50FmTSIvLse4Kzrcuzp501:wkWvVz/lNSaQe5H5W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705492314, "uuid": "0916a57f-a660-4f07-ac26-61c3fea8e6be", "value": 1034639, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705492314, "uuid": "b4224cb7-30dd-402e-89b4-bd0f2ed0820f", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705492314, "uuid": "e1508338-f1e7-49ea-ac48-6ee78e492b28", "value": "NEW ORDER--GO23B005XXXX024.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc4d480a-b547-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705503127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503127, "uuid": "2c08be0b-97a6-40ca-8085-4f5819fe9847", "comment": "Malware payload", "value": "696ef2eb3f4eaddfbe4a09ff2f253ddf", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503127, "uuid": "8df45f5b-ac65-4eb7-92f2-f16a204e3273", "comment": "Malware payload", "value": "7f8621ee68088ab9251d43e63f31b035aa5b2a02a11265878c5de2aa4c325ccc", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503127, "uuid": "0d000576-b756-4e58-baaa-e6a213de9fbc", "comment": "Malware payload", "value": "794f1f28c9cd907167bb8515d16af88c375f5837", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503127, "uuid": "6bac2803-dd65-4c90-94c4-f3cb2b69f212", "comment": "Malware payload", "value": "1986176af70c4813d6ceb7b09cd4025af938a7b180f980b5dd37362a7b6ee8ed2180bbdff2470bb276068f3485b34b89", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705503127, "uuid": "f65e7ec2-04f0-4627-b82b-2f6a87622d5f", "value": "T1EC142838A8FEBD0DF4946377C5863DBDCB2DBC80D904298B8E2841177D4B25E1B5AC64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705503127, "uuid": "477af37d-d909-4bf9-b00e-475405846aa6", "value": "192:V9bZg9gWstMoYbqNt0lgLzbCmaAC46S/65peM:VJot+T0lg3bO9yM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705503127, "uuid": "6804365b-cc9b-459c-9c68-dfd371abaa93", "value": 209139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705503127, "uuid": "dabcc2dd-8580-4cfd-93bd-497247b04618", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705503127, "uuid": "6653cc9c-4fc3-4ae8-bfcc-27eb2d5b14ba", "value": "01_17_2024_invoice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e001e53-b4e7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705461657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461657, "uuid": "1f033e21-2f04-4b5d-8cbb-36e67b78ea73", "comment": "Malware payload (RedLineStealer)", "value": "e6625c39020b84ae7acc2a1c0342011d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461657, "uuid": "2c6375de-56a8-4b99-a992-5089630b7940", "comment": "Malware payload (RedLineStealer)", "value": "807c8de036b9509ca5cf64385f9f2333284c37db3d0364e90a965243330a2781", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461657, "uuid": "de0d833e-911a-4346-9e3f-35fb64da4d84", "comment": "Malware payload (RedLineStealer)", "value": "f6a149bfe66fe9f4ddda4cccad2f3c9d4fcd78de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461657, "uuid": "c5619b55-7ad9-4ff4-b299-4956e4a32d84", "comment": "Malware payload (RedLineStealer)", "value": "b35fe59d719327c0905e1801902ecdc58e795725511163a23fb373de81067bbe53f456d6492dc1fde5aebe9122b328c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461657, "uuid": "27df9027-3d4c-456f-beab-d2ef5a0ffc79", "value": "T17A34D04377D88B66C55806F5C0E3606403F2A5872B33CA8E6F4453DA1F127E6ED8AB8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461657, "uuid": "8db7618d-19f8-428e-b0a3-b7e63dad58ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461657, "uuid": "9635239b-a848-4a98-88c8-88e9e0b9ff44", "value": "6144:GLF+FIyyXYuD7vunjXa2XOu4ML7HKkZ54X:NFsXp7v0jXORML7Hp54X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705461657, "uuid": "76965988-703f-4fc2-9641-06daf585b7f0", "value": 243712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705461657, "uuid": "fbae5d9a-ba7b-4aa5-959f-59a233cc8b36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461657, "uuid": "8762a4db-d0c8-47cb-959a-468b59521274", "value": "weekend.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "650e1af7-b544-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705501585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501585, "uuid": "54e83956-1649-4897-8d24-b12e94ffdea2", "comment": "Malware payload", "value": "843eca6f0d66fcf62f7d5b293f07a068", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501585, "uuid": "9019b990-f9d6-4346-abda-dc2075c25ad8", "comment": "Malware payload", "value": "81974307b0047b8a4e25f9d13c18571fe1ccc61f49a93e3d87fd5e903e7265dd", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501585, "uuid": "872e1f26-eb5e-4318-8820-84b1ba7b2176", "comment": "Malware payload", "value": "465b96d6fe1a3614a077302e8d7bc0c37d1bd773", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501585, "uuid": "20baa128-0b6a-4a2f-a351-aea622827ca9", "comment": "Malware payload", "value": "d0053c7c0fecb65a4772fb741f0941d6aecac4eaceac20a5a0e7ec32dd832f22fad6d869147e6c33e74b2fdee0c8a560", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501585, "uuid": "db2fc4be-770d-474f-b150-9265cf39552b", "value": "T12284231536A7D75BD0C3A8B58ED1C2DF6111FC106F136A5BB0B9B72E0A3A7C0C6A2B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501585, "uuid": "a1c62be1-9abc-458d-ab44-f86db2356ff0", "value": "6144:uIungSHBMixiMK6G+ZFrTUvCp4sJggp5zIJ8jrxCH7H4SleqeO6+5/AjKg7lAXM1:uxgQpozwjTqCfggPIJ+MbHzes6GIjxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501585, "uuid": "efafc371-e5d3-44ad-a59b-4573962bc447", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501585, "uuid": "812b494a-c925-41cd-924d-378790ec348b", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501585, "uuid": "250080b7-9a60-4537-8570-5032331e6771", "value": "Mupid project.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d58123a-b544-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705501572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501572, "uuid": "62f29c15-2c07-40c9-a3ae-b0f6830c2cde", "comment": "Malware payload (AgentTesla)", "value": "250841072f7bb27d6a75cd026249bb87", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501572, "uuid": "43f9f499-87ab-4b76-8a13-0d1b7cf3cfc9", "comment": "Malware payload (AgentTesla)", "value": "8549cb420ed5c1edf32b7e28d9d2010dac4867c0dba3650e1f8e7655278d4c5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501572, "uuid": "8e85b493-2a61-4d02-a9ec-1d3ac1bbaa11", "comment": "Malware payload (AgentTesla)", "value": "190342d9c712d9af9a3dce9eb3f2ff32bf100e23", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501572, "uuid": "b84cabae-edd5-4487-84b7-67989e8227e4", "comment": "Malware payload (AgentTesla)", "value": "41d0c19bbfe43bafb020b6bec927c3f6e9889ca0a9e9381f6383ebb3f1581afee731618b361186d41bb7474465b3474a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501572, "uuid": "17e9e747-1910-42f0-b498-4944d85f086e", "value": "T1D46412B93516D629E1C214B30FD1C0D76661FC129E0A15AB34ECBB5E6E77A80CAE2F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501572, "uuid": "369c3166-ee75-4ab9-b7b9-efadfbc65f2b", "value": "6144:6vBNSHBMixiMK6G+ZFrTUvCp4sJgo0r6Rz4rN9RjymY7TaGv37Aodpz:6vBNQpozwjTqCfgo0ugNymWbvrf3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501572, "uuid": "f3aa55c0-dbeb-4595-9b6a-08cde0323d86", "value": 309760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501572, "uuid": "5ec46886-6991-4d37-a356-ad4cf4d494f1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501572, "uuid": "ab830207-2b29-43b4-98dc-99c08b267d32", "value": "RFQ_Daewon-56C_3948645373547364.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37bad4d4-b58b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (IRATA)", "timestamp": 1705532003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705532003, "uuid": "ba035274-20b7-4ecf-bc94-da20cd5802ea", "comment": "Malware payload (IRATA)", "value": "31e8102f21c5b17e170baf3502a77649", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705532003, "uuid": "8b269ed6-0d92-4d88-b5c2-877c1ebec3fa", "comment": "Malware payload (IRATA)", "value": "89f90ef40f2f4f27624de3e884d236b56c211b5d6a07eeb3f2ab95437ec7b633", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705532003, "uuid": "8dbb0d00-219f-40ea-80ee-874f55b8014a", "comment": "Malware payload (IRATA)", "value": "b3e6fe70a31887f0e88a244f8516a885a58a5958", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705532003, "uuid": "7da6f3e7-d298-4076-b934-f93848d249d2", "comment": "Malware payload (IRATA)", "value": "dc4b0a56005e15f0fd36070c39c622e18beeaed588811d456b6c8232879c8739330072fbaf6b8df72474c95885fc40aa", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "infostealer", "colour": "#288F7C", "exportable": true, "hide_tag": false }, { "name": "IRATA", "colour": "#874CA1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705532003, "uuid": "5abcefca-2df0-44b3-a76b-88ca2a33e792", "value": "T1D6E733007DC6F0DBCB51EDBEEB8343AB11CD56B07B31A7E5C14258B9B84358AC91E64A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705532003, "uuid": "24a291bb-0100-4f0c-bc4e-1a68758348d9", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705532003, "uuid": "9ca2ccce-1117-4190-9982-7941febc5336", "value": "1572864:EyXoONw5lz/dpj2zSI5aTc+o1qJ9AVVMPSCClc2E77:hXk5D92aTDosIVW6CCl5e7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705532003, "uuid": "7d5e8b0a-2caf-4f4a-879a-053ab402421d", "value": 69681327, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705532003, "uuid": "d159d47d-e134-474f-bf79-5d066021c1f6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705532003, "uuid": "e0f4c658-f3e0-462e-9a18-b6cad5dd15ca", "value": "EpsilonSpaceWorld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74b55b01-b533-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RemcosRAT)", "timestamp": 1705494310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705494310, "uuid": "b6cc06b3-8b0a-4687-93ad-bdfedd9349f6", "comment": "Malware payload (RemcosRAT)", "value": "ae054d4dec2e43a0e66765d280b91668", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Nirsoft", "colour": "#D61DC5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705494310, "uuid": "4da8587c-c18c-4f64-bb51-2dee9584a7a7", "comment": "Malware payload (RemcosRAT)", "value": "8bdfeab040508e6ceeb585c27cf6fcdf931ad9b2d0d539fa9cb910d5ac89f423", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Nirsoft", "colour": "#D61DC5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705494310, "uuid": "bfe0f7e3-ebd6-45d5-8740-1825475af431", "comment": "Malware payload (RemcosRAT)", "value": "4ca92b950bc9cc6c54b2b519057170a8b05e8a6e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Nirsoft", "colour": "#D61DC5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705494310, "uuid": "eae22518-526c-4f6b-bbf3-5eb780e0e9a2", "comment": "Malware payload (RemcosRAT)", "value": "1567b764a14f33dd6a3b695739b9105266d372fa8112db57c5650638015fa481c002d85866020257923fff63a0bce501", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Nirsoft", "colour": "#D61DC5", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705494310, "uuid": "bfcb559e-d58a-4726-b616-3d9afeed6d16", "value": "T1A5347A2EE30B05199F5693BB874B4E4946BCB62DF38541B178AC533437E9C3E862297C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705494310, "uuid": "73630997-17f7-4cb8-a1a3-21a164e54aac", "value": "6144:gwAYwAMdSbeZ0N11ZxLToJN66Bc+bu6xRxRW:KW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705494310, "uuid": "e3079bad-ee77-4664-8b6a-8e3536ef0223", "value": 244390, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705494310, "uuid": "a67c2f4e-37f9-4ed9-9e2f-f3c071fea372", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705494310, "uuid": "22f6768b-b25f-4e0a-b37a-bee367426631", "value": "\u03a4\u03b9\u03bc\u03bf\u03bb\u03cc\u03b3\u03b9\u03bf.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd32cd25-b531-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705493572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705493572, "uuid": "d61154b6-a6cd-440e-90e3-6ca36283865f", "comment": "Malware payload (Stealc)", "value": "a5b8efa2eff9d1ff432889932b80d0f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705493572, "uuid": "796551b4-adf3-4c04-a4ce-1a99ac840194", "comment": "Malware payload (Stealc)", "value": "8d8b7a87a9a64415fcda58a572432a6c580a908abc1931b040fc8930462e9680", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705493572, "uuid": "b7f34221-8655-4dc0-94a3-d28b0558d69a", "comment": "Malware payload (Stealc)", "value": "ddf79e2a10d81849ca343f272732647e704955b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705493572, "uuid": "1349d528-2c54-4dd9-8f44-394749396537", "comment": "Malware payload (Stealc)", "value": "351f129732f4d265a8b644ec4a9dc296bd8a8a8c3ac2436efa47358d8cccad1566c1df7341719de6a464f4694d9aa16f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705493572, "uuid": "f5ebf37b-8e91-4f55-aa0f-e41a5f27e118", "value": "T1DA540753B2A17E65EA374E328E2EC2E8771EB5518F49376E216ADF1B04710B2D173B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705493572, "uuid": "7bf5ab89-9487-4209-99c6-d37732f52dde", "value": "efb0d5efee037e1ff512c9170e95e7b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705493572, "uuid": "2c8ad684-65b7-4ba6-b49b-7c3323aff6b1", "value": "3072:T9CL688Ls7NBveZzc3gLRNbhD1Gbq6txXmQONvW5Kghdb+cRTBq0:JC+88LuNRepnXbhZGbqExX4gnbdTBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705493572, "uuid": "50ca205b-4b39-47e6-965b-1832d8cb986c", "value": 288768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705493572, "uuid": "dcfa59c4-7ec5-4829-9346-63844475ddf5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705493572, "uuid": "dc1a6efd-d24a-407e-8e5e-661430cfec54", "value": "a5b8efa2eff9d1ff432889932b80d0f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16aa0e4-b590-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705534381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534381, "uuid": "69c48625-369b-48e5-9c2a-fffb3b59b518", "comment": "Malware payload", "value": "275ad1bdf9464b4d56ce97aa2ca254cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534381, "uuid": "8280d353-ee1d-419b-a690-00f6d836eaec", "comment": "Malware payload", "value": "93e3c6a19a111829d7fe16133f2acbcdf1528899add872ef413fad604c965d41", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534381, "uuid": "ed4efd84-6a9a-43a8-9a20-49a9c147243e", "comment": "Malware payload", "value": "e67af5ebd2d10f16bb3b50eaba51a406bc7b3e02", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534381, "uuid": "96434f8c-14ab-45ca-958f-38f0c71d3980", "comment": "Malware payload", "value": "1c3a89360bf2d147b9c6748c015ce71be42eeccf444b684e6fdf04d0b68e46239f1bdcc99b373809aadcf5e6ad52b0ed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534381, "uuid": "5f849266-d7f6-4596-99e6-0508b8888d00", "value": "T169D4AE02E69240F1D60A697001FE673BAB7C9B564B34CFD3D394DE756E322D1923B21A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534381, "uuid": "7d99a9a9-07cb-42ae-81e3-d55f461840af", "value": "12288:Nou85zpSoEaddhqrJKkIhwvR50rreAKOrngf2:NczpSobd/qrJjUc50H18f2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705534381, "uuid": "0a5b3ebc-578a-4917-b0a3-4c6aeb237ee3", "value": 640451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705534381, "uuid": "7d8bbaca-dd6f-4fb2-b8d0-a8cf03ffb619", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534381, "uuid": "1fbefdd6-f428-4e39-aec7-de37f53fc4cb", "value": "SecuriteInfo.com.Win32.Application.PSE.1OV7PVV.2070.20243", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1266de8-b540-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705499994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499994, "uuid": "549be6ac-878e-42d0-8a49-e93ef7a3abb1", "comment": "Malware payload", "value": "c1bfa5a675fd4a96fead52ba7539cd1f", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499994, "uuid": "c899d2f7-b4a5-437b-9033-11b4a8f31a06", "comment": "Malware payload", "value": "9738a69626586fa31b143d5291438ef807468ad424b4fc47ccc29db0b510c327", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499994, "uuid": "2c845ede-b158-483b-834e-9f8ea1fe4495", "comment": "Malware payload", "value": "af42dae199d0f9b0afee9e45868253f0892909b2", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499994, "uuid": "3de29fb2-eb04-4bd0-98f9-f50ada13f57e", "comment": "Malware payload", "value": "9d0e715ead9b9537e64d18ab120054b8a494ed545613bbb34d999c3d9a9f944f0b3727a793615e5e7e276e8c86b51510", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "password-protected", "colour": "#3D71D4", "exportable": true, "hide_tag": false }, { "name": "pw-beta", "colour": "#37A355", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705499994, "uuid": "16101a0e-05ee-4573-b6ec-7ab7261947e1", "value": "T14AE7337D05BEA9E1D2DC46CD0DB3AA112EE9F4C92B019A4C318337246BE5D350D87BE6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705499994, "uuid": "03396c25-0b5c-47cd-9e7c-c78012829905", "value": "1572864:7wxkp2qQ63a/1yGtLT+fzT8GNvOhqi7i/yUGMvo:mkp2qQXplTm9Ni7iq3MQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705499994, "uuid": "4877c56e-c2a3-462e-8d2d-2d9a1d5c4ef8", "value": 69788318, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705499994, "uuid": "c4ea75db-4640-4e89-9025-97f1d0c75d14", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705499994, "uuid": "80341b60-1490-4672-b171-6fa8981b9ea5", "value": "EpsilonSpaceWorld.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9cbeca-b559-11ee-b7ea-42010a9c0006", "comment": "Malware payload (DCRat)", "timestamp": 1705510510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705510510, "uuid": "4b0f78ab-5f15-4282-86d2-d2c3676753d3", "comment": "Malware payload (DCRat)", "value": "a3d53c95c5d457e510e89cd2f1288387", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705510510, "uuid": "6bdcb4a9-76da-4862-aec5-7ba77ba9dcc8", "comment": "Malware payload (DCRat)", "value": "97c8904e0e2da52a0021dabc7d281eab4341a36e6dd94b7d98a4c1c3eee4ba1e", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705510510, "uuid": "ab915d22-4e46-4b9f-9a3e-cef9f60a1484", "comment": "Malware payload (DCRat)", "value": "713ec6a2c7724ea023803c40b3cc23eda5e6004c", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705510510, "uuid": "1b007fe9-3d7b-43a5-a4c7-553f14dbf32a", "comment": "Malware payload (DCRat)", "value": "fe661bbdfd891ff494bdc789f4f15b3bb539af569044d5425616fbd415af8828e3a14c525623f6f32031066b07e30a33", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705510510, "uuid": "04759d5b-11c9-4858-96d6-772ae53439f2", "value": "T167B5C01665A14E33C2685B768297013E93A0D7263612FB0F366F61D278077F18EB26F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705510510, "uuid": "80a3c714-5a7f-486a-895c-72500a2143e6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705510510, "uuid": "1a2c8875-d26d-4fec-bd31-cd2615beaa19", "value": "49152:SW2cXK7xPrZz+NvK8IVYmdRMHHE3Ym57ThBHZok6tA8onR1lQY:R2hEZIVYxHk1XhBatANHK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705510510, "uuid": "70d6c513-ec74-4b47-8154-173c550eb8a1", "value": 2359808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705510510, "uuid": "132ab37c-938d-4d75-86e0-151a44fda51d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705510510, "uuid": "9e5976f6-2f8d-4274-b4f9-98d88d9a08bd", "value": "97C8904E0E2DA52A0021DABC7D281EAB4341A36E6DD94.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f893959-b4f6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705468048, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468048, "uuid": "a71a0207-4d8b-4812-8fb1-2daaecde48a2", "comment": "Malware payload", "value": "ab08ec8d348b39792bd75b4c245e3a85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468048, "uuid": "1f2bc026-35f9-4c1c-bb21-25115c41695a", "comment": "Malware payload", "value": "98c119f51a776bce249028c5a532f6919dd18bfa8b566579cadceebec293c960", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468048, "uuid": "b30e5ac3-2d0a-413d-a7dc-18ebccb4f2d1", "comment": "Malware payload", "value": "96c73851f861b63e794621834f8aa66bb37069f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468048, "uuid": "641cfe04-b435-4ba7-b0d2-aa8ff5ce88ad", "comment": "Malware payload", "value": "33677b5e2ced2c4171c27eb361b79247bca23ea0e07d96ffa1414797cd5bc954fa2ec060fb025282569dcac77643d359", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468048, "uuid": "1b047e2d-2ea5-41cc-8a45-f63a4f5e6bc8", "value": "T10F5533150E460D13F2D796B3E609B1833A34DEB9A9BB279B353C0DC327CC8AB6515978", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468048, "uuid": "86ff63fb-9238-43e6-a874-8115af55fd16", "value": "fc5d3d653af3c3decf6e755f0007c4f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468048, "uuid": "83fe9fe4-a151-40f6-bea9-37782e494dcd", "value": "24576:spjyGtYYjvhfBsHx0oG2uWZScQ95WVRYOjzl7GDIZfEkHefQkR3k5Tc11q:iXtnsHSoG2pZvNjN7vZfEk+i5Qs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705468048, "uuid": "86963c08-2b90-476e-ac55-96033d4c9725", "value": 1390080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705468048, "uuid": "592ecdc1-b136-4950-9a90-3c4f377706c5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468048, "uuid": "fb149acf-f4d3-46d5-aed6-14dee8d4da1f", "value": "ab08ec8d348b39792bd75b4c245e3a85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ded628a6-b540-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705500071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705500071, "uuid": "2076b147-29e2-462a-8cc2-48890a3d93ab", "comment": "Malware payload", "value": "4c085e7938df78b3947e6a0788c7ded2", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705500071, "uuid": "ab062f88-e949-47bc-9c69-dff33b0c4a79", "comment": "Malware payload", "value": "98f6264b0f8a096bc1bd35495d84228cb27851a449afbd4539bace735b257963", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705500071, "uuid": "967bb2f0-d142-4f8f-91da-1cf814a8619d", "comment": "Malware payload", "value": "9d612bbd3d55d43ef140b679af397fe2d04618eb", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705500071, "uuid": "60fd627b-b350-4dab-9bd9-97ff5b51fa94", "comment": "Malware payload", "value": "5c730c101df85cba06b56a5ec2cb137478a97ae9cb308b8fe3688f9fd9a4a99064efc4c3fbcd9aa2bbf81f7934fa178e", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "EpsilonSpaceworld", "colour": "#39C295", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705500071, "uuid": "8c3548e8-4695-4683-9094-af9fedbe0de6", "value": "T136E733007D87B4DBDB20EDBAEB8343EB618953A07731BAE1C2519DA9B4D3156CD0E352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705500071, "uuid": "17d9dfa4-0e5c-402d-876d-d37d97dd4dc3", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705500071, "uuid": "0b08b84f-b72d-498a-8d16-fdb1a1a353f1", "value": "1572864:fyXoONw5li9QMT/I5aTc+o1qJ9AVVMPSCClc2E/7:aXk5E+MHTDosIVW6CCl5G7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705500071, "uuid": "035bff8a-c829-40e9-a421-ea9b38778489", "value": 69680621, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705500071, "uuid": "368afbd3-e193-40b9-87f0-04e72a432581", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705500071, "uuid": "827f6808-881e-467c-bed2-5469f200776e", "value": "EpsilonSpaceWorld.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbe0cb0d-b53a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kuiper)", "timestamp": 1705497543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497543, "uuid": "2f717191-1dba-4ec4-a7a5-653ed8252da8", "comment": "Malware payload (Kuiper)", "value": "8c3c50ecee8744ad77a517ed39a25880", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionB", "colour": "#69A58B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497543, "uuid": "fd90d33b-bff3-45ca-a24e-1016e0798da2", "comment": "Malware payload (Kuiper)", "value": "998347d4ba21661688169337ca4ea2a6118c2fad2005d39d8bf46c0bcf46af5a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionB", "colour": "#69A58B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497543, "uuid": "7916978f-445d-4975-9715-e524ae75f05e", "comment": "Malware payload (Kuiper)", "value": "27abd80487784e41d2dd7eee9efd5b8b01712ec7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionB", "colour": "#69A58B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497543, "uuid": "cfe3b1be-efbc-4e14-b3c9-ae83ee8b5620", "comment": "Malware payload (Kuiper)", "value": "28b0c558c1cc91f79e1a50692e66f435c168459cec5ef03f363d8758cb5a33b8968178ea2d1a1accbed4a9497c4974e3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionB", "colour": "#69A58B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497543, "uuid": "2726b3de-da27-4445-903e-c0b4dad1710e", "value": "T1A6A51A51FEC790F6D9031D3154ABA2AF57316D094F30EB87EA207F2AE9776A1093624C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497543, "uuid": "5a3964dd-cfd0-4160-a499-eb4049216a35", "value": "49152:w6zzKyVo7x92LU5jdiqYGnZL0Tnz/ZMC7sZz1:wozK392n9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705497543, "uuid": "521a5867-3e37-4158-b24c-cc7af57d609c", "value": 2215936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705497543, "uuid": "eb290ab6-d3ae-4319-9965-045fa8191f5d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497543, "uuid": "9211b73c-2c00-4b07-9386-ae1a905141fb", "value": "B.Linux", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a37c0b42-b519-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705483221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483221, "uuid": "7d111960-a05b-480f-b5b8-c6582b092d33", "comment": "Malware payload (AgentTesla)", "value": "9a89cf51681914af52ca800d980e9e32", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483221, "uuid": "dc849d57-bf29-46cf-bd88-f64ed689201c", "comment": "Malware payload (AgentTesla)", "value": "9a720b9a3aa2ca663ecbd5b05f3abd241d323dc2f3004ee3c8e8ea6a01580063", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483221, "uuid": "37d9791f-8f14-4c94-b125-36c3bc1cfbfb", "comment": "Malware payload (AgentTesla)", "value": "6200682494e199c36d37f66f59e1393ae34fa554", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483221, "uuid": "ebd0c1c5-66d3-4d29-b3c8-d7638160f3da", "comment": "Malware payload (AgentTesla)", "value": "dac34f51adb6335ac2c4713df2ef84aa7cdbf11fa01e1463fceca27921aec5b97df12d602fe09293ab4974c7c49e8fe3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483221, "uuid": "8c55ac37-a6c2-4bdc-876a-0c35ac4d968a", "value": "T15DD423F9E649DDFBE047284D7AB9AFC4EA336D1599853030C6A67448F9C3B4242C9F81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483221, "uuid": "ca4abb10-2332-4a9e-9de4-bb2453a73626", "value": "12288:Z0SRu8iZ3qEaGD1W4UIx/JXZ9u7qpl9ASp1h7fw1tg8J8qQVpimaUNFAlCE:ju3qEaGD1BUwZg7qb9N1otgaQVcZUNe5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705483221, "uuid": "083b619d-743e-4701-a8bd-496069efe16b", "value": 645855, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705483221, "uuid": "3e708a7a-9584-46af-8903-08e74c444d02", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483221, "uuid": "2bf48698-afaf-4640-b4ee-83fab7cdb3d6", "value": "PO1-865.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403c612c-b52a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705490356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490356, "uuid": "7ecb809a-57b9-4609-bfd0-779244125405", "comment": "Malware payload", "value": "e718d77b82c955e38c698391ea17bd93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490356, "uuid": "923c71b5-74c3-4c97-8406-232a022f92d2", "comment": "Malware payload", "value": "9b0f9bc3dba76e0fb693fc6b8a3e49341065378f96982498eace4442d0dc91cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490356, "uuid": "e9416bb5-0532-4935-9ebe-48f30532186d", "comment": "Malware payload", "value": "47dfac5a36f372a8f5e9b008aa7d10b3b3eb5344", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490356, "uuid": "ef75ff52-89d8-41ac-9f4f-9cd7da10c1a9", "comment": "Malware payload", "value": "792bad1076bd60ea3703cbedb9b6422ba1788908093e3a64d8e129d052bc3ee0a0ab53fcb92036e0aa28235b6f8559d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490356, "uuid": "8d6f2bf2-57b3-4fcd-a116-48ac75f14538", "value": "T160E36D1176D89030D1B3427351A5E6A206BEFC765F269E9F7BD90D8E06784C0B329F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490356, "uuid": "3c7dee75-6d40-4a31-83b1-9c7515124b8e", "value": "908b4027593882b9af7c27754346a6f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490356, "uuid": "9f9b11c0-b546-44f4-8700-6fcb528f7850", "value": "3072:3CjUrvpLtc08HXpZ0atvdIQzpzCM6iV2:3Cjutc0A70", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705490356, "uuid": "1419342a-baa8-4baf-aa35-4817ca29af0c", "value": 145920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705490356, "uuid": "4ef179f3-41c5-457e-b543-da76d8808313", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490356, "uuid": "e11d24de-2f99-4f7f-8e8e-ee694191ca07", "value": "SecuriteInfo.com.Win32.PWSX-gen.1578.3359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2c745d3-b590-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705534384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534384, "uuid": "8847c0ab-e335-4fe3-b7a8-1884487c90be", "comment": "Malware payload", "value": "9d5ab8b8021d3f87470a1cd44f0f161c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534384, "uuid": "85317e34-ab92-496e-a942-22b13691f8cb", "comment": "Malware payload", "value": "9b6f50dfad6e8f3c1e49a50e7405bdeaabde8bc22097651f46e7739e9075923d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534384, "uuid": "1e613fd6-c267-458c-b7c6-8a9cc06b8677", "comment": "Malware payload", "value": "3508d0afff20ad3c342137c33e71ac4e826bf217", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534384, "uuid": "af9d155f-42a2-4b4b-8fd4-0cdcbfe27e4f", "comment": "Malware payload", "value": "fa3a6ac8fd278f18e47501926ff7cc5a50a0ea2c64c615a22f9013b46ed2aa7ce2f11e22805a526423e9f8a66cc662ec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534384, "uuid": "52378602-8eec-4b58-b23b-c4f69c650403", "value": "T16CC4B669727A49A1D179C07DE946866ADDA03059033C91FBA2C1C9C8BF713EC7B3CB91", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534384, "uuid": "6bf53378-6c52-4d51-85a2-f22009328e6e", "value": "1aa8cc16f5b5ed6e592de9ac425650ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534384, "uuid": "e3a28f0d-f811-41d0-b6d8-a1e7bbf982d3", "value": "6144:mM8YySiFi9BKd0QwdfWlagGpIKkN/g/D:mMcdniH8wgh/g/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705534384, "uuid": "7000981c-f3f2-4e81-a108-3cbc775ad7f7", "value": 563712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705534384, "uuid": "d37486a4-4f6b-4a34-82ee-93623a0e2fe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534384, "uuid": "4f821728-6f9c-4e9e-a402-268d2eb7de25", "value": "SecuriteInfo.com.Win64.MalwareX-gen.12482.10008", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccf45fb-b56d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1705519207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519207, "uuid": "6e8c797b-105f-41a2-9ca1-e1345e24b455", "comment": "Malware payload (Amadey)", "value": "19f0bed8cb532428c6c015b07e1f5522", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519207, "uuid": "4c4c70e0-d44a-4929-a09d-c9aaadd3682e", "comment": "Malware payload (Amadey)", "value": "9c08646b30800b36fb734790c1019d47a2a495485ec95e966df040f74c7c7bc9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519207, "uuid": "0e8cf9c8-bcfc-4712-94da-51d4a124a2be", "comment": "Malware payload (Amadey)", "value": "dae2cef4d1bf92653deaf9fd1a5ae54e3dba16f9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519207, "uuid": "9d70de7d-b06f-44aa-9b01-6b461bf358a6", "comment": "Malware payload (Amadey)", "value": "dd46810f17b8032de02d76affaca44c606ce9096689227cd79f37f0b56166b6b0f49f18e0bdb1bdf7d5b60ecdb17b84b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519207, "uuid": "8ff75be7-24dc-49ef-9653-2e0204abe171", "value": "T12BA35C057695C071E66D1A3E0874AFB1877EA914DFB08DEB27400E7AAE243D1BD35C3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519207, "uuid": "23faec0a-bf54-4372-9c4b-c4170ec5799c", "value": "91452bf3259a3ff5928a3bb7f6be301a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519207, "uuid": "9a2cbc07-a46b-4a4d-9666-5eba23f687b9", "value": "3072:XYHZ5o8D+sjrW2sosmrtuQRYKr77BUoYW0Z:XcDoBkPsituQR5aW0Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705519207, "uuid": "95a98cda-1b67-49d3-9f5f-fab7981a47b6", "value": 104448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705519207, "uuid": "be2082df-6526-4820-b3e3-e44d0dd063e5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519207, "uuid": "e511ff24-a83c-4f1b-ab41-2720852033e2", "value": "19f0bed8cb532428c6c015b07e1f5522", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60064a81-b544-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705501576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501576, "uuid": "cf77cd8a-1e52-4540-9639-a673a37da0ff", "comment": "Malware payload (AgentTesla)", "value": "98ca631b42204901486844c04bf82224", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501576, "uuid": "b0f3f24a-a0e6-4bfc-a106-bb9e78446c95", "comment": "Malware payload (AgentTesla)", "value": "9daa1156237e076b6b8c2c8572ee0e9700b8d5a11998e906523b0518cd04adb9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501576, "uuid": "8f103f77-6bd4-45b6-8e50-9e7af2a07c45", "comment": "Malware payload (AgentTesla)", "value": "f9c988f5d32b393772c31ecf1f807d39a43d87b1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501576, "uuid": "ae1872c4-32ae-418d-86c5-dbe3ffdf6538", "comment": "Malware payload (AgentTesla)", "value": "df5b618f2722d22c118daa280b60f33689fb415e02cb09d50614b8fc9a431b987926729bfbeb89106248c20b3c7ae114", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501576, "uuid": "d4973883-397c-44c4-9ecb-a3e0012d99ee", "value": "T14A641321375EC72AC49360320EC1D4DB3752FC229E5238AF7498775E1EBB640C9B2A5A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501576, "uuid": "52f93bd6-02df-4be9-80de-f2cf698964db", "value": "6144:7aBBSHBMixiMK6G+ZFrTUvCp4sJg1as74Gof55h4i:7aBBQpozwjTqCfgQs79ofDh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501576, "uuid": "4b6ff78e-dab5-48d9-ba09-cf4f45cc536f", "value": 308736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501576, "uuid": "eab298b4-75c3-4744-899c-2f6cc9df5659", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501576, "uuid": "58ad3e43-3ecc-47e0-b260-d7d71d0e633a", "value": "FPG2401001.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23dcaa93-b56d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705519085, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519085, "uuid": "1ff52b19-ba3d-4cb1-8f57-2c477935bd10", "comment": "Malware payload (LummaStealer)", "value": "a0fe5b52e1f51fdd99657726f0176ee7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519085, "uuid": "f5986fe6-97f8-4321-b297-816b1a165b74", "comment": "Malware payload (LummaStealer)", "value": "9db91e72a168e58a97153f17006046fd3cf7dda6487b3a4787567e1c8448377e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519085, "uuid": "d976220a-c760-465a-86ed-56676194cfe0", "comment": "Malware payload (LummaStealer)", "value": "7548407707fd1c17b0f02b08b1d1ffd5a96f380a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519085, "uuid": "42738e83-adc6-429a-9671-b1e85a1e4a97", "comment": "Malware payload (LummaStealer)", "value": "0438d577c534406983e286897eec20909235855e96a0687a133d8c2e7045dcce2eaf18581e0724dedd7d964733b7e5a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519085, "uuid": "1c7685d5-9689-4d8e-8fdc-e7a8ac64b0f8", "value": "T1B3D47C22A0B3F065CA1F217A0608F77BF72B9CC24351C8A6D1848FAA58719775E75D3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519085, "uuid": "49f57415-4ac2-4946-8088-3a5666d8ff16", "value": "01872e6ee81c2a9c5c63c0d52462fa63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519085, "uuid": "e503ae55-5915-455f-a891-482ec5925488", "value": "12288:YtHILsy8dW9qlCWLG3WfXFJtLZKLNuQTGvxXS4ysPdVP:gyrMCAG38btlKLrUNS4yEdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705519085, "uuid": "70553c2b-5537-4c5b-a4c8-bd10e5e5f297", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705519085, "uuid": "e372f4e5-43da-4d5b-8a90-e2aea0a9d94a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519085, "uuid": "9f825489-9603-461e-99aa-f66611d654db", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "257a3a97-b555-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705508780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508780, "uuid": "ccb3fb67-08e4-45ec-b20f-90d698a7cf14", "comment": "Malware payload (Stealc)", "value": "4ccd48a9c3d1559a8531334c58b3ebd1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508780, "uuid": "f918b6e6-c76c-4573-a20c-320743d85b70", "comment": "Malware payload (Stealc)", "value": "9fbb6be64ce733cabaa16d80b36ab68f4d0ef2f73d7a58f6a644045534125394", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508780, "uuid": "f61f06f0-1712-4705-a817-86cfdff914ea", "comment": "Malware payload (Stealc)", "value": "b9b8ec0db84f5fe6741e6440ba72c6cae05311ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508780, "uuid": "bb569c9c-2030-4e6b-87c1-a12c8ffb3ade", "comment": "Malware payload (Stealc)", "value": "1742e3d1846049f68daad91417b853458979d3d2c91ca4711d1845f7b0894ef0b28dba5bc54a1e5cfcf5ab657d023c2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508780, "uuid": "d7538271-f191-41bd-917c-acfce1aa6f36", "value": "T1D154084382F17C55EB368B729E2FD2E8761EF6708F497769251AAB1F04B10B2C163B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508780, "uuid": "641a6595-78d2-4763-ab81-4e3ec2e839bd", "value": "71b0f0cb2cb6c557a1ff35b75a3ccbcd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508780, "uuid": "c23c7f9c-221d-4cc7-972f-1e004b3817ab", "value": "3072:R6cvPUr3ML0hqprrFajzR3yQqrPnuHlc/LMOQF0GWYa5aufYO+f4qqx:R6KP28L0QprmR3yQkvEQMOc0GFuQO+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508780, "uuid": "711d2266-784b-4b66-9643-26051978e62d", "value": 281088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508780, "uuid": "cad1bfbf-ee3d-4f2b-acef-a4ec63cf9e5c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508780, "uuid": "e0c65fc8-232e-4cff-b39f-9d035c5be1b4", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c9ee7f5-b555-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Arechclient2)", "timestamp": 1705508792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508792, "uuid": "52b6be57-5462-434b-9a0a-04609c722a3d", "comment": "Malware payload (Arechclient2)", "value": "6d7ce4b27687c6991eb31fa87481c99d", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508792, "uuid": "97f40b6e-180d-4564-a16c-536757c978c7", "comment": "Malware payload (Arechclient2)", "value": "a0b01f56081b68bc18bd205504d6ab8b38e5f722e5a2570d5f530c74c26f3ea1", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508792, "uuid": "d93f6621-8f57-4108-a5e4-f7440086fac1", "comment": "Malware payload (Arechclient2)", "value": "c3266267e0e15c349b5ad109082f5702925d52f7", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508792, "uuid": "31ca7d22-6126-45c4-b733-f89d6ed73796", "comment": "Malware payload (Arechclient2)", "value": "443eca9a54946d07164f9c6f31fad08b6a9f340872455121dbd7b3835869454647eb1be29534a4ea81d1bce2fec33f40", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "Arechclient2", "colour": "#FEBA91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508792, "uuid": "b5e5174b-6c0c-403f-8d59-e6aed61253fe", "value": "T13A768D127A04DE25C12E2337C8CF541487FCFD416B13EA6A7E8A339D69523A6594F2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508792, "uuid": "6ef5b101-0eca-4a7f-bab2-ac409c378373", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508792, "uuid": "bfb91bef-a86c-4471-b0dc-e930f303f03d", "value": "98304:liS4pME05tHKYh/CsV3EyBygyNt2bWMVsMnKRc6bJ2NQip:ukpNh/nVbBygyv2UMnMgNQip", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508792, "uuid": "fcdfd405-0d46-4c17-8c6b-09f275811a2c", "value": 7444992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508792, "uuid": "89275660-62d4-4577-a7e9-1ae9e8a2c75d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508792, "uuid": "5f511ce1-ffbe-4e59-97d7-af79c5c9fc62", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90a1cb81-b4d6-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705454413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454413, "uuid": "13b9cbc3-3882-4642-9023-67490da6ce75", "comment": "Malware payload", "value": "0ea7c406d90ed7e07ed1b121e8718558", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454413, "uuid": "4a01ae8f-84ae-44d4-8fd8-6c9d3bd26349", "comment": "Malware payload", "value": "a39771882c96784a6276a987f1e25a9cc945a1c00c1ee242a2947ccec5647938", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454413, "uuid": "d92bd4a2-16ae-45d6-9a62-2ef103913f0e", "comment": "Malware payload", "value": "f933ac0a422f9ea59852d87fd804078a44e44bc5", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454413, "uuid": "e36823db-82bb-4cdb-9f2e-d2bbe8918eec", "comment": "Malware payload", "value": "b30157726f637a58b2d4251a8c1eb64bbbd3ff236609f60c5090fde126c1c469ce2821807021601cbc6268f80dee4d90", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705454413, "uuid": "98a6bd7f-e711-4e39-a834-9b151f75a850", "value": "T129743A2C7E21289CB839C92FF0C47653DA944C47F56589A3F56E30C44F9A53825FBE2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705454413, "uuid": "e7ff9483-1105-4fc6-a285-6dd23afa022a", "value": "6144:xC2zuTvvo63DkBmwlu7xIQCuQJ9OMiJGxOA:xarvVDkBZlAnCuQJ9OMGsX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705454413, "uuid": "fffc4190-2f4a-4643-9f60-9b1254a701bf", "value": 356836, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705454413, "uuid": "b0aac43e-bad2-4554-abdb-b5acdd52103c", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705454413, "uuid": "685314df-5e5f-46a6-8d86-611ee87543e5", "value": "SecuriteInfo.com.HTML.PhishingMS-ALQ.32292.21300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c2e4d1e-b555-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Socks5Systemz)", "timestamp": 1705508791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508791, "uuid": "f99b4187-5c0c-4465-9db5-831173eaa1e7", "comment": "Malware payload (Socks5Systemz)", "value": "b5752b657f8bec96dd535a406f90cddb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508791, "uuid": "e7409e35-eb7f-4e8d-a1d2-be50d0f3fc93", "comment": "Malware payload (Socks5Systemz)", "value": "a4540f539c10b3626bf576314689fbe889b93c25dc836b9f77d3facdd6b9f3f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508791, "uuid": "a0970a68-bd9b-49c3-ac4e-1e54abcfb411", "comment": "Malware payload (Socks5Systemz)", "value": "5ab1e874cb6c4de6fe717b433f26a10da3990b4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508791, "uuid": "34df39d0-964e-4ecc-98a8-a5a4a0cfaaa7", "comment": "Malware payload (Socks5Systemz)", "value": "3cb7e70576adeaceb7f6b41312ed568e3899028473aa4fb50af6ebfa54ec9ff6be64974416f4563737223f2f3818b299", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socks5Systemz", "colour": "#D268CA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508791, "uuid": "c05f1bf6-6b46-45e5-a9be-772eddf4cf37", "value": "T1B116336079118C75D173A2BC2F5B810D94B7BB271D3436A02B4FA52FB7F2991929E383", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508791, "uuid": "e67cff16-6867-4188-8c72-c7b03c938cd3", "value": "884310b1928934402ea6fec1dbd3cf5e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508791, "uuid": "c32f0d8d-e1cc-408f-b932-ead0f681ea70", "value": "98304:NfRmP+IPu8TOftsEnebcyHFoNr2LAmct+XZxYFabxSOctUJekM9pZd358:ryn28CFs4ebcyHzJZyFawOIUJev93k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508791, "uuid": "f5c0e1de-97bd-4f85-84fc-1a0c0baa8546", "value": 4286559, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508791, "uuid": "5b4059ac-2b0d-4be9-9809-dfd2fb3414d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508791, "uuid": "2d45595c-09f2-4464-96f8-61aa68ec53be", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "658c4234-b573-11ee-b7ea-42010a9c0006", "comment": "Malware payload (BlankGrabber)", "timestamp": 1705521772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521772, "uuid": "04bab535-36f2-4af4-ad68-3d6bc1e0c482", "comment": "Malware payload (BlankGrabber)", "value": "7c8c2e4beb09b7ad7376d727ba307a60", "object_relation": "md5", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521772, "uuid": "72979fa9-1ece-4f33-86cc-c15a96cb95e0", "comment": "Malware payload (BlankGrabber)", "value": "a561cdf60b18b9a09f5d0c5bceb6d7b2a1c8c6c6b2143652b3697eea901c94a7", "object_relation": "sha256", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521772, "uuid": "d67a831a-bb29-4ca6-ad0f-916d8f8ebc32", "comment": "Malware payload (BlankGrabber)", "value": "7a108b86e54d938472a456d729bf9d758cc0c8d2", "object_relation": "sha1", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705521772, "uuid": "a54c3fb2-2f3c-464e-bb83-a22a7c2b4544", "comment": "Malware payload (BlankGrabber)", "value": "9d6b2a05767570302d068771e0d76b73498d6dba026d5c57798e3f9718802591e57908cbf1daaae8e30b6d446cf5d6a7", "object_relation": "sha3-384", "Tag": [ { "name": "BlankGrabber", "colour": "#21B759", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705521772, "uuid": "4d67342b-a580-4d58-8080-a40c1237bba3", "value": "T1227633A9677019FAF9BAD33DC906C816A771B13443A4DBD743E0822A1F136915DBFB02", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705521772, "uuid": "b04f450b-98b8-4f52-8f86-930b59317cc3", "value": "1af6c885af093afc55142c2f1761dbe8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705521772, "uuid": "82502e3d-452c-4f21-a270-7d0f81a8f5c7", "value": "196608:tDV1tB6ylnlPzf+JiJCsmFMvon6hVvvJN:3BRlnlPSa7mmvo+JN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705521772, "uuid": "f7506d09-b566-4cd0-bc2a-990ab2c7ab10", "value": 7137320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705521772, "uuid": "f0f486e4-a06a-4f57-8fa2-c93eb8066204", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705521772, "uuid": "4da9caa2-a0d6-4d37-ab27-0a14686a4b0c", "value": "Token-Joiner.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "018e6f22-b549-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705503565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503565, "uuid": "f5767c64-3dc3-4577-beb2-763fec6ab211", "comment": "Malware payload (GCleaner)", "value": "47f1ee88cd07401d581c5ef360031dae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503565, "uuid": "a0119109-9390-49b8-9d61-af488c8d76ff", "comment": "Malware payload (GCleaner)", "value": "a71458783348e50fb126e50367c84b24ffbd4b96abd54bad852dc2a44b234abe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503565, "uuid": "3d923116-4725-44f2-a67c-39be4bc53c91", "comment": "Malware payload (GCleaner)", "value": "48ef75ea7224f7dd794c9ce2c3c9786553d785ca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705503565, "uuid": "ca7260ea-007d-4eb5-aa0a-782ee4b338d2", "comment": "Malware payload (GCleaner)", "value": "0163d42df749fc953e6890cb988c59675e3c5f7daaaa53fac069a964647b301d1cc35ae815007b051574a6b855315589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705503565, "uuid": "a43e0607-0561-4533-a2a6-d7964a64b019", "value": "T1B564194392E17C51EA364A729E2ED2E8761EF5A08F4977EB26189F5F08710F2C173B14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705503565, "uuid": "a93b614f-974e-411e-a696-0dbff0e7b9dd", "value": "6a82571846565f453f73685034f8f39a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705503565, "uuid": "0eb2529f-1dfb-41cb-b080-942bb9d4d213", "value": "3072:dCG+tliylaOLugk8x158DZN0WnybXsg+cLMU6sY/+W5kOQHT5brCO+f4qqx:UTqylRLugkU158/3yjLMUByyrCO+K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705503565, "uuid": "b0ecffd7-54a3-47ba-a799-eae530dd8a75", "value": 309248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705503565, "uuid": "f3cb6b15-c558-4cda-8305-d1241d288dc1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705503565, "uuid": "1c5240f9-9deb-46e5-ae5f-edc74b43e441", "value": "inte.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4974911c-b4d3-11ee-b7ea-42010a9c0006", "comment": "Malware payload (LummaStealer)", "timestamp": 1705453005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705453005, "uuid": "c0f8a585-55f8-481b-852e-90bc3e1240b4", "comment": "Malware payload (LummaStealer)", "value": "6e018065a336cc9d659cf19040dbca45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705453005, "uuid": "ff930637-ea0d-4e4b-a3e2-cdb0468111ee", "comment": "Malware payload (LummaStealer)", "value": "a7356f11fd5c9c5e654a06e96cdbb81781e90ee4ec5b3e315d1b9b183bedeaf6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705453005, "uuid": "5876f72f-11f2-4c5a-b048-98d300d8580b", "comment": "Malware payload (LummaStealer)", "value": "61e1de163e0767d7ea5e9c590f4c18f67f7b06f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705453005, "uuid": "a85f73ba-9bad-4c34-a4c9-d46e7560d25e", "comment": "Malware payload (LummaStealer)", "value": "e904f8254b6e6f03ad30b4c3f8c7e5be721acc35f8f813d5ce22ba3d22e93a280d5774cd0e8de13f3636af6c788ce980", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "LummaStealer", "colour": "#4E512D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705453005, "uuid": "2a4efb9e-9fc8-4291-a44d-98c46001da4b", "value": "T187D47C22A0B3F065CA1F217A0608F77BF72B9CC24351C8A6D1848FAA58719775E75D3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705453005, "uuid": "192b7832-a2f3-42af-bbed-fd723758e210", "value": "01872e6ee81c2a9c5c63c0d52462fa63", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705453005, "uuid": "561e31e5-673b-4d24-b1d2-0695a69fc8eb", "value": "12288:YtHILsy8dW9qlCWLG3WfXFJtLZKLN+QTGvxXS4ysPdVP:gyrMCAG38btlKLXUNS4yEdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705453005, "uuid": "145ad2eb-f21a-410f-ab53-765398f6638e", "value": 628736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705453005, "uuid": "ae207260-5330-4055-b95c-d0a93ef846c3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705453005, "uuid": "85ddcbd5-2b95-4ee1-aa28-ff6dae6cba40", "value": "54ab0a7360703e7ebd6dd3ff17c6e7849c558c724bd25364a86661be69887a4c_payload.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e6ef861-b50a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GuLoader)", "timestamp": 1705476743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476743, "uuid": "a069bee3-4338-4853-a450-7b33add512b5", "comment": "Malware payload (GuLoader)", "value": "905307b539b9d685982f75ec4fddac70", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476743, "uuid": "9afc032d-52b0-4121-a5b1-b8808f4ea732", "comment": "Malware payload (GuLoader)", "value": "a781faa7bf736f91f9557bf70e84625702f806eb7fe3b0aba98b44e21a93c5cb", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476743, "uuid": "6eb793e0-5925-4681-9993-e8f31dd02b77", "comment": "Malware payload (GuLoader)", "value": "b021250b5abb277f3c8f0070704e3d495f2c61e6", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476743, "uuid": "b7acb94e-d4f0-4d43-9ed7-22a9073a4fab", "comment": "Malware payload (GuLoader)", "value": "f442bd29b1c44b62c3db7feed0d27172b46f7dd87f7d9a5075f240075d5e00381555bf83013de4ab50a36b2d5bd3b9f7", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476743, "uuid": "5f935edf-1e78-4b5d-8fd6-bb2d55cdb69a", "value": "T17E92F456DA7E02194F8D2F45C84E38CA67E7B52FA0F515982B89F38D60C660C32F44FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476743, "uuid": "717b671c-0265-4e32-87c0-ba330a9c4091", "value": "384:d5F0tcUwjlqINxPhul4uwS0asHvVZYgzrIrhlIc9IYc9:pCwjlqI8lwSpsHvVWg0hlhI99", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705476743, "uuid": "ed45e539-dff3-4426-be1f-a1cf48145c5d", "value": 19594, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705476743, "uuid": "3fd463c3-880f-4598-b05b-79326cd892d4", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476743, "uuid": "70c2fb6a-8364-4e33-99e2-0000a6eec42f", "value": "Eilbestellung BM surface systems GmbH BE2310561 and BE2311143.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ff549c1-b4d6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705454412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454412, "uuid": "51e4838a-2335-4c04-964d-8e3e84fa786a", "comment": "Malware payload (RiseProStealer)", "value": "855ab7dc7e6f028a7cf4c059e8b1a651", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454412, "uuid": "239ba553-9399-4e9b-946d-c5e7e94c0b01", "comment": "Malware payload (RiseProStealer)", "value": "a8f71eeab37da70a5817f2a4f5a30819bb927b37b9fb48ff651a2c8730c62e5c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454412, "uuid": "69af46cf-adf5-4301-b5cc-e587fe24b52b", "comment": "Malware payload (RiseProStealer)", "value": "5223f6ad552224bde5c5dceb0ef7da193618e19d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454412, "uuid": "44c3bd87-f900-42e6-869b-d38427023dc1", "comment": "Malware payload (RiseProStealer)", "value": "b91266ba54bbf93a606333eac88afd89d7166f1692d612839f4eea90b3d20355c512e59b814eb7be3c9280f31e2538b9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705454412, "uuid": "95a5f45a-57e3-4133-807b-dd73bff19524", "value": "T1C79523F036F88A8DE4E567F25BB0E62413E0ADE9CF019DE2D2531AB73B631D14256583", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705454412, "uuid": "c0ba7cc4-abfa-4953-a1fb-32c50bade6ec", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705454412, "uuid": "9938bfb0-ebe1-4fbd-b8b7-464958e249c5", "value": "49152:mOtlgDsApu5xJmJB0fm0l5Zce4viHVkYyyR/:mogDsRZm0u0l5jKi11yw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705454412, "uuid": "2e3223a9-3f18-44be-8f39-9ccef3533d41", "value": 1892864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705454412, "uuid": "60668df8-2190-4a29-ad82-efc5a36e02b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705454412, "uuid": "546373e6-d269-439c-a5ae-b5d6e1dc958d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.20091.8346", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6723ae5f-b56f-11ee-b7ea-42010a9c0006", "comment": "Malware payload (VenomRAT)", "timestamp": 1705520057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705520057, "uuid": "052d957a-b906-4cd3-b0d1-54383a7701c3", "comment": "Malware payload (VenomRAT)", "value": "a95b7d1ef3c4f8932fa97c287dd54c70", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705520057, "uuid": "f3415ad7-cc29-4852-8899-d1792c621cc5", "comment": "Malware payload (VenomRAT)", "value": "a91ab913b292db7d5791d76bcf96303ce16bddcf84e631ba109a0f0c2eb9563b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705520057, "uuid": "2d851e2f-26fb-479d-9e7d-898a23e8543c", "comment": "Malware payload (VenomRAT)", "value": "771e6c19fb90aa257f748c41539725f71ca96970", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705520057, "uuid": "c6abf2f9-4d9d-456e-8879-c1bf3600774b", "comment": "Malware payload (VenomRAT)", "value": "ce9468cebfb74a0069f9005bc2ea91e262f4a6a1e1da93a606e3deb0339433dd80ef903c876893f50ffd542c99e77c8e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "VenomRAT", "colour": "#9EAAFF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705520057, "uuid": "6b5b989f-98fc-4170-90aa-75eab1007c4b", "value": "T159D54987FC9514F4C0AAA33589629192BB71BC440F2127DB2A50FFB82F76BD0AE75714", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705520057, "uuid": "f92a6644-e885-4fe3-84b5-0b9555c9f440", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705520057, "uuid": "556cf0f4-4318-4d95-920a-92b7f44c1d69", "value": "24576:4oT0RJ0DfNYx0UqU6OOPSxjQmTOcSc9rvjlaWDXvoZWiUI6bp8psQ0wct/VWv2yP:4f/0hYjqUGPcQOOcvjQWDoZ/p6afZux", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705520057, "uuid": "678060fc-4212-489d-803b-c2cc31afa1af", "value": 2912768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705520057, "uuid": "0e133b4a-afc1-46eb-ae09-aa68381aed9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705520057, "uuid": "4c031071-e8ef-4cee-a809-94309f8a86de", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ad6c0df-b580-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705527311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527311, "uuid": "2c3010be-936c-4e8c-8057-b735ba899e92", "comment": "Malware payload (RedLineStealer)", "value": "a745445445e16286acc88b9ee4c09780", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527311, "uuid": "e44e2e5a-face-4761-8980-8ae0b2d89424", "comment": "Malware payload (RedLineStealer)", "value": "a91bb7658e6dbc479b20d040454f26a73a90574a67c7adedd6b27530dc536ed1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527311, "uuid": "2f2eaa46-9757-4c60-b0e0-e1c93e5cca4a", "comment": "Malware payload (RedLineStealer)", "value": "b9a622570121951a147d0e05fd196c4cd6b732b6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705527311, "uuid": "30dc3932-54da-4a4a-ac14-b0ce376ad18f", "comment": "Malware payload (RedLineStealer)", "value": "83efc01d44775a11d4fe308a509034d86ae471391f0ba5aa87834aae91d51e0150a05d8b091ae4e3c6eb7067e5ee731d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527311, "uuid": "091d293b-a718-4c8f-94ab-d7cbd225f683", "value": "T1F8B56B8BBCA111F5C0AE933188A695967B71BC440F3127D72E90BB7C2E72BD4AE75704", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527311, "uuid": "0b09ae8a-5377-43cb-a761-c8aa9547cb35", "value": "5929190c8765f5bc37b052ab5c6c53e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527311, "uuid": "7d91a7f9-432a-436d-8612-4b4036199413", "value": "24576:Zv1rA30Kp9xxiIuzj+jubSkNF95cu47DCR71vqpPXdavUQ0wct2WlL6LaBM:Z2kKpXuf+jcpHcu8CR71ypda3fELZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705527311, "uuid": "343b2ff7-ea2d-4587-9907-12627fc36c43", "value": 2370560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705527311, "uuid": "1cc1c1cb-1ac5-444f-ae2a-de8824cf4368", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705527311, "uuid": "f70be77c-397d-44d0-a684-86e7422b678e", "value": "a745445445e16286acc88b9ee4c09780.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5de50134-b50b-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705477091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477091, "uuid": "2a78f3f3-7048-4baf-880f-2150520ed899", "comment": "Malware payload", "value": "343ba36c23df9a56b678063da55ff665", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477091, "uuid": "eb195e1c-69f6-4bb4-b931-ba348414c0c5", "comment": "Malware payload", "value": "a9c1d8c8cb11d51a9f8b31548842c4be98d23c510ddd40d4690b837e4e27195a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477091, "uuid": "9f0ea991-525c-42b0-a459-1f88adea40ca", "comment": "Malware payload", "value": "2a8833078af0ea7efaf3fe198bcce6307ca8ce07", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477091, "uuid": "d2934fe2-e536-4ef7-b2c4-8404dfa5fae0", "comment": "Malware payload", "value": "65ca1a1383a12f82f0886e9fc332e188e97b669e07e0cc36692a6d2c4c21f6f882443fc91c74f6581c5bbea9e4f751c6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477091, "uuid": "3378566f-eede-49ff-b4bc-2758e0304066", "value": "T195368D06A7E406E5D427C630C96BDB32D6B1FC164736C74F2851D34A2E73AA14FAB722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477091, "uuid": "bfae451c-de71-4f4a-a49a-86dd5d6d79e4", "value": "c1bd85c47a3d2c5743df7292e01168a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477091, "uuid": "5e7190be-aaf1-4bec-aed2-86acddc6471a", "value": "49152:8HK1VD9nFzyJqoX/7gAgcbFStfWPXnuFHIa0riS0FyW5UcHTP+:bQxZNPhrf0FYi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705477091, "uuid": "dc2f3664-ced0-4537-8a07-1c4a2d5e4990", "value": 4934656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705477091, "uuid": "4c2477fd-64f1-468b-8088-9aace8a24eee", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477091, "uuid": "68fea940-5b85-4bab-8ecb-c9be9484063f", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433de511-b52a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705490361, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490361, "uuid": "a6718c05-5a66-4222-9307-67a345d5f45b", "comment": "Malware payload (RiseProStealer)", "value": "dc9e4b1907500bf893168421040687c1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490361, "uuid": "bae0f2d3-12a2-4366-8695-4d134de4c0d1", "comment": "Malware payload (RiseProStealer)", "value": "aa07b3ce544584685e68c4e3d5fd68bdd3c2f46d21655494e44737cbe207d90b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490361, "uuid": "b5c8db0a-8a57-4e6e-ab8f-3e64a04a3fb2", "comment": "Malware payload (RiseProStealer)", "value": "60c50c957ad9fcc223fb7a57555851fb17eaa7f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490361, "uuid": "b593cb3a-b692-47b0-8518-8720ddfffe43", "comment": "Malware payload (RiseProStealer)", "value": "efc50154650355199b26a4edd55c1319f95f42f29e94dfa86f87dff0d4e7cf82008b1c8c24f7e3d01660c8082b602a65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490361, "uuid": "f4a5eaf0-6d61-45c9-ac75-28451e90fe04", "value": "T1B89522F672F8459EC4E813F41BB1A3B106E26ED5DF544CD6E1B7289A3B0B6C01A1342B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490361, "uuid": "75dbbf91-ee6e-4496-b08d-f691811c4c3d", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490361, "uuid": "f3b44a6d-6d9e-4c9d-a08b-157d0bb9dd2c", "value": "24576:YMNZKmmRHYN3GDV/y8C68+VsswGR/okE4Wa82ZtPdMlEDUlDf8fNN6n+FV3yZILs:rZURHYUDr8EsswGukn82POEIGnJiZfS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705490361, "uuid": "b77fe60b-6f0c-464c-9b8c-3e0f6f28cbec", "value": 1878528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705490361, "uuid": "3dc2bb01-bb51-4766-9a29-7df241ff98d9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490361, "uuid": "a7fa7279-076a-4fe6-8e95-bf75cff80113", "value": "SecuriteInfo.com.Win32.TrojanX-gen.4722.2440", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b5af47-b503-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705473756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705473756, "uuid": "033a5448-f031-4ab4-a810-f34a1acee695", "comment": "Malware payload", "value": "e3447210fe61037f8afd2e3a5e1ebf96", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705473756, "uuid": "a6d6cf31-5001-4902-bb6e-4369696e7f1f", "comment": "Malware payload", "value": "b08531ffd6f9e4169c49b996f4f8d4a5456c5cdce63dff2e4bc0d04cb0e9a0e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705473756, "uuid": "17b3753b-f9f4-4e78-b0e3-c71c33b0d1d3", "comment": "Malware payload", "value": "c549ccfca38b654af3e95e53e678b1ddc2528bed", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705473756, "uuid": "e6e6c504-a44f-4f92-b4d2-78ac419253fc", "comment": "Malware payload", "value": "df6a5e42294f5dd7f72f9e899ed101ea9140b53eb047d021d162d59bed644380b34c08f81ec55bab1cadc1ed17f686c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705473756, "uuid": "b44061e5-805f-4167-89d8-e98d2332988d", "value": "T1755533352EA1719BC628B5F624B0D32AD2331514A7B28C60D6CDCD6DB7B363B6B1D8D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705473756, "uuid": "03d488b2-e1a4-45ef-a94b-bf9d773ed6d0", "value": "fc5d3d653af3c3decf6e755f0007c4f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705473756, "uuid": "9ed6e9c1-ece5-47a4-b114-a0e7c284002c", "value": "24576:GiVUvQd7LE6g5XKhvGieFgzzrrxFUVvkvcOwATsPdIGL6IlgktwSYPvFIDEl:JVUv4LvGdFgD1Lk0TsVITAtwSY1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705473756, "uuid": "6c8823cb-8f2b-4c0c-8751-73796d6f2ae1", "value": 1389568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705473756, "uuid": "40393d7a-7602-431f-b488-54d7604d9aef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705473756, "uuid": "f9fd5199-f944-4b5d-95dd-59bdd26abc9f", "value": "e3447210fe61037f8afd2e3a5e1ebf96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1a359e-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (PureLogStealer)", "timestamp": 1705501977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501977, "uuid": "2ba73a6a-4023-4758-be49-52122948c88e", "comment": "Malware payload (PureLogStealer)", "value": "f482bd47cc651f86bfb8dd25605422f1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501977, "uuid": "ef2f65bd-9ec7-4317-b191-00cd3eaed4c6", "comment": "Malware payload (PureLogStealer)", "value": "b1398b586db65eb82d0cb0ab8bc6065c987fbbbfa6c11678f0393a2842a3f793", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501977, "uuid": "3d0b1842-f27b-4116-92ea-c62e878ae8e9", "comment": "Malware payload (PureLogStealer)", "value": "7ac888e6d028762d05199e0468c85aaff2c9b1ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501977, "uuid": "a488f6b9-122e-4fb4-ad52-a289217a9be7", "comment": "Malware payload (PureLogStealer)", "value": "7f25bf419ac6a544e1898d051465b161cad8c167da101e89ee84c42b79a7d845001910be22ba9bf52f7e5c77247382be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "PureLogStealer", "colour": "#622CF5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501977, "uuid": "f421c4b2-efec-4746-99a7-bdfd364e4785", "value": "T1B6653308568D3803D3EDA63529B5764EABC0D3F37B275603C0A018619763BF8BD56AD3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501977, "uuid": "b6eab275-bb92-4955-ad71-f3ed495f2de9", "value": "24576:BbSOO1PluhVI2MQ0epBtdrQUecyECkq53tZ+PXyGbTTEo+YTXwTwaQKo+RundcAQ:zOpwhVIDWpSVcyGqzZ+PigTTJrz6o+Zd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501977, "uuid": "7c1ccb12-1aef-4942-baf3-6b5813aae888", "value": 1459712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501977, "uuid": "a380cfab-6648-41e4-b66a-8185c35275c7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501977, "uuid": "3d1d5dd8-de83-4c1f-be71-cb0fd57a19c3", "value": "HSBC payment_copy 0020241701 09847448349928 pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97cfb04e-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (zgRAT)", "timestamp": 1705502099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502099, "uuid": "050505e7-2efc-45a1-9705-540539bf42db", "comment": "Malware payload (zgRAT)", "value": "c4a7fef41e261004d3e0a993709d62a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502099, "uuid": "fd5d328e-f73c-44f5-b0a7-ba5e83c857e0", "comment": "Malware payload (zgRAT)", "value": "b2df3846c90eb1260ae72dd6308d235596431f80fc62e131081de0862bec9f12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502099, "uuid": "cd901b2e-7bbb-45e0-962a-3075598af626", "comment": "Malware payload (zgRAT)", "value": "dfe41d7227928974e84637a0bcccac3ad482787f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502099, "uuid": "de16b578-b722-4bb6-b2e9-18c7ec798c9f", "comment": "Malware payload (zgRAT)", "value": "6bcfd6bf44ca89b210a79ea35f4724a24705e489d9ab7ec1ab170c2d370e9a799e82d06c20c95cb25d03538721e0046f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "zgRAT", "colour": "#B7C2AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502099, "uuid": "63baaddd-f70b-4231-90d8-a1a7e4f609ea", "value": "T16F034B0CBBDC6612D66D557EC5E3900463FAB3F33612D35B6EC422691983BE3A909B43", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502099, "uuid": "4bdfe7cc-b3fd-4f68-905b-60b2b91c28b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502099, "uuid": "f22b114c-0c07-4ed7-9bec-88d5814e45e6", "value": "768:tyuhzW5L7eWn9ldy7eo4iaOoJCdcYs+QFg9sn+2q0ToP1:tyMu7eYyY3OoJCdcYsTnXqeot", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502099, "uuid": "29efd767-35c7-4e9d-8c35-1273c1a9d487", "value": 37888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502099, "uuid": "c708c16f-92ec-4803-b737-c0048f065a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502099, "uuid": "442c5e16-cf82-44b6-b5ce-57e639a20e88", "value": "hesaphareketi-01.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "679ac047-b50b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705477108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477108, "uuid": "c5b71805-4298-413b-b65a-248e5341359b", "comment": "Malware payload (AgentTesla)", "value": "3111fd2a036e35ff76947b4c8b8a4939", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477108, "uuid": "1d98b626-23dd-4cc4-930d-f1af4caea119", "comment": "Malware payload (AgentTesla)", "value": "b75b7cd9470523130d3983b9618fb8a010042ec85a158cb2215f3ed56fff8e5b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477108, "uuid": "e7efd3f0-16a6-49db-bcd4-7549fcfe03f7", "comment": "Malware payload (AgentTesla)", "value": "68e4809ba279cd3306f58847e297e65150a2e3dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477108, "uuid": "53461f24-2a7e-4a9d-8b2f-e61ed2458c4b", "comment": "Malware payload (AgentTesla)", "value": "4816c10da1395185053d28420d7d9c41e581b124174ef9615e3c33fbbaac26fe5fccb3cc7e09ebe9068418755491f8c7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477108, "uuid": "a7c0ce85-ab2f-43a3-b977-f6f13a099456", "value": "T106268D06A7D405E4E46AC734CA6BEB32D7B1FC660636C74F1425E24E1D736A09FAB321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477108, "uuid": "8c1c69dc-7a17-449d-87e7-92ff5931a9ed", "value": "c1bd85c47a3d2c5743df7292e01168a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477108, "uuid": "454255d2-eadb-4950-9d59-739c19e70284", "value": "49152:w0javmGToH2HZt5IduMknWloDjuF0xnkzRfeRiPXOvfQmBIGVrDJ:9HkWlocJk5ZDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705477108, "uuid": "5e23821e-d507-4608-9826-daf566ddc7e3", "value": 4802560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705477108, "uuid": "3a934c03-d3e8-4a00-b051-ca08cbfab360", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477108, "uuid": "4e32122a-bbab-405e-b0e2-39ee653dd448", "value": "New Order PO #104746-RS2Z2948.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f898c43-b519-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705483107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483107, "uuid": "8e0a7c22-1856-4481-8a4f-f4378ac2f908", "comment": "Malware payload", "value": "ee5ad2bde820b99f1c7376cff9dc983b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483107, "uuid": "c8f02ed9-4814-4ec2-980b-ab6dd3d2d32d", "comment": "Malware payload", "value": "b98105f9b3ec235d7ff3ec3941186e049ced4cbd9dd5e6574a99b0a82b88279b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483107, "uuid": "d22e8c3b-47c7-49fe-af9a-a5cbc314f598", "comment": "Malware payload", "value": "664379dfa3ad7fa5c0ad39341ea6aaa52cfe7949", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705483107, "uuid": "abd7b50f-2660-4054-b972-90fe8fcec299", "comment": "Malware payload", "value": "6afc6118ea6104706b73fbdd50b26c8117b1d6135c208cf542ba02c7198d913ab21e2880b29dc1b73e19552ec876ea96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483107, "uuid": "5c07080d-2379-4509-8686-381c5f99eff3", "value": "T1705533C1692E283FEBACBE7EE9E91B551E78AC124ECAFD7365207614C67F8121C41C44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483107, "uuid": "c9ada35e-bc60-4f95-968b-ac331932690d", "value": "fc5d3d653af3c3decf6e755f0007c4f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483107, "uuid": "5d1e342d-dd39-42b9-b209-63cf16c08b8c", "value": "24576:itA8KL0SlwervO/QthjwrgDCNkD/9tU4+9taZIbnjZiJUoyNjw6+GRj3fuv1aCtb:O+PrmYzjpDT/TPqtaZ8cJUoCywvtWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705483107, "uuid": "9a0ba1e5-5452-4c01-9954-6311c9f1dcd0", "value": 1389568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705483107, "uuid": "1ab271d0-e06f-439b-aa39-b44c8c564928", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705483107, "uuid": "3fafc8ba-76bc-4087-a05e-3ce54acfdc31", "value": "SecuriteInfo.com.Win32.PWSX-gen.12834.19185", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4263932d-b52a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705490360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490360, "uuid": "c2ee2d5b-14e3-414b-8e17-7befcab6d92f", "comment": "Malware payload (RiseProStealer)", "value": "e93f6d96f5bcac3311b413611a26ef87", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490360, "uuid": "3c18e88a-a4ae-4b01-a0d3-57174dd34866", "comment": "Malware payload (RiseProStealer)", "value": "b9c486d355848dd0682d2d58b075fa589c04337a40fbf0461482a4fae86cb55f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490360, "uuid": "d31b0db8-b485-407f-ae63-1c747bc4654e", "comment": "Malware payload (RiseProStealer)", "value": "ba4db60723af4ad0315c7383e09df3e02761371e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490360, "uuid": "57bf3719-f8a1-4459-8545-4c3c846e3c1b", "comment": "Malware payload (RiseProStealer)", "value": "592e1930524e2e90d8a35ddcd59b5d26771a85c00c172d1b77922da8fc8bda9fd15069ac70716940d0d6cd0dc38c9907", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490360, "uuid": "b7b71421-d81f-4307-bb09-50af4eeefdff", "value": "T1019523F132F9985DDAC413F50B74A2A445E05DD1CFA81EEBC0EB5A567B036D2AF81223", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490360, "uuid": "cf8cf7c8-1e94-4deb-ba06-80afe9297dd6", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490360, "uuid": "1dedf22d-9c86-4b01-a857-d42cdbb474e3", "value": "49152:9pZuSzAMcefxSYJLQ1B7zJR+Q9XsjIaUpUPOif2:9p7sMrfxpBQ13R+Q9Xsjozi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705490360, "uuid": "6f5d801c-3e74-4794-a5b5-a870ab2916c9", "value": 1875456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705490360, "uuid": "e930b110-c1f9-4d91-8826-1a96f9e60917", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490360, "uuid": "9ebcbf2e-3991-4f06-ab50-17479ff8a42e", "value": "SecuriteInfo.com.Win32.TrojanX-gen.28545.18188", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb46486-b511-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705479910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479910, "uuid": "f5bb98cd-206b-4c6d-9c13-ff7176fe3943", "comment": "Malware payload (RiseProStealer)", "value": "a729005d74c0cbf4cec7fc1a8b1a6fa5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479910, "uuid": "c7f97c4e-b8ce-429d-8694-67f9a9afced8", "comment": "Malware payload (RiseProStealer)", "value": "bbd8463a08d0e70c418462de033120bd63b73387ac5272c181277552e01bbc39", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479910, "uuid": "998a3c4b-78eb-423f-8a1b-18b1ae97038f", "comment": "Malware payload (RiseProStealer)", "value": "df9aa6ce677595d96c04fef06f5ae05b15bf1b0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705479910, "uuid": "60839ba9-1b1a-411f-81f4-dad8543519a3", "comment": "Malware payload (RiseProStealer)", "value": "464603a73a0116009e50ee7306a9848e40d965e56205750ce023d9bcadfb46a5ec71dfae3f05e5c1475ef240cb74ab6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479910, "uuid": "428a6be6-59e0-4f8e-aa6c-3687829dd8e2", "value": "T1539523F03AFC054DE6D62BF48B74A95213DA4CD2CF889ED7D1E70802776B2D42A26517", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479910, "uuid": "8ef5d3be-b68e-4d77-a5a7-6f60f07fa7b7", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479910, "uuid": "22465b15-dc28-4e45-967e-a9a220220b47", "value": "49152:EeGE/A6o3Tlj81Yg3DcA14VZHPLzheZA6Hz/:EeY3R8+gooKHzIAGz/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705479910, "uuid": "21880429-f167-4714-98fa-5bae899479b7", "value": 1879040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705479910, "uuid": "74a2da44-c91b-45da-9fd5-66a1c89a6ea5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705479910, "uuid": "74eb0004-b970-474d-b88a-ed853e6cdf2a", "value": "SecuriteInfo.com.Win32.TrojanX-gen.22314.21124", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26571186-b4db-11ee-b7ea-42010a9c0006", "comment": "Malware payload (GCleaner)", "timestamp": 1705456382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705456382, "uuid": "f10f5dcc-569e-4e2e-80f7-a9202258ada8", "comment": "Malware payload (GCleaner)", "value": "65db7d8dda18a561c0222dbad11243cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705456382, "uuid": "a9bdf1f9-e010-48b5-9c77-2a7a61e1033e", "comment": "Malware payload (GCleaner)", "value": "bc3d79237df26d3241349aad5337361538a88ffc6f66226a24a6231f5fe0deb9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705456382, "uuid": "644a826a-aca3-4551-9dfa-43edf4d5efe7", "comment": "Malware payload (GCleaner)", "value": "424149e729a3ba18c226c9234d396a36c1364e38", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705456382, "uuid": "3d9d4ba0-837e-46b2-87b7-bee296a5863b", "comment": "Malware payload (GCleaner)", "value": "098c2053b79164c7a640c08fe87bea762c1a8f1a91c1bab4d1da507b4382e97d0a05724c687ab844bc70b56c7baf2cfd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705456382, "uuid": "e5b8dc1b-4e62-49af-a473-5cf5625a43ef", "value": "T13116CE1137E49F2AC56F4A77E8B1051607F5F9876392F38B52D4A2B82C937D18C883A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705456382, "uuid": "338e697c-6a28-4089-890f-d1cf22e0954f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705456382, "uuid": "e93274c1-2fdc-49e5-b2d9-5acdef9133f2", "value": "98304:8mrnVIqALSdXHkrIjb0PGYyAONHH8QmR9NIkMPffWcaG:8mrnVIqAL/Ijb0PpONn8bNxMP2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705456382, "uuid": "6211504c-cdf6-4183-85b1-d531533e73c3", "value": 4280832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705456382, "uuid": "90253cde-6b3a-4376-8b0e-2bc01bdacf73", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705456382, "uuid": "d17616ab-b0ef-4376-bae0-c660386deffb", "value": "65db7d8dda18a561c0222dbad11243cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5349f725-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705501984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501984, "uuid": "1225be6e-1942-4388-b8da-9fdee740870b", "comment": "Malware payload (AgentTesla)", "value": "5b9ceef22111f9ec198bf344d83234a7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501984, "uuid": "b58b6a3d-229d-46a4-a575-dac517bf6fa7", "comment": "Malware payload (AgentTesla)", "value": "bd78ecae205703d7efa045dfd85bd9e73854fc19ed71ce8acb8d1342ef083bcf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501984, "uuid": "a373899e-f16b-4355-9e6d-30554bbfd878", "comment": "Malware payload (AgentTesla)", "value": "23cb7d9f8e07555e0be0ac70d319239889935efa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501984, "uuid": "c2aaeb54-1758-4c1d-ba35-37b620ddf2bc", "comment": "Malware payload (AgentTesla)", "value": "7a8f96a770da9a944fee35fc217dc22cc95ff59712cdcc54be1f89e715845e2b520cf5e215b5ab9433b98da87f49bb52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FedEx", "colour": "#D1A78F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501984, "uuid": "cc5dec88-ee8f-497c-998c-e85e90bc4517", "value": "T15DF41226B7B3DE51C2DE6733C2CB81244335DE466163CB493AC96364055B7AB6E063CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501984, "uuid": "e8bff0d1-f66c-4177-8733-018a7818ea7a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501984, "uuid": "67198502-8ab0-496e-b6cd-7bc6cc78b014", "value": "12288:vWqgEzCB2s2iNhJz/IIHF3fKqHhGnr4ni/nfInjShUzjwXYGGfLnSu9wRJcpgRA5:u9B2s1HJz/IIHFv9HhGHIjxjTLnSX4lX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501984, "uuid": "218cbff9-81a3-4efc-9f9d-7e27fdeebae3", "value": 765952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501984, "uuid": "0923d571-2d97-4f95-867b-0894fcd8a823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501984, "uuid": "e0826154-6d8c-4185-af24-0061c3a20aec", "value": "FedEx Receipt_AWB#883053232014374654.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c890218-b517-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705482163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482163, "uuid": "5ddbbdee-d5f8-4e52-adda-553e121692b1", "comment": "Malware payload", "value": "b9d46337b5785a1c60f2b6e566bd2265", "object_relation": "md5", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482163, "uuid": "26b622ad-2680-440e-827b-0929c662d8f2", "comment": "Malware payload", "value": "c3e3767463a4713866535ca99d9fa4de3c655bad67b7c14131754b463bfb1988", "object_relation": "sha256", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482163, "uuid": "20fade79-8c7c-4cce-85b2-ae37b98d3eba", "comment": "Malware payload", "value": "6313dfea28d712ac93a6d3ac1858205e9c962d0f", "object_relation": "sha1", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482163, "uuid": "d9cbadc1-296b-4ca7-9419-a9c491420ad2", "comment": "Malware payload", "value": "5f66873d465bab9d7462458efd0a5345cec48c7bfbebcd67ce37664e7f89dc895393ceeccf25383e0a9c1a002bbcc40a", "object_relation": "sha3-384", "Tag": [ { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482163, "uuid": "341841ad-e888-4997-9b42-a2fc14952d37", "value": "T1D9C18E4AA5DBA36FD041C9B6FD5755131F88E9C2732F2F11854042922CFC142EF6E28A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482163, "uuid": "1bb983df-fcdb-4962-9c14-b5f9e20341a9", "value": "96:17SBOy9Y+lgFgLnH2OtmfkgM8a/aWD2e2WrVBmIr3srq:17GONgyOt+tOpD2e28GID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705482163, "uuid": "5a1efea0-b1b2-48ff-955b-c654e2da77db", "value": 6114, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705482163, "uuid": "f8fa5c11-6fb5-4839-b0a6-c37d11135535", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482163, "uuid": "7285f395-1f21-47b8-828f-bc0d3993f009", "value": "R34567976543234567_D45678.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fef789d-b53b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kuiper)", "timestamp": 1705497764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497764, "uuid": "9c7400c1-efd4-4368-810c-a59c9759a081", "comment": "Malware payload (Kuiper)", "value": "0bfe64b866911620f273a1d306984d29", "object_relation": "md5", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionC", "colour": "#D4039E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497764, "uuid": "b690eccb-d8c6-47da-bed5-ca3c2d3ead73", "comment": "Malware payload (Kuiper)", "value": "c66590a2ffbe53667be147c4e74e626764aff9eb31017dd8b8f161279fd0f4f6", "object_relation": "sha256", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionC", "colour": "#D4039E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497764, "uuid": "38532f4e-974e-4b97-8618-817511131017", "comment": "Malware payload (Kuiper)", "value": "4371132451177999fde66054fc84382a94f606c0", "object_relation": "sha1", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionC", "colour": "#D4039E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497764, "uuid": "d3b2038d-2337-4efa-a4cd-9d04f620fd03", "comment": "Malware payload (Kuiper)", "value": "d5d6a6110e145cb4ab8ed5e4ea7a862d39e6c9469941861421e49d1024752903968dfc23fab35f3eeddb598fe6cef6c6", "object_relation": "sha3-384", "Tag": [ { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionC", "colour": "#D4039E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497764, "uuid": "9ce7305f-606d-4ccd-a78b-8a6cdfe64fc7", "value": "T1DBB53A43BC9085A0C0AAD231C9B6A283B720BC891F2167D77B14FBB92F76BD45D79345", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497764, "uuid": "cf62cd5a-f913-46df-bb33-508e656982f0", "value": "49152:ihqI6Sorb/TVvO90dL3BmAFd4A64nsfJ3zy97kA49ctND7bg1tNeMmzq16kf30:2YACtB7QiM/f30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705497764, "uuid": "56430df9-283e-4841-b9e3-be0ed82cd861", "value": 2390096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705497764, "uuid": "4819c05a-ebac-42db-9207-c2753d9b0658", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497764, "uuid": "5835c308-331e-4e78-84c1-419ce6c04c8a", "value": "C.MacOS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f1d6ac9-b4d6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705454411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454411, "uuid": "afd89496-190f-44a6-aa4c-2789f20e406c", "comment": "Malware payload (RiseProStealer)", "value": "25ad333f2ccbfef09ac64bf488bfc5d8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454411, "uuid": "dfded4f5-557f-47c8-bd1c-25b0fee38a8f", "comment": "Malware payload (RiseProStealer)", "value": "c76bf58d8029f8ac6a9a1a93df2b180a6fe2a75d55f5e56267adab44d2ba82eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454411, "uuid": "e7306c04-138e-48a0-8192-1af61fedfc63", "comment": "Malware payload (RiseProStealer)", "value": "cafb076b871543c5e38d760e148e1bc145bc8df6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705454411, "uuid": "e21c1e70-9abd-4ea2-9b03-cbef954193b0", "comment": "Malware payload (RiseProStealer)", "value": "afdab01b1e7f840afb8937b1b607fe302818038f6ec873210d0acad2e190f6082c3fb5131afaaf2aedcddc9ace4e9d0c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705454411, "uuid": "6b8be93c-93a3-4741-a291-7ed8a4a98d86", "value": "T1369522F833F9558EC9CA6BF40B36A7A805C82DD8CF614EEAC5E76A1337074E15A12057", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705454411, "uuid": "08d065c9-0831-4900-9c2b-06c606f34466", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705454411, "uuid": "78b543da-33ca-4509-9293-8ae778f9a23d", "value": "49152:NIjQlX/Y5FZeAYmJV8ZIxnf6qBhuHSvM:OMl/NsvxjCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705454411, "uuid": "43b0d212-1178-4097-b2dc-1711b8faf3ed", "value": 1875456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705454411, "uuid": "07bb7d8f-778f-486a-be77-0815fae1bb27", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705454411, "uuid": "20a7e99b-329e-4435-afb1-ae2806dba9eb", "value": "SecuriteInfo.com.Win32.TrojanX-gen.16418.30500", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e674fbb2-b4e6-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705461429, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461429, "uuid": "be5d9370-9553-4201-b47c-32cda544ff7c", "comment": "Malware payload (RedLineStealer)", "value": "002c758143bb580557550f96c19245cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461429, "uuid": "5980964f-5c8d-4ecb-9fba-e59a6e0c67ef", "comment": "Malware payload (RedLineStealer)", "value": "c78e16c24009a2b49406717ed0e2bc22e164de0d7aa5b21c4bcb19af5e01ebb0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461429, "uuid": "e08667f7-8361-43e4-9af4-9a56d806487a", "comment": "Malware payload (RedLineStealer)", "value": "de28d1da4c0359fd4616400215305c464dc4b61a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461429, "uuid": "41377e16-f042-4a6f-be73-f102f6c0ad13", "comment": "Malware payload (RedLineStealer)", "value": "ac875223e4543825324cbb905c4a56d6aa846da8a1c50bc69f770b8ff99a0e932269073247aa94de3895127f9957b527", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "WEXTRACT", "colour": "#27E3B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461429, "uuid": "e405e408-a9c4-41ea-b016-6e4894e220c3", "value": "T1F406334406D0869BC42777781CA5059B7B75BFCBBA30B313678B9A8B0C72A6560783DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461429, "uuid": "f1a4bebd-1a68-4c42-b99d-550b80af2632", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461429, "uuid": "56e99766-3643-4a06-80fc-222c947bd003", "value": "49152:OrMneQCKOBrFuxUg+xouKyWIQQoKpTgdZ1ryoi3iTq4R4UbERr54mTc2sacJpW:OqoByqPkIQQBer1rXPTqI7bEJJhlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705461429, "uuid": "3663ce61-b753-4102-b8a6-364a088d561b", "value": 3834368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705461429, "uuid": "67f4f95c-0c87-4150-8c8d-dfc29d7d3768", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461429, "uuid": "84f71120-6cad-448f-baed-d5882e1d87b7", "value": "WEXTRACT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5cce85-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705502058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502058, "uuid": "4ae994de-0dc0-48fc-8913-8369cb08fdad", "comment": "Malware payload (Formbook)", "value": "929f79440ccb1bed77cd171edfa40c12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502058, "uuid": "834b0a58-bf86-4174-b05f-10962ebebd7f", "comment": "Malware payload (Formbook)", "value": "cc0b087b36165f23ad4310a9e0c940b40e8b249fd6632d1e0692bdaf50b03850", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502058, "uuid": "43db9cf9-38a2-4aea-a395-8c5befc92258", "comment": "Malware payload (Formbook)", "value": "783e923b690b126049680d0c21b7dbaa8c38b9aa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502058, "uuid": "dc2a7f3f-1a27-4192-a2aa-ddf52f14a333", "comment": "Malware payload (Formbook)", "value": "aa3423d2dd2eea1b45d74a49e91936059319874dcd0794899cb474f72bef802eb575bcf721cff22535db13dfbc29497f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502058, "uuid": "30531879-8bc7-4ab7-b9b0-dd37a69f33c9", "value": "T19355BF0273819026FF9B91320B96F61DC6BD692E0123E51FD3583DB9BA701A116FE763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502058, "uuid": "39e50b17-8885-4819-a1af-9b2b239a3633", "value": "948cc502fe9226992dce9417f952fce3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502058, "uuid": "b6fb14b5-6c01-46f3-bd69-0b7cf7742405", "value": "24576:jqDEvCTbMWu7rQYlBQcBiT6rprG8a28TSRFC/2Ej4C9lf:jTvC/MTQYxsWR7a289Xl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502058, "uuid": "06539014-c48b-4b79-a925-601710539533", "value": 1319424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502058, "uuid": "28726ab4-462c-4e78-9f18-b98ea31d2429", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502058, "uuid": "78733d37-a071-4540-9392-e94391b09a6f", "value": "e-dekont.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22b28283-b56e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705519512, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519512, "uuid": "14999f77-d6a6-4afc-b0fd-e45d51eaf37c", "comment": "Malware payload", "value": "4e9bf8bc3946a2a40e9db9586b2de9fe", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519512, "uuid": "50f7a3aa-499d-4ea1-a0db-c40720a53b31", "comment": "Malware payload", "value": "cdc95fc581fa222f95765ac539fa417e86e453cc5c18fce22e9cee11456ebcbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519512, "uuid": "2bf8dfd1-f1d8-4099-8f94-89f525f6fcdc", "comment": "Malware payload", "value": "4561110c87c0adfc6c7a4595364618ab3815edb9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705519512, "uuid": "74e4f055-89cf-4ce1-b8d6-5c9f8702aee9", "comment": "Malware payload", "value": "3e4e035215e2d0a702ae1037abfe08dcc6ea6687c7f13feed624e5c83000443c60c87bac1c4c827a45ddc4549cd84953", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519512, "uuid": "4f810b03-0fd5-4eab-bb50-64390b62df97", "value": "T1F103F12A263DF490E588C972DD52C9F83414FCA21DC09EA32AC5BF6F2D32952D46617F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519512, "uuid": "7c24f83f-f88f-4295-8a31-a1f38be0b9e8", "value": "19efc9e40325dd618a0e7bcf9d6da050", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519512, "uuid": "6ca486b2-1235-478f-bfd8-a57fd8aae932", "value": "384:/TI0axWs3ECsTisxYQqO7pVYYHe9sEejY+sKsTKs3EE:/pMuZdqYpuYHeWjgCE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705519512, "uuid": "37f88cdb-847c-40d6-b544-c7c25bf81204", "value": 40963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705519512, "uuid": "2d3b72c0-a5e9-4624-b228-312538d15ba1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705519512, "uuid": "cb01866a-f85c-4571-b92f-6ced1e089de5", "value": "SecuriteInfo.com.Virus.Win32.Virut.20470.15578", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "524b8369-b4e8-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Loki)", "timestamp": 1705462040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705462040, "uuid": "403c7f9c-e71e-4e17-86e5-841059785475", "comment": "Malware payload (Loki)", "value": "80ff9a80b47b90ca0a752f8e284a3744", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705462040, "uuid": "4b732d82-9e90-4a8d-8428-1ff11dcf6a47", "comment": "Malware payload (Loki)", "value": "ce6acf3fe7ca9978fcb0183042d1f210cc3003b4a9f8e349c3afe093c954aece", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705462040, "uuid": "2dba38ec-fca4-46a4-ae4c-d2129a8a729f", "comment": "Malware payload (Loki)", "value": "6c46e2cdf70e869025d975e2b9e8a9a6c85344c4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705462040, "uuid": "e77f7b57-0012-4b2e-b13b-bfb5f9fdffe3", "comment": "Malware payload (Loki)", "value": "838ad64e907f1debc90fa94e15cd1bedf1fa3717df893a9a32028a4ab830a18d0224b69f79beb87632452a7d89239e5b", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705462040, "uuid": "3497e7f6-ce39-4378-bbf1-fa3b822d3552", "value": "T1CEA4BF4077D1C76CEBE59239ADED41D02730DA889441B30EB9FC171DBAA37284DABA35", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705462040, "uuid": "ccce156b-4d07-497f-857a-ee23eec8becd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705462040, "uuid": "c45055b5-7ced-4179-b6e1-a1d7263242f9", "value": "12288:eByg8fGSh9wNfEOO9q134XfUGbpkKzfmx:QmfGSgNfEOv94PNpke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705462040, "uuid": "65ea3bcb-6ed0-405a-8f31-ca8ac1a4a983", "value": 457216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705462040, "uuid": "8fae2025-87c1-492a-bc5d-2aa2877a9e1c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705462040, "uuid": "40fd6540-192f-4159-b8ce-a781459c738d", "value": "taskmgr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20c3331b-b555-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Blackmoon)", "timestamp": 1705508772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508772, "uuid": "afccc52b-c2aa-4c4c-8562-d054310234d8", "comment": "Malware payload (Blackmoon)", "value": "bc6da13176887a094ff712a2e2a58ba4", "object_relation": "md5", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508772, "uuid": "3afd1c82-ff10-48d2-9704-96c3c8af91bc", "comment": "Malware payload (Blackmoon)", "value": "cede6ac238893e42da9d3df998429d991ff02cdcd018f7de4e7b379c3d5fdc6a", "object_relation": "sha256", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508772, "uuid": "8cff3e5b-f762-4f84-9438-d46b336c051a", "comment": "Malware payload (Blackmoon)", "value": "e67aff93f62eaf757b3167d86936cb71d653c8cf", "object_relation": "sha1", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508772, "uuid": "4da7107f-5745-404a-932a-abba76560f9d", "comment": "Malware payload (Blackmoon)", "value": "b68c6f796aa7f6f0d6d65c4930dce13df475087111c9f622b30d86ac4adcd2dd3e4933c9a7a89e904ee03976c1113885", "object_relation": "sha3-384", "Tag": [ { "name": "Blackmoon", "colour": "#939E03", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508772, "uuid": "4a116904-157e-4cca-9f6e-4ce547482a71", "value": "T1FD83F21A4E28C48CE5626F304825D5531A74FF2D85D8C32D2971BA49BCFB7E07B0972E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508772, "uuid": "2ff0bab1-7e22-4b4f-a7b1-bdc0916d4976", "value": "89523eff4ca37903b76c5903ed31cd4f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508772, "uuid": "e02d4e59-1fba-4f1c-81b3-61b125a9b3e3", "value": "1536:qZye8psDhdvoYIflDvf+RBe50UE8Feu6JsuDTpU0WyTwJg:6vdvYlDvWRBeiUDTBwVU0H8O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508772, "uuid": "18055679-152c-4e54-bf7d-a80788259f58", "value": 86832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508772, "uuid": "45397d16-1938-4de3-920b-95ae6afa5c34", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508772, "uuid": "13a68832-9957-49ef-b79f-b602a31c5031", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c21ee3a5-b590-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705534383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534383, "uuid": "00c92c39-1281-4fc4-ad69-9335702f097e", "comment": "Malware payload", "value": "025c9c1d81a59636b571bdeb5771e88b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534383, "uuid": "eb41a24c-82e9-4ca0-aa41-bd797509cf10", "comment": "Malware payload", "value": "d16f4df6d0a0b0993748bd01ffd6f4ef8bdf1a57399f4310583986b9fbf0be40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534383, "uuid": "99ac5063-02f4-4b66-8555-e2a03cea5719", "comment": "Malware payload", "value": "1699b594612cb29084c10117dc17762ee94c2f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534383, "uuid": "46a19f1e-5b67-4861-9dbb-6a1f6519c473", "comment": "Malware payload", "value": "e2615a9fc105fbaba48a0f191eb1ee6b84fd8ab9e17880592e62f314417527aecb7139faf39bea477f1a3384ee09384f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534383, "uuid": "aba670aa-4a71-4c00-bf39-7a3a88fd4efe", "value": "T1CC65AE0F735A03E9D4B68934DA96E317E37578601B2086EF67D40F56AF9F2E0193A702", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534383, "uuid": "18afb885-be3a-489f-a69a-33d7a8950b47", "value": "a98fcc30097a9893402b8be27c43a74b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534383, "uuid": "2321c5fe-524a-45e3-83c4-61884f25ec74", "value": "24576:iJgvkMzSYAM9YSlbczEpQizftQDc06WogeOfQr0W:itMzLAVStcdiTgFoR2A0W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705534383, "uuid": "e7780cac-6636-484d-9dba-bade8d54b2fd", "value": 1425408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705534383, "uuid": "2622d2a2-8f9d-4073-87c0-2a95d3cf740c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534383, "uuid": "cb8614dd-007b-4abc-a390-23f6b0e2cd6d", "value": "SecuriteInfo.com.Trojan.GenericKD.70761216.13841.26789", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b3dcaa7-b559-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705510588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705510588, "uuid": "cd63f3f4-b1e0-4285-a7b5-8aedc3cc663e", "comment": "Malware payload", "value": "b0c3ebc717d0adb164ecff17218d5573", "object_relation": "md5", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705510588, "uuid": "b9faea57-1852-46e6-95f3-2450e4b7c10b", "comment": "Malware payload", "value": "d1b6808e43617e6891feb4a2b77e9ad32f9673762829f68e7a1975d48ff8f7c4", "object_relation": "sha256", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705510588, "uuid": "462e2cb8-0031-4ff9-ba2a-9d3d635edf56", "comment": "Malware payload", "value": "2fde8bc6dd8e5c5a0a1b84050ef5df57faa34504", "object_relation": "sha1", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705510588, "uuid": "7f81e2f9-1b7d-4548-ae16-e76ccde36241", "comment": "Malware payload", "value": "eb66c51acb95d0ed80cb02bf3901a0d1a36a19ae56272171b05e1e082b94100a3ad7ed4b07c13ecbc2a9a7bdde7a5846", "object_relation": "sha3-384", "Tag": [ { "name": "Andromeda", "colour": "#4A29BD", "exportable": true, "hide_tag": false }, { "name": "pdf", "colour": "#255549", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705510588, "uuid": "46fd2f4d-eb5a-4356-9cbb-7b371a081f06", "value": "T1A5339434FBDBD3958B47995C913E3E736B9191C410D0A6A30D2F4C1BA488F768A43ABC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705510588, "uuid": "0b2d5e46-43a0-4037-be95-1271030dacb3", "value": "192:TOapHXfyVWVZ5GWa2pxTZmE3tu8cSYZEunf:KAsWNGWJpxPu8cB9nf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705510588, "uuid": "9d4504e5-1157-4ece-9a11-a6bb6f140813", "value": 51946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705510588, "uuid": "67cc0b09-c27d-4d4f-b931-697d0439a9c3", "value": "application/pdf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705510588, "uuid": "08efae96-db8d-4acc-a3f7-42e99a9e4f1b", "value": "FedEx Shipment Arrival Notification AWB# 00117980920.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2600753-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705502198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502198, "uuid": "1176cca7-1558-4e29-a8b1-c4b675f911e5", "comment": "Malware payload (AgentTesla)", "value": "d3884d224ce536dc38eaa3ff21b0d6c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502198, "uuid": "6614f91c-e6df-43b6-84f3-301c7274641f", "comment": "Malware payload (AgentTesla)", "value": "d4f631141b62ec7340456ce59f120131123450255dda02a5fa298e753782e491", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502198, "uuid": "16508c76-1ff9-4499-8553-73984840f19f", "comment": "Malware payload (AgentTesla)", "value": "f3a1a84a0e7a2da14bbf36de44d3ee11dc5982cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502198, "uuid": "eb62d51e-82a0-431d-abc0-b58aa70b5ce6", "comment": "Malware payload (AgentTesla)", "value": "a1d919e2c6aa25c2525ce66e0777ce8a68fbabbeebb59297bcfb2004805330208ebb54f1805d6989a4a644d94a70dc85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502198, "uuid": "ccd3e34e-9947-4c76-abb8-fdfab1366b20", "value": "T17325F01536749133ED44C73408F26E14D2EBEEAD2BE1A61925C8B66D2B316FE8F039C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502198, "uuid": "20675dae-7a4a-4a56-8bab-04daaf12fffe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502198, "uuid": "5bf7f975-8b7d-4eff-9970-a792adbcd9ec", "value": "24576:UeqsNxM3yk7wSgGp90ACrfKp+JD2KDH2Ka:txdSgDEQSKDH2Ka", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502198, "uuid": "f1badb91-6ab9-4a02-8072-1c2f762e800b", "value": 1053696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502198, "uuid": "da687a06-46e7-4518-9eee-dda41d143b55", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502198, "uuid": "fe951af8-806a-493e-9e32-b2aa62df2d4e", "value": "Payment Slip (SWIFT)\u00b7IMG.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bf686d-b590-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705534380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534380, "uuid": "ac1ebe4a-c87d-4fc6-b1c5-1aed0d34ca5d", "comment": "Malware payload", "value": "eca58abd2b3fdfdde6f1f710933106db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534380, "uuid": "fea40930-f475-4e45-b565-c0a2210b34c5", "comment": "Malware payload", "value": "d6129782008ef7b311bc4c3f513067ba99acfd6afbaea447af511257145bfc08", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534380, "uuid": "2dbc0e81-4e52-4f54-88c4-7502c494f765", "comment": "Malware payload", "value": "c18e99f7a4a86bb3ec6f12615c8df42e129efddb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534380, "uuid": "0774f3ea-80c4-41d8-870d-2b9883236309", "comment": "Malware payload", "value": "2205e116be3694892fdc44dfb3a3b81f26c33faa22047a345657e9a4811e8d6b53dc9e14bdc1c03834e777295fc784a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534380, "uuid": "7acfc2de-587a-4641-bfcb-13cc5a24ccf8", "value": "T1FE6533228B6BBEBFDC7D04B45D3C926667DD47B6711B0358206705D8CFD0E2207B26A6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534380, "uuid": "e9359a2a-8c08-4cd5-a22e-f5bd56ba5690", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534380, "uuid": "5f13f5d7-cb75-4e08-8430-b3863c2d697e", "value": "24576:xYXvpYjHR4uto+Oj+F6Kfo8GUd5g/6TzxzrCQ6kRGWjmy0JdGJejw6qLxEqSuiIN:b2uSnjQoPZ/kxqZy06fOqSuhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705534380, "uuid": "ad01c747-abbb-4175-b56e-b2ffd6629431", "value": 1529344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705534380, "uuid": "1f162503-0cec-49df-a677-1a7233fc584f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534380, "uuid": "0eaa5159-80c8-4979-98d4-1d2f2f648a3e", "value": "SecuriteInfo.com.Win32.PWSX-gen.24221.17365", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d434188-b53a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705497196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497196, "uuid": "376aa115-e01e-4190-976e-9f1c0a106bbe", "comment": "Malware payload (RiseProStealer)", "value": "6831bae11d01a5fa8989d0a1677a9fc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497196, "uuid": "f0b73618-5801-453e-8f69-9c0edf6f12da", "comment": "Malware payload (RiseProStealer)", "value": "d699e268d8f668913689aa0174d80debc04823e59b0aced6ff60dc71df1434f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497196, "uuid": "b07d08eb-dacd-46eb-ba8f-544fa9a92626", "comment": "Malware payload (RiseProStealer)", "value": "3a2833a59afa468adc4931513240a8362c3fbf8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497196, "uuid": "7f243d0e-cf59-49c7-b94c-f4a538808714", "comment": "Malware payload (RiseProStealer)", "value": "23d1ed7746c9a5207faa5a03fed36b17917ae4fe0ce91d9fec5d7d9d273f0e454293e9108364df2cad941fad005b2418", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497196, "uuid": "ab24ad3c-d578-478d-a634-6c30650cb132", "value": "T1E75633152FD02525C54CA6788613FE3C33B57E3504678B0BF995BBDAFCB2998613AA03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497196, "uuid": "fa011f51-1d7e-463e-a534-a6cf50dd7363", "value": "28cc55450edf4eab5f9510f1b709a4a8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497196, "uuid": "bd908c23-d035-4073-9aac-34a5efb4f0dd", "value": "98304:6g+5oSER97qu2JlgXWJWmOvoamrWmFlGIKHQ20cPRgivSXDNXUWNJRqkGu/6CD/k:6g+5a2JlzGTmnfMPRg1zNkU6kLD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705497196, "uuid": "29a175b1-3ef8-4b10-ae06-9459a980fd5f", "value": 6010368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705497196, "uuid": "1e84f69c-0b6e-4d3f-88ad-e768a7293d1b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497196, "uuid": "347d024d-9b86-4f0b-b0dc-46e24b034b01", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151d8827-b51d-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705484700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484700, "uuid": "6f1c2b72-d671-4cd7-a588-e3fd5d0af503", "comment": "Malware payload (AgentTesla)", "value": "477a2bad4bea469f4982e54db43cb16b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484700, "uuid": "799661c1-9e05-45e2-958a-05a16122060a", "comment": "Malware payload (AgentTesla)", "value": "d6ffd6ed5a5563bd8abb12e4346c1a732fcc69406f7b934038ffe08ea509a71e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484700, "uuid": "decd97a7-5123-4522-adc8-13c013826dfd", "comment": "Malware payload (AgentTesla)", "value": "6639da9a3830990c1894485cfc4ecba8cd829ed1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484700, "uuid": "66564e66-4e83-474c-8811-5617fd2e2795", "comment": "Malware payload (AgentTesla)", "value": "e31272100a2df753e3e61d23e6c5d9c92f28eb4500adc481df404f39413983b730f48dd70dd77b33c9f494704f0f476a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484700, "uuid": "e89a5cee-d39a-41cb-9461-ac3efba31e5d", "value": "T19CF412447AF51B06F0BA8FF894A9995803B5B6622523D33C0DC278DF1672FC95A80F5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484700, "uuid": "8c95ebf2-6942-4422-9536-e6faaed4f175", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484700, "uuid": "ff62e64f-108d-4667-a456-af1e3642e03c", "value": "24576:/CGSUZaIQeSAqwxLPR2FTMG5jpkNlkJX0:+IQeScxF96V0qJX0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705484700, "uuid": "558845ee-d220-41a2-b907-a670b64751c4", "value": 790528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705484700, "uuid": "3eace1ec-e655-4476-ae3e-05d04e721cb8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484700, "uuid": "f5b06b96-779d-4231-a18f-66d88662f3fe", "value": "PO-78232321,Sarsan.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "109071a0-b4fd-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705470949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705470949, "uuid": "e9b731d4-47f5-45d5-a69f-64ef425e84a6", "comment": "Malware payload", "value": "b724b7b724854f8bcc44505303036f41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705470949, "uuid": "9533ebbc-f962-455d-94fe-446ff679dad8", "comment": "Malware payload", "value": "d7d7fe29c6c71216afceb7185e7dbf5349b8626fa5dccfcff0c553002a206b32", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705470949, "uuid": "5118de80-d144-41ef-8bd1-631d9eabbaeb", "comment": "Malware payload", "value": "dedd9e315eb832a3fd658b8698d70f6ab89973c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705470949, "uuid": "737b9a52-d030-481a-8486-6d8277e0b528", "comment": "Malware payload", "value": "720a9dfe0d18ca23082764ccd7aa99e0b2560d8b23c5361c560f5965cb278a8d9bc1db7ce8b3040ddce6fe1e0bf3b150", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705470949, "uuid": "e8a7fdb9-98e3-4aa1-b160-99336904f0a2", "value": "T1B75533E0A249C8AFC24D96F0D090F91143307B3AA26875AF326B47AE2B6F515F1D7D1D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705470949, "uuid": "a4ea918d-d36b-4b5c-80b0-727aa95197da", "value": "fc5d3d653af3c3decf6e755f0007c4f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705470949, "uuid": "30c0e37e-10ac-444a-9e6a-ea8d964128b9", "value": "24576:LjV1Lcuz3wB/E3u1zYHoMw6fKD959IJoJNZJw8VWnhYUHLAy5Tyiz0:L/5e16U6A9593pDWOUrN5Tys0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705470949, "uuid": "0ee75d29-b937-466b-9665-ccc69ddb2053", "value": 1389056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705470949, "uuid": "e67d7584-48ac-4a00-91e5-f2c2574947fd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705470949, "uuid": "b7abe3d9-c5be-4526-87a3-5da83fc5f3ae", "value": "b724b7b724854f8bcc44505303036f41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2a67fe-b53e-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705499182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499182, "uuid": "a26917e6-59d7-47b4-8aec-85a910e7555f", "comment": "Malware payload", "value": "3133c80e73257392bf2a48532b334930", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499182, "uuid": "21a67fd6-66df-4312-8eaa-9764363819c0", "comment": "Malware payload", "value": "dab1bc725537fd108f5bfab274982773c68e9ef8d14d3412495cbcfdf1f04f70", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499182, "uuid": "f2df3f54-6b05-41f6-8da7-930ddee2ad3f", "comment": "Malware payload", "value": "0af9b23e1b3667d5f14403ec82ce2901ede6ff29", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705499182, "uuid": "9ae51a0b-d88d-4f5c-bb81-634d88beefef", "comment": "Malware payload", "value": "a7f50121ec384f0c2c1299bf996a95bd391080b01b2a159ac992a8c080f2c52f993b71e75092a81545d8e1965ed560ec", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "PlanetsTherapy", "colour": "#A55C4E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705499182, "uuid": "0c41fd91-650e-406b-90bf-35c864f7c2e2", "value": "T18FF73358ADCB34F7C03435F2B2F5655A340746035EF8E79198DA3A6EE06500AACF97B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705499182, "uuid": "88b838a0-5211-41ca-888a-f48d5d3abe52", "value": "b34f154ec913d2d2c435cbd644e91687", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705499182, "uuid": "9ee8860f-8d48-4956-b851-60f624af5763", "value": "1572864:w4/4rzOchPc4HXwwCpbfJdHYil6/MsLsBSEJ/10MwKztSWVkTl287:jkqcdhHnC5Rei/sLsBd/VwR/Y87", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705499182, "uuid": "f28831e9-96a3-4d72-adbd-ca266d4ca154", "value": 74823917, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705499182, "uuid": "b954330f-3ced-4faf-a5b6-9060623b002b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705499182, "uuid": "fd53a7d4-f12c-4589-8ecc-2e7301c52d33", "value": "PlanetsBeta.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b5b826-b567-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705516449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705516449, "uuid": "ad537a23-7a48-421b-bca9-e91ee0c97a8b", "comment": "Malware payload", "value": "db9508ac835fce4dcfcc49a9e24817d6", "object_relation": "md5", "Tag": [ { "name": "2023", "colour": "#5F3B3E", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705516449, "uuid": "0b4f1f89-cff9-4ddc-b7cd-fd73b562f1c8", "comment": "Malware payload", "value": "dc91b1ac776b4780ee4235b286cf9f695d308ed8de8a7c8b8d983cce0630c926", "object_relation": "sha256", "Tag": [ { "name": "2023", "colour": "#5F3B3E", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705516449, "uuid": "8a0e9fe3-4ac6-4a76-8782-35597b837f44", "comment": "Malware payload", "value": "d019ce318b55578e22161a5001e6e5785915a027", "object_relation": "sha1", "Tag": [ { "name": "2023", "colour": "#5F3B3E", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705516449, "uuid": "9c5a043c-d543-46a0-a399-54dc1d09a16a", "comment": "Malware payload", "value": "18d03193ec219c0420176a03011af7de13fdfe11b789db6b98a0ba66ae22badb28603867aca72cb8ddb144fdfd6d540b", "object_relation": "sha3-384", "Tag": [ { "name": "2023", "colour": "#5F3B3E", "exportable": true, "hide_tag": false }, { "name": "KjGtqi", "colour": "#2D840C", "exportable": true, "hide_tag": false }, { "name": "lumma", "colour": "#810EF3", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false }, { "name": "ViaCrackSite", "colour": "#2F39F4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705516449, "uuid": "3ad3daaf-fff6-43f4-8ff6-99a7ce610766", "value": "T164063368F491298B59DFD235FEB13FF940E4163AFED45860D19A008C8B05F6DBAE1B48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705516449, "uuid": "f1208c4f-e4f8-4d8b-ad5c-697f5b89b7cc", "value": "49152:fh/gqS8YudyEmIF20qMRU9z5czcek+G96O/iN9+/i89Fx1mxMoR6GLye9UtA5:fh/+Q/F20hC+BYiN9V8/x1mx5RjjS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705516449, "uuid": "3d3d139c-66be-4e42-a3a2-1bedecef74d9", "value": 3802974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705516449, "uuid": "b55c1841-0b30-4f5b-9d1e-b1982fd41256", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705516449, "uuid": "e0b55c8b-cb20-480c-9b9b-ee13cf1acdc8", "value": "Mega_FullApp_Setup_2023_PassWord.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b357fb4a-b521-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705486684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486684, "uuid": "c3eec473-a9f3-47bf-855a-ea060104749f", "comment": "Malware payload (RiseProStealer)", "value": "cb3c3161bcfce424582f2a80355073db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486684, "uuid": "e4c08cf3-c8a8-4410-9ded-6497d13ce780", "comment": "Malware payload (RiseProStealer)", "value": "dd185ca279dd748be5d8008878262f90177eff706f884a128ce51d77da423870", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486684, "uuid": "da6b9f54-209b-4688-bdeb-3e4a9d494924", "comment": "Malware payload (RiseProStealer)", "value": "de7f5838ce71ebd79313a174f45898704332da61", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705486684, "uuid": "0730fa36-bb8c-494d-a3ba-997b27c250af", "comment": "Malware payload (RiseProStealer)", "value": "36e644cde39f60ed3e3839ee3f9bac82089868d7aefa34bd5d22af2aac0717987f5e8ea6cb52114e0483e865a762aac5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486684, "uuid": "a5963bb3-1e9d-4012-81ac-7a6d6489ed48", "value": "T1D59523F23BF4859CC2C82BF527B2E96652D2ACE6CF514EDAE5D71862370B9D05E0110B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486684, "uuid": "58a52cdd-5cbd-4954-964f-63c651bce5da", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486684, "uuid": "54361e5a-89bb-484a-b14f-e6ec54e4013d", "value": "24576:OEbYH5BHl+8QHrBTj3PFqy0pZMsrLytjP/iZP9hbtxg2ocQVGE3zQyFyPwPdXfL:1mBFXQHNTj/FqBkgx9hB7XaGSjF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705486684, "uuid": "7ecabba4-6131-4f17-9f5b-dfcf56351cea", "value": 1875968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705486684, "uuid": "2020c125-bf04-4e86-9e0c-30b4928d358e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705486684, "uuid": "6f910257-0957-40d1-b41b-9aabdcaaed4d", "value": "SecuriteInfo.com.Win32.TrojanX-gen.851.1054", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1de79b8-b55a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705511216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705511216, "uuid": "eec115c8-7f19-470c-8fb1-420f8e518a47", "comment": "Malware payload", "value": "0b1f2960e0047c82de95dcebd5152cc6", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705511216, "uuid": "86b15438-3d5d-4998-be66-4b1287e03df1", "comment": "Malware payload", "value": "dd207767a10c3a271f9695f82cd3185049eb45a53ea38e994d95293f70b5fe2e", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705511216, "uuid": "41ac226c-e404-4b42-a5bd-53a903043df4", "comment": "Malware payload", "value": "5aced3fb181a459b9883b492039d9951bd378abe", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705511216, "uuid": "8f521da1-063d-4c28-a7cb-1434bc1e5ddb", "comment": "Malware payload", "value": "28d04a0745af35369c8cdc3bdf8baa2c503d867d9f2812d12355a6a76d9926a87e3c5446ebc57aec915ec361a8e34ecb", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705511216, "uuid": "ac38b1f6-d906-4aa3-91ad-cee64eb4c964", "value": "T1D86412663513C66BC2C3787A4EC2C0D35311FC125A529A4F78E8B76E0E7B781C7A2B56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705511216, "uuid": "8e781988-99fd-4010-829d-a3ce6f22c9cc", "value": "6144:HFfSHBMixiMK6G+ZFrTUvCp4sJg4UI8K5f+udH7rBD746S0:HZQpozwjTqCfgFo5f+iHfqF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705511216, "uuid": "3d5216f0-55e2-46c0-9e06-fc06ace61830", "value": 314880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705511216, "uuid": "66852f82-a733-465a-bd98-f5682ce0cf3a", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705511216, "uuid": "b6e64b65-e9c9-45f5-a53b-9ad02124580b", "value": "MT103 0216009430 - Anun\u021b de transfer efectuat.pdf.xla", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4974851f-b51d-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705484788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484788, "uuid": "b3a4836f-d2b9-42a1-a6f8-8077a23618ed", "comment": "Malware payload", "value": "161b9794d775fcd1a255c3d02acc5139", "object_relation": "md5", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484788, "uuid": "18ed9204-00c7-4324-aa68-c3624f700b37", "comment": "Malware payload", "value": "dd7c2ff45bc2771c82096e8166e051290af473907472ff821e2c4f177c80df2a", "object_relation": "sha256", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484788, "uuid": "106f2815-1f0a-4f5a-80e5-33796ac1331b", "comment": "Malware payload", "value": "8cf228ebc24d03ed0fa3404a2016d6a8ae98240b", "object_relation": "sha1", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705484788, "uuid": "aa5c4705-67de-40be-bb74-e6130f831fe5", "comment": "Malware payload", "value": "3346ca480a5ecf8703a3193fa5a6a6a6d60cc3236cc2991045e9373ba9d316aa5d8034f525bf6793654095bf5ca91ad0", "object_relation": "sha3-384", "Tag": [ { "name": "cve-2017-0199", "colour": "#B8DD67", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484788, "uuid": "c4796462-6379-4b16-8997-2f5b7af86a9c", "value": "T1B0942354F769F3BBD05B07780E11005E434CFD25AB99A18718BBF3D8A138F98A52968F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484788, "uuid": "76fe4cbf-2146-4f48-a0a1-c6e27070aec8", "value": "12288:eaBC6uEHsu8JAkng0dhTVSOoPXFbQUrBHwRhh/Q:Jw6/yAktXZSOlUrBQj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705484788, "uuid": "64200055-2715-4066-a224-5d7761accd7d", "value": 431104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705484788, "uuid": "e2097ef9-5a2f-4e49-964c-f3e4c4b274ba", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705484788, "uuid": "268d095d-2d79-44ef-a966-851abfbef657", "value": "BILLXOFXLADING.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8b9e57c-b53a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Kuiper)", "timestamp": 1705497430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497430, "uuid": "3a311a6d-77a6-498c-954e-66fa2f89dec5", "comment": "Malware payload (Kuiper)", "value": "84820f3eb491a2fde1f52435cd29646c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionA", "colour": "#7CF454", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497430, "uuid": "0cf1d0a6-72b0-4d14-9add-73af1d9959b4", "comment": "Malware payload (Kuiper)", "value": "df430ab9f5084a3e62a6c97c6c6279f2461618f038832305057c51b441c648d9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionA", "colour": "#7CF454", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497430, "uuid": "a11d071d-ae60-46ca-9439-e167bacff401", "comment": "Malware payload (Kuiper)", "value": "8c6e135495fcf8898de62e6793e3cd06d3025461", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionA", "colour": "#7CF454", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705497430, "uuid": "29dfcf00-18df-4b64-881d-e4dac919fb0a", "comment": "Malware payload (Kuiper)", "value": "04decaca5a04f835ad64c9f1eba0d3ba40f99cee68890ea17c58fac047dd5bc6dd5dff6622a27b6725b1d2a8dd808d6c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "golang", "colour": "#7C2D0F", "exportable": true, "hide_tag": false }, { "name": "Kuiper", "colour": "#C74B9A", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VersionA", "colour": "#7CF454", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497430, "uuid": "48601620-90a6-423e-a346-c4b17f951cbe", "value": "T169B53961FDE780B2E503293144A7A2BF67317E094F30DA87DA107F5AED73AA10D36619", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497430, "uuid": "e8a8e2dd-39d1-40ca-8d71-ee56c45604e4", "value": "9cbefe68f395e67356e2a5d8d1b285c0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497430, "uuid": "c68cf3e4-31fb-4e2d-8488-a616d908c1d9", "value": "24576:8J/+56Kus0jCcT8kgTe5Gq10TgoFf25QVDGxkl2JM6ioM93gBFfMEzNiYlg055Ws:8pFg0MYq+W249vZGqsCz9/K7E8gx1z1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705497430, "uuid": "6d4c941e-576b-485a-ac59-1aece2aadab8", "value": 2331648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705497430, "uuid": "2d871ac5-aaf9-410c-8a50-8e067c1f01c2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705497430, "uuid": "f3b03de1-062f-4e06-b3c5-6bd0a69239f1", "value": "A.Windows", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4209203a-b539-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705496802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705496802, "uuid": "fb7f915e-227d-4d0c-829e-7b4178fc7afb", "comment": "Malware payload", "value": "714f61fdbf29ea25fc1a8c3db764c6f3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705496802, "uuid": "8a79a070-607c-4719-816a-2fa67d2ff0de", "comment": "Malware payload", "value": "e1f0c2ed20c25b89bb7d70385ef04aca0cc33e2ef16ecb92c474733c8f046c48", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705496802, "uuid": "b9af99e5-aebe-4e71-89ba-cd3eeb641e10", "comment": "Malware payload", "value": "9472c8867038209efa2925c6b3ecaa3e5189e73e", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705496802, "uuid": "a4443c43-8a0e-4f6c-b650-424f6c159ff5", "comment": "Malware payload", "value": "984e49ca0d105464dbab5443116ec59078fb55db0ee68d2ddd8c6f6572eb29d185813d7df4292ca19edf79afeb78ecd6", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705496802, "uuid": "aa7258cd-22af-4132-bdd9-542aebafd7e2", "value": "T17DE24F1526FE910CB1F37FA52FE5B9E54E6FF771252691AD1014030B8A63E80CDA2B72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705496802, "uuid": "46553893-b579-4b99-aac3-374463d0f496", "value": "768:dIk0M/0M30MXIT0MYR5k30qwzyLtJ0bt1YyZ7fF:dIkP/P3PXITP+ypJ0jYkF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705496802, "uuid": "f0b98cb7-02ff-4f9e-8739-3fd750c68d56", "value": 31872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705496802, "uuid": "5b378c87-86c8-4503-8a88-0e58804b056e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705496802, "uuid": "8f1d3925-399f-4ad3-a937-b2437fa77d75", "value": "slim man.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e27151fe-b585-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RedLineStealer)", "timestamp": 1705529712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705529712, "uuid": "2461619c-bbc5-41d8-af65-1f6467f5f14a", "comment": "Malware payload (RedLineStealer)", "value": "a7d458984cd041e231acf88a8968d61d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705529712, "uuid": "fd51af54-2462-4cad-9bed-f9a8bc8ba303", "comment": "Malware payload (RedLineStealer)", "value": "e3842ce1a944ba370db991ddb782fc0baf4bd1bdf1215f90abac4f3c14400487", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705529712, "uuid": "44adbb2f-e7fc-4d06-b0c7-2d2ab17bb760", "comment": "Malware payload (RedLineStealer)", "value": "e1a0df74a9ff8983e05d309ac80e0516571c83bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705529712, "uuid": "387be85a-90e7-4415-996c-822e5a2a7cc1", "comment": "Malware payload (RedLineStealer)", "value": "2eb30b8f2edc1e350a3d73897e04f10ff028a327544e642ab5b0b4c00c5ed8128e935d48885e16c7ab97068793cf0283", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705529712, "uuid": "583801a4-e842-4be5-a351-2a9c9e0f3fc5", "value": "T1CA662276727ACAE2C0554732B9929123373E9D727F170B7331B8361F0E723519AA92B4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705529712, "uuid": "060171ec-c8af-4fd6-927f-357fe0407a7f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705529712, "uuid": "c532301b-4726-4e9c-b57c-5cfec71ba50d", "value": "98304:6/1FK8uWvXodPOTZgMVv2wNN/ZlFZIShcvsY8722fjHno4:6iavEmTZgMVvNvxXZdO5872Wj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705529712, "uuid": "915cc1c4-6754-4c97-8627-751632c5a219", "value": 6838145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705529712, "uuid": "31eabc51-3634-4bd6-b6d4-efc285053211", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705529712, "uuid": "16653845-9138-4059-bf4c-d58b4519cbde", "value": "E3842CE1A944BA370DB991DDB782FC0BAF4BD1BDF1215.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6462d5b0-b50b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705477102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477102, "uuid": "63896dc7-94f7-4e63-a34a-60de70cd6817", "comment": "Malware payload (AgentTesla)", "value": "79bf78dd8c34cd2a1d3682d4bb829453", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477102, "uuid": "119340d6-3a33-4510-b693-d7c2ff5fd35f", "comment": "Malware payload (AgentTesla)", "value": "e62db78af11ac6a634634768e714627547a1f57fe6abbdb21c7afd5285e26cf4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477102, "uuid": "8248ab96-41be-4752-9c43-8eaf86503381", "comment": "Malware payload (AgentTesla)", "value": "25c7241d66a4cd4a233f403d34a0881a39d593f0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477102, "uuid": "00ab5a3d-0901-442a-9e96-be65f681743e", "comment": "Malware payload (AgentTesla)", "value": "47fc7c8e637361e3aed1ac0a2c631dd58e03c88e7a80a5ac23cb58c680b1f248d14adf0a21d44dc6496601854593a90d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477102, "uuid": "9784a39b-f7d7-4a9a-a961-37c4e92c6644", "value": "T119368D15ABE405D1E067C630C96BEB32D3B2FC560632C70F1964D64A2EB36B15F6B326", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477102, "uuid": "2f730cac-cc46-45d7-b2e7-f553b6572ef7", "value": "c1bd85c47a3d2c5743df7292e01168a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477102, "uuid": "9c0d1f55-602b-4ecb-9cf4-46f00922d42b", "value": "49152:8EBjW7C63fLbFW5vVODJDi9PQ+uFNMb/6qwJfLsZpXy+Mw:gY9Pf6TA7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705477102, "uuid": "82c055b1-5c4f-4dea-9565-d4f7980b0f6b", "value": 4922368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705477102, "uuid": "064c9177-2570-4087-811c-e9e73169a690", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477102, "uuid": "47ea27fb-de74-4e41-8ddb-8e5b115f56cc", "value": "INTERSAGO_AWB_F645537744.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f3b89c4-b544-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705501575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501575, "uuid": "95a12c40-9144-4e20-8096-599eee0cd626", "comment": "Malware payload (Formbook)", "value": "27bf00621c8bfc604a50a3ed989d3edb", "object_relation": "md5", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501575, "uuid": "43738622-0a3a-4b93-805d-d65ba5fb647c", "comment": "Malware payload (Formbook)", "value": "ea0d508838824f307834ad0175e5c033295b29ee52c79e1aaaa43c4cd3453d34", "object_relation": "sha256", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501575, "uuid": "9e0ca607-b4e0-4e29-acbd-557926bc639e", "comment": "Malware payload (Formbook)", "value": "bc76ee457023a6fc86d38db228fa33453789f029", "object_relation": "sha1", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501575, "uuid": "1d3d6537-b1ef-4ac4-8c61-70c396178b6f", "comment": "Malware payload (Formbook)", "value": "384926bc8248487d9fa6eb63cf181c50062ab1c2da2f7c6eb30b31d9dc9f453684a218dc537615058d2d7129de2ac739", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2017-11882", "colour": "#945F25", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "For", "colour": "#774D5A", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501575, "uuid": "6c60102b-0262-489a-beeb-867801cfa8c8", "value": "T14AB3CF6DD34B02698F6213779B1B1E5542BCBA7EF38452B1306C533933EAC39A1252BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501575, "uuid": "05b2b0c7-5200-4dbd-abf7-63b7380a5c15", "value": "768:UwAbZSibMX9gRWjtwAbZSibMX9gRWjZTqBz60qiVVVohlCamLhIU3S9Ck:UwAlRkwAlRbBW0bVohlH+hIQqt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501575, "uuid": "8c31b9af-ca9d-4173-8cdc-7f4cc544bce0", "value": 108782, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501575, "uuid": "af980a2b-09af-4725-8c94-425003308f34", "value": "text/rtf", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501575, "uuid": "52b839b7-c886-467e-8ad3-25e320425907", "value": "Customer_Requirements _Pricing.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6043c85-b545-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705502150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502150, "uuid": "c0bb60cb-5bac-4f64-b4f2-7b1eef1cf53a", "comment": "Malware payload (AgentTesla)", "value": "bd44fbdabbdd65f30c762affb4a3c559", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502150, "uuid": "890a273f-ff63-4d48-8498-014b31d60a0d", "comment": "Malware payload (AgentTesla)", "value": "ed02a2ae00a8ecc81f06f53547274e174259f4fecd1abacd502b6ae4a5408598", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502150, "uuid": "a7db5cdc-c41f-44ee-8cdc-95f031d2c2ae", "comment": "Malware payload (AgentTesla)", "value": "2a3a347aa97bc94f561e365302fabf4de509f204", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705502150, "uuid": "7fadd2a4-fd06-45f9-a1e5-95d807fe7467", "comment": "Malware payload (AgentTesla)", "value": "eba1511a339c7fae252f4f8ab8d036f87b1d503ee6b6fbf2f749634bc39c959de03b1149f82659cdd513b1eeb216639a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "scr", "colour": "#9C5D43", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502150, "uuid": "82b61f5a-6f53-4529-a661-cbb88b30ce46", "value": "T13CA57CA573FC1A52D5EE9B32A5F81A1587B3EC10EBEAC31E154478EC483676D4A03B13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502150, "uuid": "23730f6a-044c-4d18-b258-819e79f511cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502150, "uuid": "48d54abe-c5dd-4676-8d5d-22c7f1b5e750", "value": "24576:t3/BFmkgKIQi2R2kT0cuH3UCI5QjzjwqpHWloQ6UwSZcS6B9Vu3LkrK0ErbvjRhP:UBQijtcuX/jzsqplxBl5akrKdM8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705502150, "uuid": "e2a10958-3c6b-4c70-820f-97274bedbbf5", "value": 2249968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705502150, "uuid": "a02e5295-bdb1-41a0-ba67-ba4d30c41bad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705502150, "uuid": "3a023b12-5dff-45f1-a784-7f2c8586fb1e", "value": "PO OAU_JANQTRFA00541\u00b7PDF.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8cd903a-b543-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705501349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501349, "uuid": "9849e3d8-2a7f-4f19-b96a-ec521bf2961a", "comment": "Malware payload", "value": "0d447d480c60b9a215a27274452e0cef", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501349, "uuid": "540e104b-ec2b-4515-8b38-135637b8e1d4", "comment": "Malware payload", "value": "ed531801b5b3b9d9acf36c8a26b184cea8d6eb639efb7b8d95a4c3c15bef0f02", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501349, "uuid": "81474efd-c864-488f-b397-4770e0351771", "comment": "Malware payload", "value": "a8b374a55c3733a18208df26fb084ae7ca578337", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501349, "uuid": "3f7c79d1-a9d7-4ada-b97a-791784b18c44", "comment": "Malware payload", "value": "0550fe38b0d9061e68ff939690f3114f00d7c5396abf3d23ba8ef45f555444f83ce3f7be6a422d4061372ad5420977b2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501349, "uuid": "96fcfac4-44cf-4029-a691-4046f5eef08c", "value": "T1C7566D337345AD3EC05A0B3A482BA75495BF7A712A1A8C5B67F4088C8F3D5817B3B647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501349, "uuid": "85f152fd-215f-42a7-8719-b652cb8a3def", "value": "49152:azwWZizIP+y0IZJSKcrEu/RUoVX8noNWzbh5mCv9UyrlYSlZAvmKnoX8r6F5mCmR:ddk+OoVX8noWdv3dAvko6cYvA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501349, "uuid": "ca2a8be2-54f4-4fc8-889a-f6fa350cdb1b", "value": 6152192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501349, "uuid": "d5888f25-7d8f-4f76-b57c-c58b4e9b00de", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501349, "uuid": "fda48848-ac06-433b-8460-4962b7e8a7dc", "value": "TRANSFRVIERNES-A4-TLLTK_ESM160122244222024.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42f1ce03-b54c-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705504964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705504964, "uuid": "d49dc402-ae56-44c5-9057-7b528fad99a6", "comment": "Malware payload (AgentTesla)", "value": "7547a8f171604d74d6436f7983c7a91d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705504964, "uuid": "a4565052-2ffb-4801-9cc5-d42a3aa4cd23", "comment": "Malware payload (AgentTesla)", "value": "ee0c5f720625ad1cd24714bf731e85419098b62c6f335af5e296342ec65c7a23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705504964, "uuid": "e8085d07-c29c-45e6-9e8e-1b78293a3d02", "comment": "Malware payload (AgentTesla)", "value": "653faad88f8455594f8b1cdb1a00c16313032ef0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705504964, "uuid": "9bd283c4-27a3-42eb-bb93-2df3eaad1afd", "comment": "Malware payload (AgentTesla)", "value": "ad1ac539dd67920d4ba747b3bb103fc554076b498069c3e26fae4d3003af92c48c589ccdc348bfe2ca3ea8bcb87b306a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705504964, "uuid": "201fdb4d-5c5c-4ed7-ba7c-f29771bf53b2", "value": "T18074020A3B69645BE16C97F991B3910007F5E629B491FBCE6CF931E810E1B815281FEF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705504964, "uuid": "dfd36001-1664-4a16-ac7e-95c8edcfab78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705504964, "uuid": "655fe1ce-125d-48a2-bd5a-0b7b472c8e3b", "value": "6144:hOtz1yPOECnjLDpnU63aQ4i71gWbZpz1UnWqNn+UDrQFXq/5OQ4kQ:SIPYLDpnU63aY71gWVpxPCzMF+Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705504964, "uuid": "eb0cd35d-0c1b-4ce6-afbc-8233b3ccf556", "value": 351744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705504964, "uuid": "8f7b714d-ccd4-4938-8b0c-6c994cc632be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705504964, "uuid": "25eb9dc8-de91-4c52-8f69-14d38b3e9bf9", "value": "7547a8f171604d74d6436f7983c7a91d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c053750f-b4f7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1705468667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468667, "uuid": "3747cd97-b661-4d71-9c34-898e804bb27b", "comment": "Malware payload (SnakeKeylogger)", "value": "3e0881ac7a644e8fdb414f8eec2bd86c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468667, "uuid": "4a244a81-f8b5-4489-999e-7b8c449eb5dc", "comment": "Malware payload (SnakeKeylogger)", "value": "ee682a222c0cb6eae0f8bb8270fb96b76832f05df316de82e1e3a3e86b59ff83", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468667, "uuid": "eb59c0bc-3000-4549-9f62-0b573794294a", "comment": "Malware payload (SnakeKeylogger)", "value": "6292fa75c4952485b158b3e311a787ffe7178db3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705468667, "uuid": "537eb50c-5dfd-408c-9fc4-dea3731410d8", "comment": "Malware payload (SnakeKeylogger)", "value": "0ef4adb03d6dc9c739aa63d6d52561a2d2d47be62cfe3930f8aaf66072c7e0f594aaa5dc5fab334c437a696aaa4a2ed6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468667, "uuid": "bfeff452-1f2e-4011-a8f0-c3de4c1b8cb5", "value": "T19AC42300B75C817FECBA55B780E31264233395246951FE59AECB7ACA10F5F904EA2B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468667, "uuid": "0ae33577-895c-4dbc-93db-7835cf93974e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468667, "uuid": "4874fade-0d08-49cb-9aea-c09bbb1c9cb4", "value": "12288:iePFLVoq3Fsohj1gJoDvhK4LDjzYHUgmGR4qOy9QfhWscftPg7xG7RJ7DN:iePRVoMFDPgJoDv9fYHUNG9Qfhhcf5OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705468667, "uuid": "fa4f0c69-a3a6-49cb-abac-b7f5199f2b9e", "value": 569344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705468667, "uuid": "20654de8-ba22-4b0f-a135-35718c6b2ac9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705468667, "uuid": "10d86cc3-28e1-40c2-af98-876ef39e7180", "value": "SecuriteInfo.com.Win32.PWSX-gen.23109.5216", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed48e146-b563-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705515128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515128, "uuid": "edc084d1-7441-4c8f-a12c-bd00270f2a51", "comment": "Malware payload", "value": "dee0c3f92f82b1bda81a843705be5471", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515128, "uuid": "0ba9ec91-8c2b-4fbd-bc3d-4cdd0c969d06", "comment": "Malware payload", "value": "eec118e973e7d3c98fa42d2002f5db5f72bb260bc9a46ccf0af922b833411550", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515128, "uuid": "6a663f06-51e0-4ed9-ad39-1e7a86416ce3", "comment": "Malware payload", "value": "a1f870854086d316b4b2b033d79ac2a357750075", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705515128, "uuid": "a7298a8d-3d1b-4f30-bb0c-334e6be6c1c5", "comment": "Malware payload", "value": "e09beb86e8e96eebc3d0631515cec99146b3531dc040ae823e6c6266ebbe09c64efe4c76255d10b5db2a59ffed843dc7", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515128, "uuid": "e9257094-2560-4b5a-98f5-fa783e1095fc", "value": "T1BBF047B2D21E6400D50675359A0B4FC4DC070A74461E7F47859BD60740F32637DA4D3B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515128, "uuid": "5a5a2e0b-4def-4e0d-b9c8-fa023c144fa2", "value": "12:5jsNPlHFaC80h4m+MB99dTi3FcCjrdP9jIv2ittRuYN5ptaR:9clQCl+MB9XiVc+rnj+24q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705515128, "uuid": "e6862dcb-de1d-46e9-b558-f390f3a8a529", "value": 606, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705515128, "uuid": "0525c54f-1a25-451e-a41c-90a76b4a1b2a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705515128, "uuid": "2f235524-030b-4eb9-b3b7-4909cde8fc4e", "value": "26586807.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "414914c5-b52a-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705490358, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490358, "uuid": "7cd9e9f2-a118-49e9-80fe-21a38b3f73ac", "comment": "Malware payload", "value": "f8f5fc0ba41cc1dd515cb5b828e45995", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490358, "uuid": "a8bf4846-48af-4ba3-ae45-dbc0f5ad5bbd", "comment": "Malware payload", "value": "ef3b18766f4446a86472a6f88c121984a3e6fc7f1e0f730195ced2e857e2e690", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490358, "uuid": "db0e4dc6-418c-4311-8a21-00c8cac7d5cb", "comment": "Malware payload", "value": "78ba8dd26f2761cae764b7bb148f79a8fa23c1b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490358, "uuid": "3429af19-30ba-43be-9b92-15100c858a92", "comment": "Malware payload", "value": "eac2d19808038aebacfe7c0bc39ab89748d908f963cbc990e887e76f813c4d76e3dd8eae2b5d18c3e82749eeeb5696e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490358, "uuid": "c55f3267-072f-48ed-804c-412ecef9be88", "value": "T139553345BA57F24EC50BC934003760228BA8C0A752F6F1177971FB9B226F7BB17690DA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490358, "uuid": "ef163337-7045-42c5-a209-587401863a38", "value": "fc5d3d653af3c3decf6e755f0007c4f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490358, "uuid": "acb487c5-dc7b-4de9-bbb8-28cf433cc000", "value": "24576:SLNdyA9w/9EM6kkWRRLd1JK8bFbDWTXxiN5h/oNu1Eovy4ecjvvuB7i:4Nd/G/9hXRLduq8co+EoviSvO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705490358, "uuid": "47d0fc02-ae48-4ca1-ba1b-13e0ad7f1a13", "value": 1389568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705490358, "uuid": "c893b487-a146-4513-9932-3c780373d0be", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490358, "uuid": "7f39cfbc-e310-4c06-9543-56471ec7c30e", "value": "SecuriteInfo.com.Win32.PWSX-gen.22082.3798", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db3d0de-b50a-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705476715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476715, "uuid": "1dd9416b-8f9e-4af0-94aa-249526488780", "comment": "Malware payload (AgentTesla)", "value": "6d05b95db543a0495aeda340aee2ff60", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476715, "uuid": "ac6e63eb-2b6d-4178-8177-e37650256c8a", "comment": "Malware payload (AgentTesla)", "value": "f03a4dce443898bf27dd2c0a1ce87738f44cc232e690976bcafb3c3b63b3d467", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476715, "uuid": "d56f4da6-3682-422e-9839-279c5e6aff4c", "comment": "Malware payload (AgentTesla)", "value": "0a5e96b3fc8bdd8f307e975bbe1e1620c99e42fc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705476715, "uuid": "9866f181-a80a-4664-9319-0e9b86f2537d", "comment": "Malware payload (AgentTesla)", "value": "60b34f24efb11dcbd9d7cf8911c0d9c987c6497a81f8f3a3187fd913ba1975eca702893dd1e784d1bb83985ce8ad9ddd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476715, "uuid": "996555a9-124f-4420-92b0-faad60ee9844", "value": "T1B2C4F19177D1CA2DE8F64B35F4F944061B31EE889491E71B7AFD112C2F63B084AA7722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476715, "uuid": "4b0b7801-fa5d-4e88-a83c-62d4952bcdd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476715, "uuid": "a2f5791e-bc17-4ca8-b056-d6bf2ecdeb6a", "value": "12288:1Jv32oUcIETRuZCTy8J3qhLbkqGfNFkllRSbNH5Sxmf:1t3TXtTwZEyo3rqoNF0SbNHr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705476715, "uuid": "8dbc1a10-172a-4ef5-bbc8-85d2a15a332c", "value": 584704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705476715, "uuid": "70c2b133-ed27-44ea-9633-3d8469320b4b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705476715, "uuid": "5b5ed017-0697-4782-8976-1506f9d37b7d", "value": "soya crypt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c479a98b-b590-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705534387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534387, "uuid": "e24f197d-7c73-4593-9dd3-f6aef027607e", "comment": "Malware payload", "value": "001f325cfc6eb661fef35a7f0f42af85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534387, "uuid": "0a97cd10-3e82-48cc-857c-66eaa8f6bd65", "comment": "Malware payload", "value": "f06d68e2cc43d22a83140814998a24956e3471a15b5dcc44cc222c1bda995d1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534387, "uuid": "e8f520c3-7fcc-4378-8e40-3fdc40b1b023", "comment": "Malware payload", "value": "b51429e4caf711429edd8de02fa5fcccf62060cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705534387, "uuid": "47c05cee-0447-46e8-898c-28507d3e4d0a", "comment": "Malware payload", "value": "9924f720ab50ba7be660a2eefe9367962bbf73b20305e9910d4217ad25e13f29c65743241e0b22547b9b896ea6213dfa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534387, "uuid": "0733b652-5aec-40ff-8757-8ed5a0fb0eac", "value": "T14644BF513B58C538EAB78B36887253E4A63AFE059405CF0E09C1365D5E7B7C3C922EE6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534387, "uuid": "9b55c35c-6078-48e7-bcdf-75f9bed42d96", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534387, "uuid": "ae0ad1ad-11fc-4638-bee0-94cd7efa8e31", "value": "6144:WTHGwliKbvH+zwGnAQPxpkxV4F9vFdEt87L:wPAUHI7J57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705534387, "uuid": "3fa40c8b-af65-4637-a46c-92eea8934947", "value": 261602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705534387, "uuid": "ccad00cf-84a7-4267-a899-f30a4a6a884e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705534387, "uuid": "76312ce4-2421-4cbe-87c0-a23242322361", "value": "SecuriteInfo.com.Trojan.Crypt.8226.28479", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddff9d7f-b501-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Amadey)", "timestamp": 1705473011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705473011, "uuid": "4102e8e8-9402-43a1-92c4-142ee8a4f517", "comment": "Malware payload (Amadey)", "value": "1711fbb2b67eb266df0a5396a8862db5", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705473011, "uuid": "bd2db781-b69f-46aa-8b37-d0f58c9809d8", "comment": "Malware payload (Amadey)", "value": "f26e377ce95895c9d2da1482b565eff58aed2104a63825e175038985c3739d04", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705473011, "uuid": "52fc18da-ea39-4843-af00-e4fbfb421122", "comment": "Malware payload (Amadey)", "value": "c7079f28c51bbe519989982060bffa05c925a73d", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705473011, "uuid": "b6c4b8a1-80a1-483b-9e81-169930cfaafa", "comment": "Malware payload (Amadey)", "value": "6381b166752f42a5bf7f7a67aa6c6d6e9b2f4211454850577b7e41d7045f204a048606a1d2604e26838262784f8bccc2", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705473011, "uuid": "97eaf4b2-8071-40d9-8cb4-3893cec12634", "value": "T1F8369E06A7D805D5E4ABC730CAAAD333D6B2FC260734874F0411D74E5EB3AE55E6B226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705473011, "uuid": "3bfd07d2-add0-40da-8f4b-a8e26a17bf32", "value": "c1bd85c47a3d2c5743df7292e01168a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705473011, "uuid": "cb48f7d6-3126-482a-96d7-18518ea4ad79", "value": "49152:14rRPa0AyMAJwb4XGwlbSonkIEAPuF+c0xOGUOPnVStiHuFnY:LI1b6IEUO1OPVS8qY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705473011, "uuid": "fcb164cd-5a4b-4a59-8269-bcd6d843d81e", "value": 5014752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705473011, "uuid": "08d4a528-0e74-484f-ad46-93b13f07fba8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705473011, "uuid": "ca2b7d94-9f2f-41f6-a186-bdb3a9522c10", "value": "1711fbb2b67eb266df0a5396a8862db5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5327ea9c-b50b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Formbook)", "timestamp": 1705477073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477073, "uuid": "8da63786-3487-4725-bf59-890519991945", "comment": "Malware payload (Formbook)", "value": "e7bbc16183e0e1b7ae8a9a4f7317e5cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477073, "uuid": "954aa66b-9a90-413c-b8c0-847634b8a71e", "comment": "Malware payload (Formbook)", "value": "f4394572b606f03890726b8ab03753c450d539bc0c3ef57310a32ec17d869159", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477073, "uuid": "d033e7ac-ecf4-4a77-92a9-3d22aa9b804d", "comment": "Malware payload (Formbook)", "value": "8e77c5057da1ce7da562e612204e5ac1d7593410", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705477073, "uuid": "7c7bd15f-f6b6-4a3d-999d-054fabe6abf1", "comment": "Malware payload (Formbook)", "value": "06594ac4e602658e06afb8477d4b4d72d626ebb763455f081b1649ac37f7419eba0fb08670acc8ca2bbb94676a2c5a7b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477073, "uuid": "4a8a4c8b-fc71-4317-af68-b608c90402bb", "value": "T1CE826C846BE81203F9EB1F31CAF791E3EFB9B2131562AA1F2DF480552E4634010553BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477073, "uuid": "78b6d856-30bc-44a6-a771-86f7e9d3884b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477073, "uuid": "45574db3-7d86-49b3-9897-16f95d6ec0d3", "value": "384:L7P3pzoeYpv0KYvlqKYvlWmVGoGCJEF8ZpHoCB:fPYpv0KY9qKY9LtEFiR1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705477073, "uuid": "a9f8d230-2cd3-4c3c-9ad4-547b5a1d5855", "value": 17816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705477073, "uuid": "2beeba5a-da82-4390-b13f-35f0b6606362", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705477073, "uuid": "eedb2175-dbc8-4a62-845d-9fd5cccb6903", "value": "Purchase Order No_15..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ca69439-b52b-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Rhadamanthys)", "timestamp": 1705490887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490887, "uuid": "52faf569-74b7-4293-8faf-548dcb43af12", "comment": "Malware payload (Rhadamanthys)", "value": "74a538098e9d9708e0a5cd283175db2c", "object_relation": "md5", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490887, "uuid": "a7fef5c3-5a4e-490b-b700-be2585086c6a", "comment": "Malware payload (Rhadamanthys)", "value": "f496e7140ca8fd01024714f4b5250d3ded59edbf2f1fadf91709e86d055ca1a2", "object_relation": "sha256", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490887, "uuid": "e18e1306-25f1-4c8f-8235-99c14ae039e3", "comment": "Malware payload (Rhadamanthys)", "value": "ac3156f9fb87898760b41324c5c8c38fb55b6919", "object_relation": "sha1", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705490887, "uuid": "6c81f73f-1232-4861-9a5c-088c718868a8", "comment": "Malware payload (Rhadamanthys)", "value": "34b9ace69fc8ad9479765eb520ec9797ae42ae7398f6c62fc195985827a65ad715bf91801ae6fe4456493b4b6b71d7f7", "object_relation": "sha3-384", "Tag": [ { "name": "file-pumped", "colour": "#D06044", "exportable": true, "hide_tag": false }, { "name": "Rhadamanthys", "colour": "#3D95F5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490887, "uuid": "4960a3a5-83b3-4d19-8849-29c686e998b2", "value": "T114D733D85AD1E4C3ADF047B78DDB598DD19BDB6B406DCC131138250EE5BBEC900AC8AA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490887, "uuid": "c7c539f2-795b-4a11-af7e-3be6aa7f3204", "value": "1572864:/yvwMaMj5G1RnG69tEHacN1pAV5eLep4uN4i5C094PIsKl/q8i8lewNncN7Eyo:/fvMdGPr9t4aczpvLS4umi5C094PIsK5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705490887, "uuid": "78eb0d69-a467-45da-b98a-5c5bdd1a8791", "value": 59437291, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705490887, "uuid": "cac8cede-a2d5-4b3e-8935-b965f23165e8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705490887, "uuid": "98e5b7c6-dc76-46fc-9feb-bdd43d788aeb", "value": "PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8dc4165-b587-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705530582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530582, "uuid": "cb799e2b-197d-4ccc-a314-d539ad481f0b", "comment": "Malware payload", "value": "a5e8111701769f6ee892b47ddb9b4790", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530582, "uuid": "03589d48-acdf-4667-a7e5-f5583b9ac047", "comment": "Malware payload", "value": "f5a3bc0b1c24f8e34b6af56760a6aa04d8fcc33a9a104336364bc1a149027e25", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530582, "uuid": "a02aaadc-01ec-4521-8f2b-2998db24546d", "comment": "Malware payload", "value": "09501abc923db2adba25e47d13a6c16ba0408148", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705530582, "uuid": "9582f1a5-2c31-4845-905e-002b6c580faf", "comment": "Malware payload", "value": "cfd2bbbe900ad9559612abc568cd77ce9448d9a11d174487d3b86e01252b1869a38bdcfc2ca7140c1cc3dd050dbcfdf5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530582, "uuid": "d9231917-4bda-4956-bdb9-16efbc7cc02f", "value": "T1BAD4C09A23224E22C7629B35DA77E7010A50FAB79163C30393C6A33E61177FE5F91746", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530582, "uuid": "4051b866-dff9-4f76-ab4b-ba6f07a700e4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530582, "uuid": "72083db3-6157-4dfe-8571-68efe5fb227a", "value": "12288:64xvwEgazq3eXf3Z6wAyo2ypdg9WdBg9XwBHoI2b:L1lzq3qJIPoWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705530582, "uuid": "5b88f527-4dac-4788-8928-8c235d57f620", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705530582, "uuid": "e2161518-67d9-43a2-aaa8-8bc58a831cc6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705530582, "uuid": "50dd4532-d44a-489c-b5d6-43cde25fb57c", "value": "a5e8111701769f6ee892b47ddb9b4790", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99c2147a-b4d4-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705453570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705453570, "uuid": "3162c788-a27e-4fe5-90be-df38a264a42b", "comment": "Malware payload (CoinMiner)", "value": "927c5713520866a66c7a8ed0cc010c21", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705453570, "uuid": "8969e35a-55a6-46c3-8faa-dd06b918804f", "comment": "Malware payload (CoinMiner)", "value": "f7a16392427028623d3fe7a12d6caeda12b4a08dc4e5174a9193279d412c38fd", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705453570, "uuid": "8ae08dc7-897e-47e4-9423-68ae38726e02", "comment": "Malware payload (CoinMiner)", "value": "1f7624e129a43fde992be6731538b7da25b65cbb", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705453570, "uuid": "cc843a0b-e28a-4f7b-9ae3-9a4a217a5e12", "comment": "Malware payload (CoinMiner)", "value": "2635a9987ad23363e5217b281ae2d94ca306b4031fac8baf50fe4ceafd89178704928e762d5c8e937834b9c9b05ccea5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705453570, "uuid": "538f4336-3f54-4e09-b5b6-14ba050d1ac7", "value": "T168465A01537C8927FE66DAF153E3C01C076DBC3F6622A30B392C792B59FB1A549472A6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705453570, "uuid": "94a66dba-16c0-48a6-acf4-4fc471859df0", "value": "49152:GLddd0ZLXsOX3MJPrJ3Iktl2MAO7XGp8mih7NUfXUu4tEqNrqcqapPeDkwVzMemI:ZKNLXVRG/Mul2rq/aReDkizMeQUz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705453570, "uuid": "9e7cf4b3-4322-482c-b0da-3395da34b237", "value": 5873152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705453570, "uuid": "a17e1146-6f7e-4896-98a6-8457b365ce9d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705453570, "uuid": "6ffd8f58-6f5a-43b4-ae08-88a61a779e2a", "value": "927c5713520866a66c7a8ed0cc010c21", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "983cabc7-b4e7-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Vidar)", "timestamp": 1705461727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461727, "uuid": "9e18ba1d-8db6-494f-aecc-515deb9ce1f5", "comment": "Malware payload (Vidar)", "value": "f5b43cf5212e2cbedaad1b749cf823e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461727, "uuid": "33fe820a-f1a7-4710-b68b-62b92b539bd0", "comment": "Malware payload (Vidar)", "value": "f7ac1e9fa5730ae3d8d8909b0ac56843eed0ddbb1a410aa816f18993297c9dff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461727, "uuid": "59ffb6f4-cfc8-40f0-8968-5e5a69cd2aae", "comment": "Malware payload (Vidar)", "value": "ed94fa5b4987dbbec00a93b1bfc60d6f3e4b9869", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705461727, "uuid": "58f3eb19-793a-4f32-9ff6-56807c358716", "comment": "Malware payload (Vidar)", "value": "3a6079311ef3176cc783a2404fd58f6ec672d7e92d855aded61f459c89719f8189fb2b99a70c7197c738655f323bfb03", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "vidar", "colour": "#BA40B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461727, "uuid": "b69b74a9-91b5-47e3-b8b6-d575e034e8d1", "value": "T1C7449DFE3A84443BD2BC64B8A354DA3556A2E4957E3472973BA0CD6DED323F38C16640", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461727, "uuid": "1dd401be-61f5-4df5-8ea8-6ae56dec5e77", "value": "ea195bf8c93901cc0697df8bcbd3b755", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461727, "uuid": "17367571-4924-49f3-bab8-e68176b1961d", "value": "3072:ETyyh5elkS4QWsT4axJPJH+kQlLsGbMoNOjOXiFx2sX8+5xySq1mhidlbH7c:0OUQd0aRirXiFx2sX8axkPlbY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705461727, "uuid": "122919e4-3ba7-4feb-b3d0-de072fbc63f8", "value": 277145, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705461727, "uuid": "2b7f985e-953c-4afe-8151-52bf8fdfcdbf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705461727, "uuid": "c8cec3cd-8b15-4478-b001-0f83c5e6faf4", "value": "paradise.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9b998d3-b518-11ee-b7ea-42010a9c0006", "comment": "Malware payload (AgentTesla)", "timestamp": 1705482910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482910, "uuid": "ad80c8c1-4146-401a-905e-3285aa95b134", "comment": "Malware payload (AgentTesla)", "value": "e9e2d62c3573248d73f16ce3cf2de4a3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482910, "uuid": "16fd1ee6-246d-4cf4-9b49-e1ebff442de1", "comment": "Malware payload (AgentTesla)", "value": "f7d2723f223abb512d1d36604da6a30de016b4a5160c52271a630162e7a2f763", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482910, "uuid": "c4ff290b-87b7-4eda-8fd0-04a5a5c50257", "comment": "Malware payload (AgentTesla)", "value": "644fc67392a9356be0074c98ad17072eae045641", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705482910, "uuid": "ed4ff9a6-44bb-475c-a5ea-8732be70d50d", "comment": "Malware payload (AgentTesla)", "value": "f12a86a0b37af44085ad00d2602556e900864e7049ca146f82f9992c27d6b514d47d4917b0fa3cecb33d4c942139bb01", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482910, "uuid": "fd6453a2-de3f-463d-b777-3640ea7f1bfd", "value": "T11AE433121E9905C8D7D5B801106AEA0226FF9D35A16E7FF099FD5170D773B993E8CC24", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482910, "uuid": "a95b255a-4e5e-4462-8746-95edcc3f4168", "value": "12288:JB0ePOZLP3LOyHue3XBbh2YImcnltUrX7b3tFUiR5X5/B3Pm3I5NN5USDRsX6p2I:JBVPOZb3LOyHfRVIPl27DUwX5J3PCI5v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705482910, "uuid": "c7a18a8e-5dde-4420-9bbb-40d732386d37", "value": 702955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705482910, "uuid": "d0a3eeae-c036-4c41-92c2-83a6ed42026a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705482910, "uuid": "d4393d9f-47ae-4e87-9d23-67667a72c114", "value": "Purchase Order.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21f088f1-b555-11ee-b7ea-42010a9c0006", "comment": "Malware payload", "timestamp": 1705508774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508774, "uuid": "0026df00-1de7-4de5-b056-c126f014152b", "comment": "Malware payload", "value": "e2653142160ea22eaa31961f452b8336", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508774, "uuid": "4411a567-f751-48ec-9834-be9034bd33b2", "comment": "Malware payload", "value": "f7df2743f68bf9d181b4ee06927328b90420934b1ce9782e1953ac0cea84166e", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508774, "uuid": "4a388829-971e-430b-8edc-5f53b67b0d52", "comment": "Malware payload", "value": "53e9993bc6a3220d1aa8a6bdb1aebc73c7fa864f", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705508774, "uuid": "729ed858-534a-4c8f-ba06-45b2117ecc19", "comment": "Malware payload", "value": "813430cc7da6d8e6d84740f11ece4f316f72f383707bc6367b232dd0ece12a450e984d44f1a780401f5ac6ed27c7ab9c", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "MSIL", "colour": "#2D22DA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508774, "uuid": "24d6264f-b4f0-47f4-8ce7-276a1d040b8e", "value": "T13422E75547EC4533EA7F0BBC9DF7624247B0AB2A0D13FF9E21C891CA19467800D91BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508774, "uuid": "1418a462-a83f-4d24-93ae-455d83090262", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508774, "uuid": "932b8450-52c7-422e-a686-77f757354823", "value": "192:o6FHHavN+kTI4jMdRSXp3W4H+I+EwOVEVz19NQF:o6FnavN+kcLXSZ3W4KEwOapQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705508774, "uuid": "55131356-bf28-4005-9639-6b5be35dcd1f", "value": 10240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705508774, "uuid": "843db669-61ed-44cf-808a-30b4d45982a2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705508774, "uuid": "898251da-2270-4b0b-b7af-0d01cf1cd560", "value": "file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f81fff-b4ed-11ee-b7ea-42010a9c0006", "comment": "Malware payload (CoinMiner)", "timestamp": 1705464254, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705464254, "uuid": "9987a137-9f49-4ec9-9e85-180857e6ef9a", "comment": "Malware payload (CoinMiner)", "value": "bc690d37ae8395cb25a8657db1d370e8", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705464254, "uuid": "9c05b6ae-a7e4-44e2-923e-178a67fcca88", "comment": "Malware payload (CoinMiner)", "value": "f882cbd19bca7935fb6d2214f305299399dec452b9db794cc4f97b1a1104c538", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705464254, "uuid": "cd45beb1-b5ae-4941-9948-42edea908357", "comment": "Malware payload (CoinMiner)", "value": "ede0c4b82a9b4107fe4432643f886059944b4ee6", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705464254, "uuid": "fc470779-f894-46b7-8bdd-21b3416b8d84", "comment": "Malware payload (CoinMiner)", "value": "0e576eaff30a2e647a87bac62ce4e6b1e69e2d24bebe766cca9c78e1b7c65cec849afd7440de37f5d09a77e9b7799535", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705464254, "uuid": "f4b11376-da57-45b0-8557-f1ca4a8573b8", "value": "T1A60633D184F97829C1E919FE037C32D624C42A69B355EF05BFE9FB06B6A3451F240D29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705464254, "uuid": "5a3d58ba-c3f0-47ea-a24f-8ed87b6f7fd0", "value": "a9c887a4f18a3fede2cc29ceea138ed3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705464254, "uuid": "105bd914-2e1a-4a8b-98be-a7c49fa3a7ae", "value": "98304:UXDDWMyNVmf2ILDVGDgRdWiN0d1nbudqP4X+u0dOW+M8xFZwnzTu:UzDWMDV2gRdfN81nbDPQyOXMw/wz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705464254, "uuid": "3d4048b5-1e9f-4b8c-b50b-7794cae14bd4", "value": 3924480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705464254, "uuid": "5815a162-5963-4d43-9812-9e72efc65ee0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705464254, "uuid": "90af581d-22d3-40ac-8a3a-7068431289bf", "value": "Discord Grabber.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81df4d82-b4ef-11ee-b7ea-42010a9c0006", "comment": "Malware payload (RiseProStealer)", "timestamp": 1705465126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705465126, "uuid": "e410554c-be2b-4939-bb89-7dc7063a458d", "comment": "Malware payload (RiseProStealer)", "value": "15efb0762d3cdd00d4cf97bd5b7c3d0d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705465126, "uuid": "906ad75a-6baf-4de4-bac2-edf89fffb624", "comment": "Malware payload (RiseProStealer)", "value": "fca83cf4181e4ee43a08995efd5a18ba353b3f56dc43773cb21a9c19bcc7419a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705465126, "uuid": "fb4a8a5e-3955-41ba-9418-d8093a7b56d5", "comment": "Malware payload (RiseProStealer)", "value": "3155fa3f56be01c3a123f05ba56e68499c1347f9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705465126, "uuid": "901b65ef-1c94-4366-a9c3-c2fb74b84771", "comment": "Malware payload (RiseProStealer)", "value": "6343aa12093b36cde3f14276b1ddaaf03c85534ad8765ad00679f3692836abdd8e675303ed01ba933e3a6296ecb9c500", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RiseProStealer", "colour": "#2C729B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705465126, "uuid": "4267f88c-341e-4b6a-b14e-28f8071af854", "value": "T1E69523F175F8148EC4D00BF5A7B2A95651D04EE9CF020FEEC5A79F223B136D5AA0A427", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705465126, "uuid": "054c33ec-ed46-4a43-9084-83b9ba453cc0", "value": "1e453fd81736fddb1b5f5ce807c79734", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705465126, "uuid": "fc30fe14-25f6-4f9a-96ad-7c3e274ade2a", "value": "24576:qu+wP8WTXiUAsJsegbW1gKlWcQN+uJZBjnICNfqfDdn5MTSjvMMb7XMrKOTQOgen:zqUAsuen1LQ/tFqf1RkMXOKOTQOnhj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705465126, "uuid": "6649a574-317b-4886-b82b-9a116d5c361e", "value": 1876480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705465126, "uuid": "e56b646a-4e85-45f6-9b22-1ce3a71f693e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705465126, "uuid": "aa5fba00-68a7-40a3-96a0-680d2ccefeb1", "value": "SecuriteInfo.com.Win32.TrojanX-gen.12004.28645", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6770ec1b-b544-11ee-b7ea-42010a9c0006", "comment": "Malware payload (Stealc)", "timestamp": 1705501589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501589, "uuid": "adf81d93-5af8-41e5-8ecb-60534b1c3017", "comment": "Malware payload (Stealc)", "value": "c7b1dd9f72808b5026483820783fb31e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501589, "uuid": "9d1af246-47f1-4449-9eed-baade4d7e169", "comment": "Malware payload (Stealc)", "value": "fd0c4ce27e4c30e616b791bde30ffd351faeb416aa3e3717fbf023c41d3c374a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501589, "uuid": "b747c30e-da86-4e59-aa6f-7c914229100b", "comment": "Malware payload (Stealc)", "value": "a23a180c3a5b7540ab361816e2e6d3de898cc848", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1705501589, "uuid": "ebd7e732-1f23-4422-88f5-53f70e1b41e8", "comment": "Malware payload (Stealc)", "value": "fdf870eec742ce93bc77d5454dd6046e792e0d57f73e9c98a0e72171d7828f1dffedbe0508f059892ad511343b469061", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Stealc", "colour": "#D401CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501589, "uuid": "4c65da4a-890a-4030-8e18-959db5f47337", "value": "T11B54F793B2917C45EA364E729E2EC2E8771DF6518E49776E2128EF2F04711B2C1B7B10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501589, "uuid": "b667a3dd-2a8c-4c9f-940e-a8ac6c6dc734", "value": "efb0d5efee037e1ff512c9170e95e7b3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501589, "uuid": "6ed4bf0d-1f04-4a74-bcb4-d95e10e04665", "value": "3072:P9CLq8sLogNxfjJMpzbWxKQPE1OG5rJKTYdTjMgJOU5KscU+cRTBq0:lCO8sLhNxjJMIAQE1L5FIGMgEsldTBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1705501589, "uuid": "99762d5f-28bd-4c44-b3a8-4173ae8dfc47", "value": 289280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1705501589, "uuid": "c6ea3202-27b8-4137-8e72-d36022b14116", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1705501589, "uuid": "d355081f-fd59-4931-a592-a08b977797c8", "value": "c7b1dd9f72808b5026483820783fb31e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }